Home › Insights › The Collection-Completeness Ratio: Proving You Got It All

The Collection-Completeness Ratio: Proving You Got It All

Smartphone, laptop and hard drive in labeled evidence bags next to a printed source register with check marks

Quick Answer

Divide the sources you collected by the sources you mapped, and put that fraction on line one. A register behind each row, with a written reason for every gap, defends it.

The map comes first. Litigation support guidance published through ILTA in 2021 lists a negotiated discovery plan, naming date range, custodians and document categories, ahead of every other cost control. That plan is the denominator. Count against it before review starts.

Did this answer your question?

Key Points

  • The Collection-Completeness Ratio is sources collected divided by sources mapped; in one 2024 practitioner thread, 10 custodians with 3 sources each made 30 sources, not 10 people.
  • Federal Rule 26(g) asks for "a reasonable inquiry" and Rule 37(e) for "reasonable steps," so a 30/30 ratio still needs a method, hash and custody log on every row.
  • eDiscovery Today's 2024 State of the Industry Report found that 40.2% of respondents discovered mobile devices in all or most of their cases, and 37.9% did the same for collaboration apps.
Three things people believe. Myth or fact?
Call each one, then see how other readers called it.
1 If every custodian sat for an interview, every source is on the map.
2 A source counts as collected once anything has come off it.
3 A source that was collected correctly can still drop out before review.
Smartphone, laptop and hard drive in labeled evidence bags next to a printed source register with check marks

Every mapped source gets a row, and every row gets a mark: collected, or a written reason why not.

Most downstream fees are billed per gigabyte, per user or per hour, and the source map sets how many gigabytes arrive. A missed row reopens collection, processing and review.

In 2021, Gretel Best, who manages litigation support and eDiscovery at Gowling WLG, laid the fees out for the International Legal Technology Association (ILTA). Processing, hosting and analytics were billed per gigabyte. User fees ran per user, per month. Archiving and cold storage added their own per-gigabyte charge. Her list of ways to cut those fees did not open with a review tool. It opened with a negotiated discovery plan that sets the date range, the custodians and the categories of documents.

I read that as an argument for the ratio. The plan is the denominator. Whatever it names is what the collection gets measured against, by you first and by opposing counsel later.

Her other levers work after collection. DeNISTing strips out system files using the NIST reference list. De-duplication, email threading and continuous active learning cut what is left. They shrink what was gathered. They cannot find what was never gathered.

The same holds outside litigation. Internal investigation teams and forensic accountants working through large email and chat collections need the same count before anyone reads a message.

Best also warned that technology fees can apply to the opposing party's data once you host their productions. That cuts both ways. The count you keep on your own sources is the count you can ask for on theirs, and the next section builds it row by row.

Defensible collection rests on chain of custody, hash verification and intact metadata. Practitioners treat these as baseline skills, and a completeness challenge tests all three at once.

The challenge usually arrives as a letter. It says the collection is short. It names a custodian, or a phone, or a chat app. Then it asks you to prove a negative.

Most firms answer with a narrative declaration. Diligent efforts. Reasonable steps. Good faith. Opposing counsel reads it, sets it down, and asks for a deposition.

The volume makes the prose look thin. On a 2024 episode of the LawNext podcast, a former O'Melveny & Myers litigation technology lead described one matter where the team collected 800,000 text message bubbles, dumped into Excel. It took roughly two weeks just to get the spreadsheet. No adjective covers that much data.

Forensic habits have been moving into civil work for years. A 2016 practitioner thread already said tools such as EnCase and FTK were becoming more prevalent in civil cases. The standard rose. The way firms describe completeness did not.

I think the answer is a number. A logic note on Lesley's Digital Garden calls a system complete "if we can prove all things right," and a collection should meet that test one source at a time.

What is the Collection-Completeness Ratio, and how do you build its denominator?

The Collection-Completeness Ratio is sources collected divided by sources mapped. Thirty over thirty means every mapped source came in. Anything less names a gap you must explain.

Build the denominator before anyone touches a device:

  1. List every custodian by name.
  2. List each source type that custodian uses: mailbox, phone, collaboration app, social account.
  3. Write every custodian and source pair as its own row. Count the rows.

The row count is the denominator. Nothing else is.

One 2024 practitioner thread did this math out loud. A collection quote covered 10 custodians with 3 sources each. That made 30 sources, not 10 people. The difference matters. The common assumption is that the denominator is the custodian count. It is not. A custodian is a person. A source is a container of data, and each container has its own collection method.

The containers have changed. eDiscovery Today's 2024 State of the Industry Report found that 40.2% of respondents discovered mobile devices in all or most of their cases, and 37.9% did the same for collaboration apps. In my view, that settles the default. The phone row and the chat row go on the map for every custodian. You strike them later, in writing, if they truly do not apply.

Hard sources are the ones that fall off a map. A founder interviewed on a 2024 legal tech podcast described the traditional phone collection: at least four parties in the room and four to eight hours for each device. A source that eats a day is a source somebody quietly forgets to list. Writing it down first stops that.

The money tells the same story. ComplexDiscovery estimated in 2019 that collection had grown to 12% of eDiscovery task spend, up from about 8% in 2012. Collection is no longer a rounding error. A missed source now costs real money twice: once to go back, and once to explain why you did not go the first time.

Combining 5 sources points to one rule. Map by container, not by person. Cloud tools carry their own blind spots here, and the things one-click cloud collection tools miss belong on the map as separate rows, not footnotes.

Each row needs an address. At Relevant e-Discovery, every answer the platform gives links back to the exact exhibit it came from, so an attorney can verify it in one click. A source map should work the same way. Every row points to the custodian, the container, and the item that proves it was collected.

With the denominator fixed, the numerator comes next. That is where the counting either stays honest or does not.

Why doesn't a perfect ratio prove the collection is complete?

A source counts only when its copy is hashed, logged and held under documented chain of custody. Touching a source is not collecting it.

Once the fraction is on paper, the urge is to push it to 100%. Thirty out of thirty looks clean. But the numerator only counts sources touched. It says nothing about whether each one came in whole, or came in right.

Before and after makes the point.

  • Before: "Custodian 4, mailbox, collected." The row is checked. Nobody knows how, by whom, or what was left behind.
  • After: "Custodian 4, mailbox, collected by examiner, hash recorded, linked attachments re-associated, custody log attached." The row now proves something.

The first row inflates the ratio. The second row defends it.

Practitioners say the same thing in plainer words. In an r/ediscovery thread on interview advice, one experienced commenter warned that collecting metadata the wrong way "has the potential to sink a case or result in penalties/sanctions." The same commenter called it a bad idea to let clients, or even their IT department, self-collect. A self-collected source still adds one to the numerator. It also hands opposing counsel a target. The risk of forensic imaging done by your IT person is the risk of a row that looks done and is not.

Depth cuts the other way too. In a separate r/ediscovery thread on imaging phones, the original poster, a practitioner with "more than 25 years" in the field, said a full forensic image had been needed only "a couple times." The text data was what mattered. Other commenters pushed back hard. One described learning at deposition that a custodian used WhatsApp or Signal, after only a targeted collection, with no way to collect the phone again.

Both camps are right about something. A targeted pull can be proportional. A targeted pull can also be the row that sinks you. The ratio cannot tell the two apart unless the row says what was taken and why.

So I add a depth note to every collected row. It records the method used, what the method leaves out, and who decided. That turns a yes into an answer.

Depth has a cost downstream. Fuller collections mean more to review. That is where Relevant e-Discovery's figures matter: AI-assisted review runs cents per document against the dollars per document and roughly $19K/GB of manual review, while every original stays immutable, content-hashed and tracked in an append-only audit trail. Collecting deeper stops being a budget fight.

None of this helps if the register sits in a drawer. It has to come out the day opposing counsel says your collection has holes.

Where can a 30/30 collection still be hiding a gap?

A completeness score can read near perfect while much of the underlying data was never gathered. One open-source contributor showed how, and the logic carries over to a source register.

The tool is BloodHound, an open-source program that analyzes Active Directory networks. In an open GitHub issue, a contributor noted that it counts a user as covered once a single session record turns up anywhere, so "a user logged on to six hosts counts identically whether SharpHound collected all six or one of them." Where most people use more than one machine, "a substantial fraction of hosts can return Collected: false while both figures stay near 1.0."

The contributor named the gap: coverage versus saturation. Coverage asks whether collection is "reaching this population at all," which helps when you are hunting for a misconfigured collector. Saturation asks whether collection got everything, and measuring that "would need a denominator that is not knowable from collected data alone." The issue concerns network data and is still unanswered, but the arithmetic carries over. A sources-collected over sources-mapped ratio has the same two soft spots: a bottom number that may be short, and a top number whose rows may each hold less than a whole source.

The short denominator can surface late. On an eDiscovery practitioner forum in December 2025, one commenter called it "awful" "to find out in depo that a custodian was using WhatsApp or Signal" after only a targeted collection, with no way to recollect the phone. A source nobody mapped never lowers the ratio. It never appears in it.

Industry survey data suggests where to look first.

Mobile devices, in all or most cases 40.2%
Mobile devices, in very few or none 19.0%
Collaboration apps, in all or most cases 37.9%
Collaboration apps, in very few or none 18.9%
Corporate respondents, mobile data in all or most cases 13.2%
Where the source map runs thin. How often surveyed eDiscovery professionals see each source type in their cases, from the eDiscovery Today State of the Industry survey, 444 respondents, October to December 2023. The corporate figure comes from posts citing the report.

Posts citing the report add that nearly 90% of corporate respondents must collect collaboration data. Rarely seeing a source type may mean the matters never involved it, and the survey cannot separate that from a source nobody asked about. Either way, these are the categories where a map is most likely to be thin.

The second soft spot is harder to see: a row can say "collected" and still hold only part of its source. Practitioners keep describing the same few patterns.

Row on the registerWhat it can leave outWho flagged it
Mailbox exported with a platform toolLinked drive attachments never reattached to their parent emails, and earlier versionsForum practitioner, 2024
Phone, logical or advanced logical extractionAnything outside the targeted scope, such as an app that surfaces laterForum practitioners, 2025
Phone, targeted device collectionEmail, Slack and Teams, left for collection at the sourceFounder of a mobile collection company, LawNext podcast, 2024
Files the client or its IT team collectedMetadata, which self-collection can mishandleForum practitioner, 2021

Phones draw the sharpest disagreement. One commenter estimated that "In 99% of civil litigation matters, all they want are messages," which a logical extraction can get. Another favored the fuller extraction: "Image is good to have to avoid recollection." Either choice can be reasonable. A phone row that records no extraction tier leaves opposing counsel to argue about which one you made.

Depth also costs money. A ComplexDiscovery pricing survey published in May 2025 put the anchor rate for forensic collection at $250 to $350 an hour, cited by 56.6% of respondents. Per-device rates above $350 were reported by 50.9% for desktops and laptops and by 49.1% for mobile devices. In a 2024 forum thread, a poster called a $15K quote "pricey." One reply worked it out at 30 sources, "about $500 per source." Another answered: "A spoliation claim alone will cost more than $15k to deal with."

The federal rules show where to put the effort. Under Rule 26(g), an attorney who signs a disclosure certifies that, after "a reasonable inquiry," it is "complete and correct as of the time it is made." Rule 37(e) asks whether lost ESI was lost because a party "failed to take reasonable steps to preserve it." Both standards measure the inquiry and the steps taken. Neither asks for a number that proves itself.

A 30/30 is a coverage figure resting on two judgments it cannot show: how the 30 sources were found, and how deep each collection went. Opposing counsel can go after those judgments. The answer belongs in the register, row by row, where the inquiry and the method are written down.

Five checks before you sign

  1. Write down how the map was built: which custodians were interviewed, and whether each was asked about messaging apps such as WhatsApp and Signal before any targeted phone collection.
  2. Test the map against mobile devices and collaboration apps first, the source types professionals most often report rarely seeing.
  3. On every phone row, record the extraction tier (logical, advanced logical, file system or full file system) and why it was chosen.
  4. On every mailbox row, note whether linked attachments were reattached and versions considered. If a device collection skipped email, Slack or Teams, give each its own row.
  5. Before trimming a collection quote, ask what recollecting would cost if the custodian or the device became unavailable later.

How we checked this

We drew on a software issue from outside law, eDiscovery practitioner forum threads, an industry survey, a pricing survey, a podcast interview and the text of two federal rules. None of the figures here are our own. The GitHub issue concerns network data and is one contributor's question, still unanswered, so we use it only as an analogy. Forum comments are anonymous practitioner opinion. Of the survey respondents, 42.8% were software or service providers, and the corporate figures come from posts citing the report. The pricing article's editor's note and its charts name different survey editions. The podcast guest sells mobile collection, and the transcript is machine-generated. We sell eDiscovery software built around hashing, audit trails and chain of custody, so we have a stake in registers that hold up. Still unknown: how often a 30/30 register later turns out to be short, and how courts weigh a ratio on its own. None of our sources measured either.

  1. BloodHound contributor, GitHub issue on completeness metrics, undated.
  2. r/ediscovery, thread on imaging a phone versus collecting data, December 2025.
  3. r/ediscovery, thread on tools for collecting client data, November 2024.
  4. r/ediscovery, thread with eDiscovery interview advice, September 2021.
  5. eDiscovery Today, 2024 State of the Industry report announcement, January 2024.
  6. ComplexDiscovery, 2025 eDiscovery processing and pricing update, May 2025.
  7. LawNext podcast, episode 258 on mobile data collection, September 2024.
  8. Legal Information Institute, Federal Rule 26 text and Federal Rule 37 text, retrieved November 2026.

How do I respond when opposing counsel challenges the defensibility of my ESI collection?

Answer with the ratio, the register behind each row, and a written reason for every gap. Keep that record where you control it, with no vendor retention.

The letter comes. It says your collection is incomplete. It asks for a declaration. Here is how I would answer it:

  1. Lead with the number. State sources collected over sources mapped in the first line of your response.
  2. Attach the register. One row per custodian and source, with method, date, hash and custody log.
  3. Explain each gap in one sentence. Struck by agreement, not in use, or pending, and who made the call.

Compare the two ways to say it.

  • Before: "Counsel undertook diligent, reasonable and good-faith efforts to identify and collect all relevant sources of ESI."
  • After: "Sources collected over sources mapped appears on line one of Exhibit A. Each collected row carries its method, hash and custody log. The phone rows struck by agreement at the conference are marked, with the date."

The first sentence invites a deposition. The second invites a question about a few marked rows. That is a much smaller fight.

Small fights are cheaper. In 2025, ComplexDiscovery's pricing survey found that 47.2% of respondents reported expert witness testimony at $350 to $550 an hour, and 26.4% reported rates above $550, the highest share of any top tier in the survey. A completeness dispute argued in prose tends to end with experts on both sides reading each other's methods aloud. A register narrows what they can argue about. The narrower the dispute, the fewer hours anyone bills to settle it.

The register also has to be safe to hand over. It names custodians, devices and accounts. Your working copy, and the data behind it, should sit where privilege cannot leak through a vendor's back door. That concern runs deeper than collection, and the question of whether privileged ESI gets embedded before the screen belongs in the same conversation.

That is the reason Relevant e-Discovery runs processing single-tenant, or inside the firm's own AWS account under the firm's own keys, with no vendor retention and no model training. Nothing fed into it trains anyone's model or waives privilege. The same platform's demo asks a buyer to bring a messy collection and a hard question, then watch it read, code and cite that buyer's own evidence. I would use that hour to test the register itself. Ask it which mapped rows have no documents behind them.

A row with no documents is either an empty source or a missed one. You want to find out which before opposing counsel does, and before the cost of finding out climbs.

Can a small firm keep a source register that holds up?

Yes. Relevant e-Discovery pairs a defensible spine of Bates numbering, privilege and chain of custody with cited answers and chronologies, in one tool built for small-firm matters.

A practitioner on r/ediscovery warned that bad metadata handling can bring sanctions. A grocery list works the same way. Nobody trusts it once half the items have no checkmark. Run it in your own AWS account, under your own keys, and no administrator is required.

Map your first matter

How can I reduce the cost of document review in litigation?

Map every source before you collect, then collect against the map. A counted, complete set gets reviewed once, instead of being reopened after a completeness challenge lands.

The number will matter more, not less. Volume does the damage. A 2016 practitioner thread described one matter at about 16 GB from a cell phone, 7 GB of Gmail and a 100 GB hard drive image, then said of the lawyers handed that drive: "Most cannot make head or tail of it."

A register fixes that. It says what each gigabyte is, where it came from and what it cost. In 2024, one commenter split a $15K collection quote into about $500 per source, which is the same arithmetic the ratio runs, only pointed at the invoice instead of the court.

I would start there. Pull the quote. Count the mapped rows. Divide, and put the answer on line one of the declaration before opposing counsel asks for it.

Summarize This Article With AI

Open this article in your preferred AI engine for an instant summary.

Frequently Asked Questions

What else do people ask about proving a collection is complete?

Most follow-up questions ask what counts as one collected row. The answer turns on scope, method and proof, written on the register beside each source.

Does a targeted phone collection count as a collected source?

Yes, if the row says what the filter was. On a 2024 LawNext episode, the founder of Mode One described participant filtering: a collection aimed at conversations between named participants instead of the whole message store. The proof then sits in the hashing and validation, not in a full image. Write the filter on the row.

Does email pulled through Purview or Google Vault close the row?

Not yet. Microsoft Purview and Google Vault make platform collection fairly straightforward. They do not finish it. Linked drive attachments still have to be collected and tied back to the parent email, and versioning still has to be considered, so the row stays partial until both are done.

Does a phone collection pick up the email and chat apps on the device?

Not always. The same founder said Mode One does not collect O365 email, Gmail, Slack or Teams from the phone, and sends users to collect those at the source. Those are separate rows. A phone marked collected can still leave them open.

What does one phone cost to collect?

It depends on what the quote covers. In 2024, Mode One listed $1,500 per phone for collection, processing and conversion, against about $4,000 per phone the host cited for the old approach. Collection-only quotes of about $650 existed too, but they stopped at collection.

One candid note. These are one vendor's list price and one host's comparison, and nothing in the evidence I have shows what a typical ratio looks like by matter type. Price each row against the same scope.

Why does the hash matter if nobody asks for it?

Someone will. A hash is a fingerprint computed from a file's contents; change the file and the fingerprint changes. Hiring managers in the field ask candidates about different hashing algorithms as a matter of routine, and practitioners call metadata "required for meaningful search and review, even when analytics/AI-driven review is not in use." The hash is how the row shows the copy matches the original.

How do I start a register on a live matter?

Start with one matter and one list of containers. Relevant e-Discovery takes new matters through the contact page on its site. Bring the container list. Bring the quote, too.

Written by

Michael

Kansky

Michael Kansky is a serial software entrepreneur who has spent more than two decades building and bootstrapping profitable SaaS and services companies.

Connect on LinkedIn

Read next

A small law office at night, a lone attorney in shirtsleeves seated at a heavy wooden desk lit by a warm brass lampEdiscovery

The Privilege Log Is Due Tomorrow: A Triage Plan

Triage, do not transcribe. Narrow the set, collapse documents into families, screen for lawyer names, then log by category and ask opposing counsel to accept that format before morning.November 4, 202621 min read
AttorneyEdiscovery

'Ask the Record' Finds Nothing: 2 Reasons Why

When "Ask the Record" finds nothing, either the fact is absent from the collection or retrieval missed a passage that is there. Source-linked answers tell you which in one step.November 2, 202621 min read
A slim three-ring binder with a handful of tabbed exhibit dividers lies open on a conference table, beside a neat pile of printed document pages with highlighted passages and a yellow legal pad of handwritten notesEdiscovery

Build a Deposition Hot-Doc Binder From Your Discovery Set

A Hot-Doc Binder is the small set of documents you will show one witness, filtered from an issue-coded, entity-linked review set. Build one per witness, in an afternoon, not a week.November 2, 202621 min read

See it on your matter

Bring us a messy collection - mailboxes, scans, phones, recordings - and watch it become one searchable, defensible record.