Incident in progress What to do in the first hour → Preserve first. Several ordinary responses destroy the evidence permanently.
Wirewalk Forensics and Security

eDiscovery

Collection, processing, hosting and production, priced per unit. Processing is metered on source volume as collected, which is the smaller number and the one you can check.

Document
WW-F-012
Version
1.0
Issued
2026-09-11
Last revised
2026-09-11
Scope
EDRM stages and per-unit economics
Authority
Principal

What it costs

Processing is billed per gigabyte of source volume as collected — before containers are expanded, before duplicates come out. You can count that on your own drive. Most vendors meter the expanded figure, which no client can check.

eDiscovery units · reviewed 2026-09-11 · next review 2027-03-11
LineUnitPriceWhat this does not establish
Processing and ingest indicative; confirmed at scoping per GB of source volume as collected $22/GB Not a total; that turns on what survives culling.
Review hosting, no analytics per GB per month $9 Recurring while data stays hosted.
Review hosting, with analytics per GB per month $14 Analytics organises a review; it does not decide responsiveness.
Review platform user licence per user per month, at cost $75 No mark-up, no commission, either direction.
Imaged production indicative; confirmed at scoping per page $0.05 Page format is not always the right form.
TAR protocol design and validation indicative; confirmed at scoping per project, fixed $6,500 Measured recall against a sample, not proof nothing was missed.
eDiscovery project management per hour $180/hr Runs to a written ceiling; I stop at 80% and report.

Collection is never priced per gigabyte: it is per device, per custodian and per endpoint, on the rate schedule. Superseded schedules stay on the version register.

What I take, what I refer out

EDRM stages · posture and deliverable
StagePostureWhat you getWhat this does not establish
IdentificationTake A data map of custodians, systems and accounts, ordered by expiry date. That the map is complete; nobody names every repository.
Preservation and holdTake, on counsel's instruction A hold confirmation report: what was held, where, how, and what could not be. That a duty to preserve attached, or when. Counsel's call.
CollectionTake Hashed sets with manifests, and a note of what I deliberately did not collect. That everything responsive was collected. Scope is a decision, recorded.
ProcessingTake A reviewable set, an exception report by count and path, and a log reconciling counts. That everything processed cleanly. Failures are reported, not dropped.
Hosting and platform adminTake, pass-through Hosting on a third-party platform, load and QC, and sets cut to counsel's specification. That I am the platform. I administer somebody else's.
The review itselfRefer out An introduction to a managed review provider, and the technical work behind it. That I supervise their calls or stand behind them.
Analysis and cullingTake Each culling option with its volume and monthly cost, before any is applied. That a search returning nothing proves nothing is there.
ProductionTake Native or imaged sets, extracted text, load file, Bates numbering, production log, hash manifest. That the set is admissible; the court decides that later.
Privilege log supportTake, to FRCP 26(b)(5)(A) The metadata extract behind the log, with the withhold or redact basis per entry. That anything on it is privileged. I flag; counsel decides.

What you end up holding: a hashed collection manifest, a processing log and exception report, the produced set with its load file and hash manifest, and the privilege log metadata. Where imaging would strip a spreadsheet of what made it useful, I say so first. I do not take information governance.

Why I will argue you out of part of this bill

Everything collected becomes billable volume. Over-collection earns me money, and deduplication runs after the point I measure, so I bill you for duplicates. On a mail-heavy matter, collecting broad and culling late is the difference between a five-figure bill and a four-figure one.

So my incentive runs backwards, and there is no structural fix for it. I can name it and put the numbers in front of counsel before any cull is applied. If you would rather the conflict were removed than disclosed, ask me to quote project management hourly and host elsewhere. Sometimes that is cheaper, and I will say so.

On eDiscovery matters, I will not

  1. Bill you for expanded volume.
  2. Image a whole disk where a targeted collection answers it.
  3. Stay quiet about a cull that takes your bill from five figures to four.
  4. Take a commission from any platform or vendor I place.
  5. Bill an hour above the ceiling you authorised in writing.
  6. Adjudicate privilege, or opine that ESI was destroyed on purpose. Both are the court's.
  7. Take a matter I cannot finish inside your production deadline.

Full list on the home page, verbatim in the engagement letter.

Ring me on 917-217-7975 and I will tell you whether this is a forensics problem, an eDiscovery problem, or a job for a review provider. The call costs nothing, including the one that ends with me saying the data cannot answer it.