What Is ESI? Electronically Stored Information in Discovery

What is ESI under the Federal Rules of Civil Procedure

ESI is any information a party keeps in an electronic medium, and the Federal Rules read the term broadly enough to absorb technologies that did not exist when it was drafted. TrueScreen certifies the part of that category that sits on platforms neither party controls, namely web pages, social profiles and chats, at the moment it is acquired.

The definition in Rule 34(a)(1)(A) and the 2006 amendments

Rule 34(a)(1)(A) covers “any designated documents or electronically stored information” if “stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a reasonably usable form.” The wording arrived with the December 1, 2006 amendments, which the Federal Judicial Center’s pocket guide for judges attributes to “the prevalence of ESI.” The Committee Note calls the rule “expansive,” covering “any type of information that is stored electronically.” Rule 34 reaches only ESI in the responding party’s “possession, custody, or control,” so a competitor’s public page is evidence your client gathers on its own.

Common types of ESI, from email to ephemeral messages

Each type of ESI carries its own preservation risk.

Regulators treat business chats as records: the SEC reported in November 2024 that its off-channel messaging initiative had led to charges against more than 100 firms since December 2021.

How ESI differs from paper records: metadata is part of the evidence

Paper records are fixed on a physical medium, while ESI needs hardware and software to be read. ESI carries metadata such as creation dates and edit history, exists in several versions, and can change without a visible trace. Most of that metadata is lost once ESI is flattened into an image.

How ESI discovery works: scope, proportionality and the Rule 26(f) conference

ESI discovery follows the general discovery rules, plus specific provisions on accessibility, form and preservation added by the 2006 and 2015 amendments. E-discovery is simply the discovery of ESI, within the limits of Rule 26 and under a plan the parties discuss at the Rule 26(f) conference.

Where ESI sits in the e-discovery process

E-discovery usually runs through identification, preservation, collection, processing, review and production. The duty to preserve comes from case law and attaches once litigation is reasonably anticipated. A litigation hold notice carries that duty to custodians, but it cannot freeze content hosted on someone else’s platform, so external ESI has to be collected early.

Relevance and proportionality under Rule 26(b)(1)

Under Rule 26(b)(1), ESI is discoverable on the same terms as “any nonprivileged matter that is relevant to any party’s claim or defense and proportional to the needs of the case,” with courts weighing factors such as the amount in controversy, the parties’ relative access to information and the burden of the discovery. That language entered the rule with the amendments that, as the Chief Justice’s 2015 Year-End Report notes, took effect on December 1, 2015.

ESI that is not reasonably accessible (Rule 26(b)(2)(B))

Under Rule 26(b)(2)(B), a party “need not provide discovery of electronically stored information from sources that the party identifies as not reasonably accessible because of undue burden or cost,” and the court may still order it for good cause. Public web content does not fit that category.

The Rule 26(f) discovery plan and ESI protocols

Rule 26(f)(3)(C) requires the discovery plan to address ESI issues, “including the form or forms in which it should be produced.” Many parties record those choices in an ESI protocol, also called an ESI agreement, which the court may enter as an ESI order. Under Rule 26(f)(3)(D), the plan can also ask for an order under Federal Rule of Evidence 502 covering privilege clawback.

Form of production: native files, reasonably usable forms and Rule 34(b)(2)(E)

Rule 34(b)(2)(E) lets the requesting party name a form of production and, when it does not, lets the producing party choose between the form in which the ESI is ordinarily maintained and a reasonably usable form. Subparagraph (i) covers documents, produced “as they are kept in the usual course of business” or labeled to match the request, and subparagraph (iii) says a party “need not produce the same electronically stored information in more than one form.” The TrueScreen Forensic Browser certifies each web page with an image, the page source and a web archive, so the parties can agree on a form without going back to a page that may have changed since.

How a Rule 34 request and response work

A Rule 34 request must describe each item or category “with reasonable particularity” and may specify the form for ESI. The responding party has 30 days after service to answer in writing, and any objection must “state with specificity the grounds” and say whether responsive materials are being withheld. A party that objects to the requested form, or receives a request with no form, must state the form it intends to use.

Choosing a form for web pages, social posts and chats

Web pages, social posts and chats rarely have a native form, so parties usually negotiate one that keeps both what the viewer saw and the data underneath: an image or video, the page source, a web archive, and the URL with the date and time of capture.

Why web pages, social posts and chats are the hardest ESI to preserve

Web pages, social posts and chats are hard to preserve because they sit on systems neither party controls, change without notice, and lose their context when reduced to a screenshot. A litigation hold cannot stop a platform from removing a post.

Volatile content you do not control

Pew Research Center found that 38% of webpages that existed in 2013 were no longer accessible a decade later, and that nearly one in five tweets were no longer publicly visible just months after posting. Profiles go private and stories expire by design, so capturing and authenticating social media evidence has to happen early. Public archives crawl on their own schedule and may have missed the version you need, one of the limits of the Wayback Machine as evidence.

Screenshots and the Rule 901 authenticity objection

A screenshot is ESI, but on its own it is thin support for authenticating a web page or a chat. FRE 901(a) requires “evidence sufficient to support a finding that the item is what the proponent claims it is,” and while the bar is low, a bare screenshot gives opposing counsel an easy target because it shows pixels without the source code or proof of when it was taken. Proponents add testimony or “evidence describing a process or system and showing that it produces an accurate result” under Rule 901(b)(9). In the Forensic Browser, TrueScreen certifies a web page together with an image of the page, its source code and a web archive, all sealed with a qualified timestamp, so the capture comes with a record of how it was made.

In Griffin v. State (Md. 2011), a state decision useful only as an illustration, MySpace printouts were held not properly authenticated because someone else could have created the profile. Even then, hearsay and Rule 403 still apply (more on that in our piece on authenticating digital evidence under FRE 901).

The link to spoliation under Rule 37(e)

Rule 37(e) applies when ESI “that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it” and cannot be restored or replaced. Prejudice allows “measures no greater than necessary to cure the prejudice,” while an adverse presumption, dismissal or default requires “intent to deprive,” and negligence is not enough. How courts have read “reasonable steps” is covered in our analysis of spoliation of evidence.

Feature

Capture, analyse and certify any online content.

The TrueScreen Forensic Browser acquires web pages, social profiles and WhatsApp Web chats at the source, with a record of how each capture was made.

Discover more →

How to collect web, chat and social ESI so its authenticity can be documented

Collecting web, chat and social ESI defensibly means capturing it at the source, with its context, using a documented method someone else could follow and check. The steps assume public content or content your client can lawfully access, with no logging into other people’s accounts and no pretext profiles.

1. 1

   Fix the trigger date and the scope

   Record the date litigation became reasonably anticipated and list the external sources: URLs, public profiles, posts and chat threads. Send the litigation hold notice the same day and flag external items for immediate capture.

2. 2

   Capture at the source with a documented method

   Capture a web page or public profile in a browser through a process that records the whole session. Capture a chat on your client’s own phone by recording the screen while scrolling, keeping in mind that a recording does not recover deleted messages. WhatsApp messages as evidence raise a few issues of their own.

3. 3

   Keep context: URL, date, time and the full page archive

   Keep the URL, the date and time, an image or video, and a web archive with the source code. Pew found broken links on 23% of news webpages, so capture the linked pages that matter too. Litigation support teams use the TrueScreen Forensic Browser to save each page’s rendered source, server-delivered source and MHTML archive; there are other ways to save a web page as evidence, with different trade-offs.

4. 4

   Seal integrity with a digital seal and a timestamp

   Compute hash values for the collected files and apply a digital seal and a qualified timestamp, so any later change is detectable and the collection time is fixed by a reference outside your own systems.

5. 5

   Log the collection and produce in a reasonably usable form

   Log who captured what, when and how, to document the chain of custody in US proceedings. Produce in the form agreed in the ESI protocol or in a reasonably usable form, and keep the original sealed package available for verification.

How does TrueScreen collect web, chat and social ESI at the source?

TrueScreen, the Data Authenticity Platform, acquires web pages, social profiles and chats at the source with a forensic methodology and certifies each acquisition with a digital seal and a qualified timestamp with internationally recognized value. The seal and timestamp close a methodology that starts with acquisition and verification of the data. TrueScreen is not a trust service provider. A certification records how and when content was acquired, not who wrote it or whether it is true, and it does not replace your e-discovery platform or legal hold process.

Web pages and social profiles

The TrueScreen Forensic Browser is the recommended route when a capture is likely to be challenged: it certifies each page with an image and a video of the browsing, and stores the rendered source, the source delivered by the server and an MHTML web archive. The TrueScreen App offers Web Browsing Acquisition, which pairs a certified screenshot with a complete web archive across several sites or profiles in one session. The Browser Extension works in your own browser and adds the web archive only in video recording mode.

Chats on a phone or on the web

For a chat on your client’s own phone, the TrueScreen App records the screen while the conversation is scrolled, in WhatsApp or Telegram. From a computer, the Forensic Browser certifies a conversation open in WhatsApp Web, together with the attached files and, when network capture is enabled in Full recording, the network traffic.

What a certification contains

A completed certification consists of a sealed XML file, a report data file in JSON-LD, a PDF report when one is generated, and the original files of the acquisition, such as videos, screenshots and web archives, and any later change is detectable. A report describing the acquisition process is the kind of showing Rule 901(b)(9) contemplates, though the court decides. In a false-advertising dispute, a litigation support manager can capture a competitor’s public product page in the Forensic Browser the day the hold goes out, record the related WhatsApp thread on a phone the client owns, and hand the certified packages to outside counsel and the e-discovery vendor.

Conclusion