
Quick Answer
Native production is usually the cheaper, safer choice once a Rule 502(d) order and a protective order are in place. Most native risks are process failures, and a privilege review catches them.
The trade-off is real at depositions. A native can render differently on each side, so pair it with a Bates-stamped image for exhibits. I'd pay that small cost. The larger risk sits with whoever reprocesses a production instead of loading it as produced.
Key Points
- A sworn declaration filed in a 2020 federal ESI protocol fight found one email with a Word attachment came out 41.74 times larger as TIFF than as native.
- A Rule 502(d) order keeps a disclosure in the case from waiving privilege, but confidential material that is not privileged still belongs under a protective order.
- In a 2024 Reddit thread, practitioners said reprocessing a production instead of using its load file loses custodian, deduplication and pathing information .
Native files or page images: the format choice sets the bill and the fights that follow.
Teams, Slack, Google Workspace and Zoom became commonplace during the pandemic, and a 2023 eDiscovery Assistant article called these tools "the cornerstone of workplace communications." That is where the evidence lives now. It doesn't sit still for a page image.
The old rule says image everything, because native is risky. It was built for Word files and Outlook, and it keeps getting applied anyway. I think it costs small firms money and buys them less safety than they're told.
This piece walks through four things:
- What TIFF conversion costs you in file size, metadata and hours.
- Which native risks are real, which are process failures, and which ones survive a Rule 502(d) order.
- How to Bates-number natives so the production holds when opposing counsel challenges it.
- Why the receiving side's handling can be the bigger exposure.
That last point is the one I'd underline. A vendor employee wrote in 2024 that their team "leans very heavily" on reprocessing incoming productions instead of loading them with the load file provided, and the practitioners who answered said that was wrong. The format wasn't the problem there. The handling was.
One thing you won't find here is a dollar figure for what native saves against TIFF on real matters. Nobody has published it, and I won't make one up. So start with what can be measured, and that's the bill.
Native production means you hand over files the way they were kept, metadata and all, instead of flattening them into pictures. So the question I'd put to you is plain: who on your matter checks the files before they leave?
The playbook says otherwise. It says natives leak and invite fights, so you pay to convert, and the conversion is the thing being sold. Back in 2022, practitioners recalled that imaging was once billed at 2 to 3 cents per image and had since become just part of processing. The fee faded. The fear stayed.
And the data moved on without it. A 2023 eDiscovery Assistant piece on collaboration platforms found that internal talk has shifted to chat, that Slack exports arrive as .JSON, and that search terms and TAR (technology-assisted review) "work best with native data." Teams scatters private chats, group chats and files in separate places. You don't image your way through that.
So the question isn't whether native is risky. It's what makes it safe. A protective order, a tool that opens natives cheaply for both sides, and a Rule 502(d) order covering the slip you can't foresee. Then the fight moves to how files get handled once they land, and that is where I'd look first.
What does TIFF conversion actually cost you?
TIFF conversion costs you volume, metadata and hours. One email with a Word attachment came out 41.74 times larger as TIFF than as native, and hosting bills follow volume.
Before you agree to image everything, I'd run three checks on your own matter:
- Ask what your review platform charges per gigabyte hosted each month. A format that multiplies file size multiplies that bill.
- List the file types that lose meaning as pictures: spreadsheets, documents with tracked changes, audio and video.
- Count the documents that truly need redaction. Only those need to become images.
A sworn declaration filed in a federal ESI protocol fight in 2020 put hard numbers on the first check. An email between counsel with a Word file attached was 41.74 times larger as TIFF than as native. A second set, 24 public plaintiff publications and five sets of procedural rules, came out 12.59 times larger. Cloud review platforms charge by the volume they host. So the bigger file is the bigger bill, and it comes every month, and the requesting party pays it.
Then there is the metadata. Anith Mathai, writing on LinkedIn in 2021, said it flat: metadata such as creation date and author "is usually altered or destroyed when a file's format is changed." Mathai also notes TIFF was built by Aldus in 1986 and has not been updated since 1992. That is the format the careful lawyers want.
The EDRM Production Standards say the same thing in a chart. For image productions they flag higher costs for image conversion and longer turnaround on most of the data set. Their Category A, the native and near-native option, images only the files that need redaction.
The common assumption is that imaging is the conservative choice. It is not conservative. It is bigger, slower, and it throws away the dates.
And somebody has to read what comes out. A paralegal in 2024 got a standard TIFF production, thought it was scrambled, and faced about 20,000 .txt and .tiff files by hand. If you are on that end, it helps to know how to go about making an unsearchable image production usable under Rule 34, because nobody else will do it for you.
An analysis of 5 sources shows one pattern: conversion adds volume, adds time, and strips the facts that date a document. In practice, the format choice sets your budget for the life of the case. So before you agree to TIFF, ask who pays for the conversion and what it buys your client.
Our own economics point the same way. At Relevant e-Discovery, AI-assisted review runs cents per document, against dollars per document and roughly $19K/GB for manual review, and you can see that delta on your own matter. The production side runs on immutable originals with content hashing, append-only audit trails and documented chain of custody, so the native you hand over is the native you collected.
Which leaves the one fear that still has teeth, and that is what rides along inside the native file.
What are the real risks of native production, and do the safeguards cover them?
The real risks are hidden fields, embedded attachments, encryption and rendering fights. Most are process failures, and a privilege gate, a clawback order and controlled processing cover them.
The playbook is not lying about failure modes. Practitioners on the r/ediscovery forum laid them out plainly in 2022, and I take each one seriously. So I put one question to each. Is this a problem with the format, or a problem with how somebody handled it?
| Reported risk | Format or process? | What handles it |
|---|---|---|
| In 2022, a vendor technician said .msg emails carry "dozens if not hundreds" of low-level metadata fields that never show in renderings or load file columns | Process | Agree in the protocol which fields are exchanged, and review what your tool extracts before it goes out |
| A redacted attachment produced as TIFF while its parent email goes native leaves the unredacted attachment inside the native email | Process | When any family member is redacted, image the family |
| An exported native came out encrypted, and the review tool showed an empty email; the producer may have to hand over keys | Process | Catch encryption during processing and settle its handling in the protocol |
| Processing exclusions let the other side pull more from natives, such as embedded files, than the producer reviewed | Process | Review what is inside the file, not just what is on screen |
| Fights over whether headers or footers existed in the original, and no Bates stamp on the page face | Partly format | Image the few exhibits that reach a deposition |
Four of the five are process failures. One is partly about format, and it touches only the handful of documents that end up in front of a witness.
Here is the part the risk talk leaves out. Hicks Johnson PLLC wrote in 2019 that courts accepting an ordinary-course production look for unaltered metadata, likely including at least the original file name and file path. A bare statement that files were produced as kept "routinely are held insufficient," the firm noted. Conventional wisdom treats every metadata field as exposure. Some of it is simply what the rule asks for.
A Rule 502(d) order is the backstop. Under one, producing a privileged document does not by itself waive privilege, and you can claw it back. I'd like to tell you how often metadata slips out with an order and without one. The sources I have never counted it, and I won't guess.
The clawback has its own weak spot, and it sits on the other side of the table. A receiving vendor that reprocesses your production instead of loading it with your load file rewrites the metadata. Practitioners call that spoliation. It also makes the clawed-back document harder to find later.
Our answer at Relevant e-Discovery is to keep privileged material in your hands from the start. Processing runs single-tenant, or inside your own AWS account under your own keys, with no vendor retention and no model training, so nothing you feed it trains anyone's model or waives privilege.
And the gate has to run every time you produce, which matters when you are deciding between rolling productions or one final set. So the question stops being whether to go native. It becomes how you write native into the protocol, and that fight starts at the meet and confer.
Which native production risks survive a 502(d) order?
Redact an attachment perfectly in the image set, produce its parent email in native form, and the unredacted original can still reach the other side. Would a clawback order even help?
The warning came from a vendor-side technologist in a 2022 r/ediscovery thread about a native-only protocol. Redact an attachment, produce it as an image, send the parent email native, and "the non-redacted, native attachment will still be available to the receiving party from within the native email."
How a redacted attachment slips out
- An email and its attachment are collected as one family.
- Review redacts the attachment, and it is produced as an image.
- The parent email goes out in native form.
- The native email still holds its own copy of the attachment, unredacted.
Source: a vendor-side practitioner on r/ediscovery, April 2022.
Attachments are only the visible part. The same commenter said .msg emails typically carry "dozens if not hundreds of lower level and obscure metadata fields" that never appear in a rendering or a load file column. Another practitioner added that processing settings or a vendor's file-type exclusions can let the receiving side extract more, such as embeddings or custom metadata, than the producing team reviewed. EDRM's production standards, led by Julie Brown of the law firm Vorys, Sater, Seymour and Pease, flagged the same drawback years earlier: "Metadata may be hidden and not fully reviewed prior to production."
So does a Rule 502(d) order catch any of this? A federal court may order "that the privilege or protection is not waived by disclosure connected with the litigation pending before the court." The rule concerns attorney-client privilege and work product. An attachment holding pricing, a trade secret or a customer's personal details can be confidential without being privileged, and as we read the rule, 502 does nothing for it. That protection must come from a protective order, which the thread's original poster set as the first condition before saying there was "no justification for tiff/txt productions in certain litigations." When leaked content is privileged, the order settles its legal effect. The other side has still seen it.
A second group of failures has nothing to do with waiver. One commenter described an offline mailbox file that stored email-encryption credentials. One processing engine extracted the text and metadata and generated an accurate image, but the exported native was encrypted, and a leading review platform and the email client both showed an empty message, with no text and no attachment. If passwords or keys were used in processing, the commenter added, the producing party may have to hand them over before the natives can be read.
Then comes the deposition room. One practitioner who has completed native-only productions, and has even put Bates labels on videos, still warned that when a printed native "doesn't look exactly like the native version that the opposing side has, it will become an issue." They have seen parties fight over whether headers or footers were in the original file.
None of this argues for imaging everything, and the standards agree. EDRM's native-first Category A handles redaction in one line: "Only files requiring redaction are tiffed." Even its image-heavy Category B keeps spreadsheets and files "not usable in .tif format" native, and its comparison chart lists higher cost and longer turnaround as the price of image conversion.
One argument for native carries less weight than it once did, and we include ourselves in that. A practitioner in the thread remembered imaging billed at 2 to 3 cents per image and said the charge is now folded into processing, which left them seeing little advantage in native-only productions. The savings from native now arrive later in the case, in hosting volume and searchable text, as our cost section shows.
Lined up, the leftover risks sit at four points: the email family, the extraction settings, the encryption keys and the exhibit table. A 502(d) order reaches part of one. The rest need fixes written into the protocol before anything is produced, including the middle ground some practitioners prefer, images plus natives of the same documents, because under Rule 34, unless the parties stipulate or the court orders otherwise, a producing party "need not produce the same electronically stored information in more than one form."
| Leftover risk | Does a 502(d) order help? | Protocol fix |
|---|---|---|
| Unredacted attachment inside a native parent email | Only if the content is privileged | Image the whole family when any member is redacted |
| Metadata or embedded files nobody reviewed | Only if the content is privileged | Review with the same processing settings used for production |
| Encrypted native that opens empty | No, it is a rendering problem | Test natives before release and settle key handling |
| Printed native that looks different at a deposition | No, it is a dispute over what the document shows | Use Bates-stamped images for exhibits |
- When any family member is redacted, image the whole family, parent email included.
- Review what a native actually carries, embedded files and metadata included, with the same processing settings you produce from. Ask any platform, ours included (we build one with a fail-closed privilege gate), whether its gate inspects files embedded inside a native parent or only documents on the production list.
- Put confidential, non-privileged material under a protective order rather than counting on the 502(d) order.
- Open a sample of produced natives in an ordinary viewer before release, and write key handling into the protocol.
- Agree before the first deposition that exhibits will be Bates-stamped images.
How we checked this
We used a 2022 practitioner discussion on r/ediscovery, the EDRM production standards and the text of Federal Rule of Evidence 502 and Federal Rule of Civil Procedure 34. No figures in this section come from our own data. The forum commenters are anonymous, so we cannot confirm their roles, and their tools may have changed since 2022. The EDRM standards date from 2010, with a 2014 update. Our reading that Rule 502 does not reach non-privileged confidential content comes from the rule's text, not from a court decision. We sell a review platform that produces natives, so we have a stake in this answer. Still unknown: how often family leaks or empty encrypted natives actually happen. None of our sources counted them.
- r/ediscovery, discussion of a native ESI protocol, April 2022.
- EDRM, production standards version 2, May 2010.
- Legal Information Institute, Federal Rule of Evidence 502 text, retrieved November 2026.
- Legal Information Institute, Federal Rule of Civil Procedure 34 text, retrieved November 2026.
How can a small firm Bates-number and produce natives defensibly without an expensive vendor?
Name the production category at the meet and confer, number each native at the file level, image only what needs it, and check every cited fact against its source exhibit before filing.
The rule gives you more room than most lawyers use. Under Rule 34(b)(2)(E), the requesting party may name a form. If it does not, you may produce in the form the ESI is "ordinarily maintained" or in a "reasonably usable form." And a party "need not produce the same electronically stored information in more than one form." So the first agreement is the one you live with. Get it right at the start.
Here is how I'd run it, in four moves:
- Propose a category by name. The EDRM Production Standards built their categories to be "easily communicated by attorneys at a meet and confer by referring to the category of production." Say Category A, native and near-native, and put it in writing.
- Trade review tools. EDRM tells the requesting party to say which review tool it will use, so the producer can build a production that loads. Ask the same question back.
- Number the file, not the page. Under Category A each file name matches its DocID, as in ABC0000123.doc. That is your Bates number. Image only the redacted documents, plus the few exhibits you will put in front of a witness, and page-number those.
- Verify before you file. Every fact you cite in a response or a brief should trace to the exhibit it came from. Check it there, not from memory.
None of this needs a litigation support vendor on retainer. It needs a protocol with a category in it and a platform that reads natives. The hard part is discipline, not money.
The fourth step is where small firms get hurt. A wrong cite costs more than a wrong format. At Relevant e-Discovery our outputs link back to the exact exhibit they came from, so an attorney can one-click verify before filing, which is the structural answer to the Mata v. Avianca sanctions risk. I'd rather a lawyer check one link than explain one mistake.
A named category also makes the production harder to attack. When opposing counsel says the format was inadequate, you point to the category they agreed to and the file names that match it. That argument is short, and short arguments tend to win.
If cost is what has kept you off a real platform so far, it is worth reading what a small firm should pay in per-matter versus annual platform pricing before the next meet and confer. Because the protocol is only half of it. The other half is what you do when the documents are not files at all, but a year of chat.
How can I reduce the cost of document review in litigation?
Stop paying to turn files into pictures. Produce native under a 502(d) order, ask for native back, and load what arrives as produced, so review runs on searchable data.
That is the whole bet. When one email weighs 41.74 times more as an image, the image is a bill, not a safeguard.
The next fights won't be about TIFF. They'll be about chat and links. A 2023 eDiscovery Assistant analysis found that Slack, Teams and Gmail now send links instead of attachments, and in Nichols v. Noom the court held hyperlinks are not attachments and would not order discovery redone for a party that hadn't asked up front. So the native terms go in the protocol on day one, or they don't go in.
I'd rather lose an argument at the first meet and confer than a motion later. The first costs a phone call. The motion costs what's left of the budget.
And when the other side's vendor reprocesses what you sent instead of loading it, the metadata that changes is theirs to explain.
Summarize This Article With AI
Open this article in your preferred AI engine for an instant summary.
Frequently Asked Questions
What else do litigators ask about native production?
They ask about privilege leaks, depositions, encryption, chat and fees. Each one comes down to planning the protocol early and checking the files before they leave.
Does native production leak privileged information?
It can, through the attachments. Practitioners writing on Reddit in 2022 warned that a native email carries native copies of its attachments, so if you redact an attachment as an image but send the parent email native, the unredacted attachment rides along inside. A Rule 502(d) order, a court order that keeps a disclosure in the case from waiving privilege, is your backstop. Review is still your first line.
Can I still use page images at a deposition if I produce native?
Yes. The same 2022 thread floated a middle ground: produce native plus a Bates-stamped rendering, TIFF or PDF, so both sides cite the same page. PDF keeps a text layer you can search. I'd agree on this before the first deposition notice goes out.
What happens if a native file is encrypted?
It may open blank on the other side. In one case described in that thread, Nuix pulled the text from an encrypted OST, but Relativity and Outlook showed an empty email. If passwords were used in processing, the producing party may have to hand them over.
How should I produce Slack or Teams messages that link to files?
Produce the version of the linked file that existed when the link was sent. A file linked six months ago may have been updated ten times since. Most platforms keep timestamped versions, but you have to plan for it up front.
Should I ask opposing counsel to produce native to me too?
I would. Native with load files is the easiest production to receive, and natives without load files still work in modern review software. Then load what arrives as produced, and don't reprocess it.
What does Relevant e-Discovery charge for review?
AI-assisted review on Relevant e-Discovery runs cents per document, and you can see the difference on your own matter. Start through the contact page at relevantediscovery.com and bring the collection that's worrying you.
Written by
Michael
Kansky
Michael Kansky is a serial software entrepreneur who has spent more than two decades building and bootstrapping profitable SaaS and services companies.
Connect on LinkedIn

