10 Custodians, 14 Days: CFSI Handles Large-Scale eDiscovery Using Forensic Collections and the Top-of-Class CS Disco Review Platform Preferred by the Legal Community for Review and Production

By Lance Sloves, CCE, CCPA | Computer Forensic Services, Inc. | Dallas, Texas

A practical guide to collecting, processing, and loading ESI from computers, Office 365, OneDrive, Teams, and cell phones into a review platform — fast.

If you're a litigation attorney staring down a two-week production deadline with ten custodians, each generating data across computers, email, cloud storage, Teams, and cell phones, you're looking at one of the most common yet operationally complex scenarios in modern eDiscovery. The good news? This is exactly what Computer Forensic Services, Inc. (CFSI) does every day.

In this post, we'll walk through how CFSI collects, processes, and loads electronically stored information (ESI) from a real-world scenario — and how we get it into an attorney's hands for review, tagging, and production in as little as two weeks using our hosted CS Disco eDiscovery platform.

The Scenario: What Are We Dealing With?

Let's set the stage. Your client has identified 10 custodians relevant to the matter. For each custodian, the following data sources need to be collected and produced: 10 Windows or Mac computers (hard drives, locally stored documents, browser artifacts, application data); 10 Office 365 Exchange email accounts (inbox, sent, deleted, drafts, and archive folders); 10 OneDrive accounts (cloud-stored documents, shared files, sync activity); 10 Microsoft Teams accounts (chat messages, channel conversations, shared files, meeting recordings); and 10 cell phones (text messages, iMessages, call logs, app data, photos, and attachments).

That's 50 distinct data sources across five different platforms and device types. The opposing counsel expects production in two weeks. The clock is ticking.

Step 1: Forensic Collection — Preserving the Evidence

Before anything can be reviewed or produced, ESI must be collected in a forensically defensible manner. This means maintaining the integrity of metadata, preserving chain of custody, and ensuring nothing is altered during the acquisition process. CFSI handles each data source with purpose-built tools and protocols.

Computers

CFSI creates forensic images of each custodian's hard drive using industry-standard tools like FTK Imager or Digital Collector. These bit-for-bit copies preserve everything: active files, deleted data, system artifacts, and metadata timestamps. For matters where full forensic imaging isn't required, we can perform targeted collections of specific file types, date ranges, or folder locations.

Office 365 Email (Exchange Online)

Using a combination of forensic email collector tools and Exchange eDiscovery tools, CFSI exports each custodian's mailbox in its entirety or based on specific search criteria such as date ranges, keywords, or sender/recipient filters. Exports are captured in PST format, preserving folder structure, attachments, and all associated metadata.

OneDrive

OneDrive collections capture cloud-stored documents including version history and sharing permissions. CFSI uses administrative access or compliance tools to preserve these files with their original metadata intact. This is particularly important in trade secret and data exfiltration cases where file access patterns and sync logs can tell a critical story.

Microsoft Teams

Teams data includes chat messages, channel posts, shared files, meeting transcripts, and even reactions and edits. This is one of the trickiest data sources in modern eDiscovery because Microsoft stores Teams conversations across multiple backend systems. CFSI extracts this data and converts the messages into a format compatible with review platforms — which brings us to the critical processing step.

Cell Phones

CFSI is a Cellebrite-certified lab. We extract data from iPhones, Android devices, and other mobile platforms using Cellebrite UFED and Physical Analyzer, as well as GrayKey where advanced extraction is warranted. Mobile collections capture text messages (SMS/MMS), iMessages, WhatsApp and Signal chats, call logs, photos, videos, app data, location history, and more.

Step 2: RSMF Conversion — Making Messages Review-Ready

Here's where many law firms and even some vendors stumble. Chat messages from Teams, text messages from cell phones, and other short-message data don't natively fit into traditional eDiscovery review platforms that were built for email and documents.

That's where RSMF (Relativity Short Message Format) comes in.

RSMF is a standardized file format specifically designed to represent short message conversations — text messages, chat threads, Teams messages, Slack conversations, and similar communication types — in a way that eDiscovery platforms can ingest, display, search, and produce. Think of it as the PST equivalent for chat data.

RSMF preserves conversation threading so reviewers see messages in context, not as isolated fragments. It maintains sender/recipient information, timestamps, attachments, reactions, and edits. It enables efficient review by grouping related messages into logical conversation segments. It is natively supported by leading review platforms including CS Disco, Relativity, and others. And it allows attorneys to review chats the same way custodians experienced them — in threaded, chronological conversations.

CFSI converts all short message data — whether from Teams, cell phones, or other platforms — into RSMF format as part of our standard processing workflow. This ensures that when the data hits your review platform, it's ready to go.

Step 3: Loading Into CS Disco — Your Review Platform

CFSI provides a fully hosted CS Disco eDiscovery environment as part of our service. This means you don't need to license, configure, or manage a review platform yourself. We handle the technology so you can focus on the law.

Once collection and processing are complete, CFSI loads all data into your dedicated CS Disco database. Email (PST files) is ingested with full folder structure, threading, and attachment relationships preserved. Documents from computers and OneDrive are loaded with metadata, text extraction, and OCR where needed. Teams messages and cell phone communications in RSMF format load as threaded, reviewable conversations. All data is de-duplicated, indexed, and searchable from the moment it lands in the platform.

What Attorneys Can Do in CS Disco

CS Disco is built for lawyers, not technologists. Once your data is loaded, your review team can immediately begin working. You can search across all data sources using keywords, date ranges, custodian filters, and Boolean logic. Review documents and communications with AI-assisted prioritization to surface the most relevant materials first. Tag and code documents for responsiveness, privilege, confidentiality, and custom issue categories. Apply privilege logs and redactions directly within the platform. Run analytics including email threading, near-duplicate detection, and concept clustering. And generate production sets in industry-standard formats (TIFF, PDF, native) with Bates numbering and load files.

Step 4: Review, Tag, and Produce — Meeting Your Two-Week Deadline

With all 50 data sources collected, processed, converted, and loaded, here's what a realistic two-week timeline looks like when CFSI is managing your eDiscovery:

Days 1–3: Collection. CFSI deploys to collect computer images, initiates cloud collections for O365, OneDrive, and Teams, and schedules cell phone extractions. Remote collections can often begin the same day the engagement starts.

Days 3–5: Processing and Conversion. As collections complete, CFSI immediately begins processing. Email is extracted from PST files, documents are indexed and OCR'd, and all chat and text message data is converted to RSMF format. De-duplication is applied across custodians to reduce the review set.

Days 5–6: Loading. Processed data is loaded into your CS Disco database. CFSI performs quality control checks to verify document counts, metadata accuracy, and search functionality before turning the platform over to your review team.

Days 6–12: Attorney Review and Tagging. Your team reviews, tags, and codes documents in CS Disco. CFSI remains available to assist with search strategy, workflow configuration, and any technical questions that arise during review. Need to add more custodians or data sources mid-review? We can handle that too.

Days 12–14: Production. Once review is complete and privilege review is finalized, CFSI generates the production in whatever format opposing counsel requires — TIFF with load files, native format, PDF, or a combination. We deliver the production set ready for transmission to the other side.

Why Law Firms Choose CFSI

There are national eDiscovery vendors who can handle this type of project. But there are important reasons attorneys across Texas, Oklahoma, Louisiana, New Mexico, and Florida turn to CFSI:

Single point of contact. You're not passed between departments or account managers. Lance Sloves and the CFSI team handle your project from collection through production.

Licensed and local. CFSI is a licensed Texas Private Investigation agency (License #A11665), physically located in Dallas. We're not an out-of-state vendor operating without proper state licensing — a critical distinction that can matter at trial.

Forensic expertise built in. Unlike pure eDiscovery vendors, CFSI has deep forensic roots. If a custodian's data reveals something unexpected — evidence of spoliation, data wiping, or hidden communications — we have the expertise to investigate further.

Transparent, competitive pricing. We provide clear, predictable pricing without the surprise fees that plague the eDiscovery industry. You'll know what the project costs before we start.

Veteran-owned, security-cleared. CFSI holds a Top Secret/SSBI clearance and is a veteran-owned business, which matters for government contracts and matters involving sensitive or classified information.

Expert witness capability. If your forensic collections or eDiscovery process are challenged, CFSI's examiners can testify to the methods, tools, and procedures used. We've testified in federal and state courts across Texas.

The Bottom Line

A 10-custodian eDiscovery project spanning computers, email, cloud storage, Teams, and mobile devices doesn't have to be overwhelming. With CFSI managing the collection, RSMF conversion, and CS Disco hosting, your team can focus on what you do best: practicing law and winning cases.

Two weeks. Fifty data sources. One team handling everything.

Contact CFSI today for a free consultation and project estimate. Computer Forensic Services, Inc. | Dallas, Texas | www.cfsiusa.com | info@cfsiusa.com

Serving attorneys across Texas, Oklahoma, Louisiana, New Mexico, and Florida since 2002.

AI Assisted Blog Post