Discovery Attender Tips: Identifying Privileged Data

When performing an e-discovery search, there is often a need to parse the responsive data (i.e. the items that match the search criteria) into privileged and non-privileged data sets.  Privileged data is any information that is protected by a legally recognized right against disclosure, for example communication between an attorney and client.  Even if the data is relevant to a case, privileged data can be excluded from being used as evidence in court.  As a result, many Discovery Attender users need to identify and eliminate the privileged data from the result set.

There are many ways to identify privileged data with Discovery Attender.  For instance, you could create a search that excludes this data by using the “NOT” or “EXCLUDE” operators.  Although this may eliminate the privileged data from your result set, you will not be able to report on what was eliminated and why.  That is, you will not be able to create a privileged log, nor will you be able to readily prove why a specific item was considered privileged and hence removed from the responsive data set.  Therefore, there are two recommended ways in Discovery Attender to parse the responsive data into privileged and non-privileged data sets:

Single Search Method – This option identifies the privileged data as a function of the current result set.

Two Search Method – This option identifies the privileged data using two searches.

Single Search Method

The single search method uses Auto-Labels and/or Advanced Filters to identify the privileged data.  Once privileged data is identified by using Auto-Labels or Advanced Filters, it can easily be excluded from the export using marks to filter the data.

Auto-Labels have the added benefit of getting the search and identification completed in one step.  Auto-Labels are configured during the search wizard to identify a sub-set of the results as privileged while the main search is being run (i.e. it is a search within your search):

Once you select this option, you will be able to specify the keywords and/or addresses that will identify your privileged data within your responsive data.  The items that meet the criteria for the Auto-Labels will be part of your result set and will be found under the By Labels node:

Additionally, you can use Advanced Filters to select and identify your privileged data.  Advanced Filters are processed against the result set (i.e. a search against the result set):

Advanced Filters can use dates, addresses or keywords.  However, using keywords requires that you select Index Results in the search wizard:

In other words, you can still use Advanced Filters without selecting this option in the search wizard, but only for dates and addresses.

Any number of Advanced Filters can be added after the search is run.  As a result, this method is effective when you are unsure of your privileged criteria.  Additionally, you can query and cull your data in a number of ways without changing the underlying search.

Two Search Method

The Two Search Method is the most effective way of removing privileged items as it has the most thorough audit trail.  It is also the preferred method in identifying privileged data.  With this method, you will do the following:

  • Search 1
  1. Search the source data stores or files for items that match your search criteria.
  2. Organize and deduplicate data as needed.
  3. Export the responsive items to a result set (i.e. your responsive result set).
  • Search 2
  1. Create a new search which scans the responsive result set to find the privileged data.
  2. Use the action Move to PST and/or Move to File to copy messages to a new store and then delete the data from your responsive result set.

Note: The Move to PST and Move to File actions are disabled by default.  You will need to enable these “Advanced Actions” in your Discovery Attender settings.

Both the Single Search Method and Two Search Method have advantages and disadvantages:

Pros Cons
Single Search Method – Complex criteria can be used effectively
– Additional items can be excluded after the searches are run
– Interface can be used to validate items
– No separate set of privileged items
– No in-tool count or readily available report of excluded privileged items
– Multiple steps
Two Search Method – Log, count and reports of privileged data
– Separate, producible set of privileged data
– Clear, easy to reproduce steps
– Can use the most flexible criteria, without an index to take up room
– Method is most lengthy, takes more time
– Multiple searches
– Will have to produce two sets of reports
– Must have well defined privileged criteria


For more information about the topics described here, please refer to the Discovery Attender help document or contact Sherpa Software technical support.

Leave a Reply

Your email address will not be published. Required fields are marked *