From Data Chaos to Case Strategy: What a Live Investigation Reveals About Modern Ediscovery
You've just been handed a mountain of data. Your client is in trouble. The meeting is tomorrow. Where do you start?
That was the premise behind an interactive webinar from Everlaw and Sandline Global, Unmasking the Truth: Real Time Ediscovery Action, where attendees were dropped into the middle of a high-stakes investigation and walked through exactly how modern ediscovery tools handle the pressure of tight deadlines and massive document sets.
The scenario featured Everlaw’s Gregory Campbell, Principal Solutions Architect, and Ralf Kaiser, Chief Technology Officer at Sandline Global, a legal technology advisory firm. Rather than a conventional product walkthrough, the team role-played a live investigation scenario using the Enron dataset, with audience polls shaping the direction of the inquiry.
The session demonstrated something practical: how a law firm, a technology platform, and a consulting partner work together when the clock is ticking.
Step One: The Call Comes In
The setup was deliberately stressful. A law firm receives a last-minute request from a high-profile client, Enron. The data is voluminous, the facts are unclear, and the client expects answers by tomorrow morning.
Before any data enters a platform, someone has to figure out what needs collecting, where it lives, and how to get it there defensibly. That's where Sandline comes in.
Kaiser described the typical first call from a law firm. "It’s a flustered lawyer on one side of a project, not knowing anything about the scope or what we're going to find. But it's urgent," he said.
Sandline starts with the basics: timelines, number of custodians, data sizes. From there, they handle collections across jurisdictions, navigate data privacy requirements, ensure defensible chains of evidence, and get the data into shape for the platform. For modern data types such as phone communications, messaging apps, Sandline uses its own tools to preserve metadata and threading before anything reaches Everlaw.
"We support our customers throughout all the stages of the EDRM life cycle," Kaiser explained.
Campbell addressed a concern that's front of mind for UK practitioners handling sensitive matter: data security. He explained the security infrastructure underpinning this work. Everlaw hosts in the UK (London) and the EU (Frankfurt) through AWS, with its own certifications including ISO 27001, 27017, and 27018, SOC 2 Type 2, and Cyber Essentials Plus. "Those security certifications are our own, and we're annually audited on them," he said.
Step Two: Ask the Data What Happened
The investigation began with Everlaw Deep Dive, Everlaw’s retrieval augmented generation (RAG) tool. Campbell asked a deliberately broad question across the entire document set: set out the key topics and issues we need to investigate.
"There's a lot of talk about lawyers or investigators becoming coders. We don't believe you need to be a coder," Campbell said. "I'm asking this question in a very natural manner."
Within seconds, the tool returned citation-backed answers, identifying 63 potentially relevant documents, generating facts from those documents, and flagging key topics including the LJM partnerships and Raptor special purpose vehicles that were central to the Enron case.
Every answer linked back to a source document. "That verification step's really important," Campbell noted. "Deep Dive is using that RAG technology to pin your answers to the set to give you that increased confidence."
Step Three: See Who’s Talking to Whom
What stood out about the demonstration was how each tool fed into the next rather than operating in isolation.
After Deep Dive surfaced the key topics, Campbell moved to Everlaw's clustering tool, which groups documents by conceptual similarity. The cluster defining terms around Raptor and LJM confirmed what Deep Dive had flagged, adding another layer of confidence.
From clustering, the team generated search terms and moved into the communications visualizer, which maps who is talking to whom across the document set. The visualisation revealed communication patterns between key executives, with node sizes indicating email volume and arrow direction showing who was initiating conversations.
"If Jeff says, 'I never communicated with James at all,' you can see here that there's maybe a chain of inquiry to follow because it appears that Jeff is indeed communicating with James," Campbell observed.
When polled, the audience chose to investigate custodians communicating with different domains. Campbell drilled into a senior executive named “Vince”, filtering by domain. This revealed communications with a personal AOL email account. Among those 38 documents: emails about coping with ethical issues.
"This does look a little bit like a potential smoking gun," Campbell said.
Step Four: Process the Documents at Speed
With key documents identified, the session moved into the tools that help practitioners actually process what they've found.
Campbell demonstrated several AI features that could be used in this scenario.
Descriptions and summaries condensed lengthy documents into readable overviews. A 102-page report got both a high-level description and a detailed summary, with the ability to jump to source text for verification.
Topic summaries broke documents into themes with sentiment analysis, flagging positive, negative, and harmful content. "Which is quite useful when you're dealing with email communications, particularly in investigations," Campbell noted.
Custom extractions used natural language prompts to pull specific information from documents. Campbell demonstrated an entity extraction for names of natural persons, excluding organizations. This can be useful for quickly mapping who appears across a document set.
Everlaw’s Coding Suggestions automated initial document classification against issue codes. Campbell was clear about the boundary: "We are not coding the documents. We are making suggestions about it. We strongly believe that having that human in the loop is very important."
Coding Suggestions produced a spectrum from hard “yes” to hard “no”, with soft responses in between that flag documents requiring human attention. "If you know how to put together a review protocol for a review team, you will be able to put together your coding suggestions in Everlaw," Campbell explained.
Step Five: Draft the Memo
The final step addressed the blank-page problem: turning investigation findings into something a client can read.
Using Everlaw's Storybuilder and its integrated writing assistant, Campbell generated a draft memo analysing the role of the Raptor special purpose vehicle in fraudulent accounting practices. The output appeared in real time and could also be generated in different languages. For instance, Campbell demonstrated a German translation for the international audience.
"This isn't designed to be the final piece of work," Campbell said. "This is to get you away from that blank page."
Why the Partnership Matters
Kaiser's closing comments grounded the technology in operational reality.
"The flustered lawyer would probably not be willing to find all those easy clicking buttons shortly before your high stakes meeting. That's where we come in. We are the specialist on demand," Kaiser said of Sandline.
Sandline's involvement extends beyond the initial setup. They support production assistance, loading additional data including opposing counsel's productions, and eventually data disposition once matters close. "We are continuously there on communications, on the case, and helping on all of these," Kaiser noted.
The partnership model reflects a practical reality: powerful tools still require experienced hands to deploy them effectively under time pressure.
What the Session Demonstrated
The team went from knowing nothing about a matter to identifying key topics, mapping communications between executives, surfacing potential smoking-gun documents, classifying thousands of documents by relevance, and drafting a client memo—all within a single session.
The technology is accessible and the workflow familiar. What sets the approach apart is speed, and the confidence that comes from citation-backed, verifiable outputs rather than best guesses under pressure.
