Email Conversion for eDiscovery and Legal: A Forensic Practitioner's Guide

Email as Digital Evidence

Email remains the single most important source of digital evidence in civil litigation, regulatory investigations, and internal corporate inquiries. According to industry estimates, over 90% of all business communication still flows through email, making it the richest source of discoverable information in legal proceedings.

When email enters the legal domain, every aspect of how it is collected, processed, and converted becomes subject to scrutiny. A conversion that mangles dates, drops attachments, or breaks the chain of custody can undermine an entire case. Conversely, a properly documented, forensically sound conversion process strengthens the evidentiary value of the data.

This guide covers the intersection of email conversion and legal practice — how to convert email files while maintaining their evidentiary integrity, what formats courts and regulators expect, and how to document the process to withstand legal challenge.

Legal Framework for Email Evidence

Federal Rules of Civil Procedure (FRCP)

In the United States, the FRCP governs the discovery of electronically stored information (ESI), including email:

• Rule 26(b)(1) — Parties may discover any nonprivileged matter relevant to any party’s claim or defense
• Rule 34(a) — Requests for production can specify the form of ESI
• Rule 37(e) — Sanctions for failure to preserve ESI when litigation is reasonably anticipated

General Data Protection Regulation (GDPR)

For email involving EU data subjects, GDPR adds constraints:

• Article 5(1)(b) — Purpose limitation: email collected for litigation may not be repurposed
• Article 5(1)(c) — Data minimization: convert and produce only what is necessary
• Article 6(1)(f) — Legitimate interest: the legal basis for processing email in litigation
• Article 49 — Derogations for international transfers in legal proceedings

Other Regulations

• HIPAA — Healthcare email requires redaction of protected health information before production
• SOX — Financial records must be preserved in original form
• SEC Rule 17a-4 — Broker-dealer communications must be retained in non-rewritable format
• State laws — Various state-level data protection and discovery rules

Preservation: The First Step

Litigation Hold

When litigation is reasonably anticipated, a litigation hold must be implemented immediately:

1. Identify custodians — Determine whose email may contain relevant information
2. Issue hold notices — Notify custodians and IT of the preservation obligation
3. Suspend deletion — Disable auto-archive, auto-delete, and retention policies for held data
4. Preserve in place — When possible, preserve email in its original location and format
5. Collect when necessary — If in-place preservation is not feasible, collect to a secure location

What to Preserve

For each custodian, preserve:

• Active mailbox (Exchange/Microsoft 365/Gmail)
• PST files on the custodian’s workstation and network shares
• OST files (may contain unsynced data)
• MBOX files from Thunderbird or other clients
• MSG or EML files saved to the filesystem
• Email on mobile devices
• Archived email on backup tapes or cloud archives

Forensic Collection Best Practices

• Collect first, convert later — Always preserve the original format before any conversion
• Use forensic imaging tools — EnCase, FTK Imager, or similar tools that create bit-for-bit copies
• Calculate hash values — MD5 and SHA-256 hashes of every collected file
• Document the chain of custody — Who collected what, when, where, and how
• Maintain write protection — Use write blockers when imaging source media

When Conversion Is Necessary for Legal Proceedings

Common Conversion Scenarios

Conversion is typically required when:

• The review platform requires a specific format — Most eDiscovery platforms prefer EML or MSG format for individual message processing
• The producing party uses a different email system — PST files from Outlook may need conversion for a recipient using Gmail or Thunderbird
• The court orders production in a specific format — Some courts mandate EML, PDF, or TIFF production
• Cross-platform review — Legal teams on Mac or Linux cannot open PST files natively
• Redaction and privilege review — Individual message formats (EML, MSG) are easier to review than database formats (PST, OST)

Format Selection for Legal Production

Converting PST for Legal Review

Convert PST to EML is the most common conversion for legal purposes:

• Each message becomes a separate file for individual tagging and review
• Headers are preserved in human-readable form
• Attachments can be extracted and reviewed independently
• File-level hash values can be calculated for each message
• EML is accepted by virtually all eDiscovery platforms

Recovering Data from OST Files

Orphaned OST files frequently appear in legal matters — for example, when a custodian has left the organization and their Exchange account has been deleted. Convert OST to PST recovers the data, or convert OST to EML for direct ingestion into review platforms.

Maintaining Chain of Custody During Conversion

Documentation Requirements

Every step of the conversion process must be documented:

Hash Verification

Hash values are the foundation of digital evidence integrity:

1. Before conversion — Calculate SHA-256 hash of the source file
2. After conversion — Calculate SHA-256 hash of each output file
3. Store hashes — Record all hash values in the chain of custody documentation
4. Verify later — Recalculate hashes at any point to confirm no modification has occurred

Preserving Original Files

Never convert in place. Always:

1. Create a forensic copy of the original file
2. Work from the copy, not the original
3. Preserve the original in a secure, tamper-proof location
4. Maintain the original in its native format indefinitely (or as required by hold orders)

Handling Specific Legal Conversion Challenges

Email Threading and Conversation Reconstruction

Legal review often requires understanding email conversations as threads:

• Conversion must preserve In-Reply-To and References headers for proper threading
• Some tools strip or modify these headers — verify in your pilot
• Thread visualization depends on the review platform, not just the conversion

Encrypted and Signed Messages

S/MIME encrypted or signed messages present unique challenges:

• Encrypted messages — The encrypted content converts as-is (still encrypted). Decryption requires the recipient’s private key, which may not be available.
• Signed messages — Digital signatures may become invalid after conversion if the MIME structure changes. Document that the signature was valid at the time of collection.
• PGP messages — Similar considerations as S/MIME

Calendar and Contact Data in PST Files

PST files contain more than email. In legal matters:

• Calendar entries may show meeting attendance and timing
• Contact records may reveal relationships
• Tasks and notes may contain relevant information

When converting PST to EML, non-email items may be lost. Consider extracting calendar data to ICS format and contacts to VCF format separately.

Deleted and Recovered Messages

PST files may contain recoverable deleted messages in unallocated space:

• Standard conversion tools only convert active (non-deleted) messages
• Forensic recovery tools (EnCase, FTK, Kernel PST Recovery) can extract deleted items
• Recovered messages should be clearly marked as recovered in the production

Large Attachments and Embedded Objects

Legal production may require separating attachments from messages:

• Family grouping — Keep parent messages and child attachments linked by a family ID
• De-NIST — Remove known system files (NIST NSRL) from attachment review
• Near-duplicate detection — Identify near-duplicate attachments across messages
• Size limits — Some production media or platforms have per-file size limits

Quality Assurance for Legal Conversions

Validation Checklist

Statistical Sampling

For very large conversions where 100% verification is impractical:

• Use stratified random sampling across folders and date ranges
• Sample size should provide 95% confidence at 1% margin of error
• For 100,000 messages, this means sampling approximately 9,600 messages
• Document the sampling methodology and results

Exception Documentation

For any messages that fail conversion:

• Record the source file, message identifier, and error description
• Classify the failure (corrupted source, encoding error, unsupported feature)
• Document recovery attempts
• Report the exception to opposing counsel and the court as appropriate

eDiscovery Workflow Integration

Collection to Review Platform

The typical eDiscovery workflow for email:

1. Collection — Forensic collection of PST, OST, MBOX, and other email files
2. Processing — Conversion to review-ready format (usually EML or MSG), extraction of metadata, text, and attachments
3. Review — Attorneys review messages for relevance, privilege, and responsiveness
4. Production — Responsive, non-privileged documents are produced in the agreed format

Conversion happens primarily in step 2 (processing). The output must be compatible with the review platform (Relativity, Concordance, Everlaw, Logikcull, etc.).

Metadata Fields for Review Platforms

eDiscovery platforms expect specific metadata fields. Ensure your conversion preserves:

• DocID — Unique identifier for each message
• From — Sender address
• To — Recipient addresses
• CC/BCC — Copy recipients
• Subject — Message subject
• DateSent — Send date/time with timezone
• DateReceived — Receive date/time with timezone
• HasAttachments — Boolean flag
• AttachmentNames — Semicolon-separated list of attachment filenames
• FolderPath — Original folder location within the mailbox
• MessageID — RFC 5322 Message-ID header

Production Formats

Common production formats and how to create them:

EML production: Convert PST to EML or convert OST to EML directly.

Load file production: Most review platforms can export load files (Concordance DAT, Relativity, IPRO) that reference the native message files.

PDF production: Convert individual messages to PDF for court filings. This is typically done from the review platform, not from the raw email files.

International and Cross-Border Considerations

GDPR and EU Data Transfers

When email data must leave the EU for litigation in the US or other jurisdictions:

• Data Protection Impact Assessment (DPIA) — Required before transferring personal data
• Legal basis — Article 49(1)(e) allows transfers necessary for legal claims
• Minimization — Transfer only what is necessary for the litigation
• Security — Use encrypted transfer channels and secure storage at the destination

When converting email for cross-border production, use tools with EU-based processing. MailtoPst processes all data on GDPR-compliant EU servers, with automatic 24-hour file deletion, ensuring data does not persist beyond the conversion process.

Multi-Language Email

International litigation often involves email in multiple languages:

• Verify that the conversion tool preserves character encoding for all languages present
• Test with sample messages in each language before full conversion
• Some review platforms require language identification metadata — ensure the conversion preserves Content-Language headers when present

Cross-Jurisdiction Format Requirements

Different jurisdictions may have different format preferences:

• US courts — Generally accept EML, MSG, PST, PDF, or TIFF
• UK courts — Practice Direction 31B allows parties to agree on format; EML and PDF are common
• EU courts — Vary by member state; PDF is widely accepted
• International arbitration — Format is typically negotiated between parties

Tools and Technology

MailtoPst for Legal Conversions

MailtoPst provides several features valuable for legal conversions:

• Format flexibility — Convert between PST, EML, MBOX, MSG, EMLX, OST, and OLM
• Metadata preservation — Full header and metadata retention
• EU-based processing — GDPR-compliant servers in the European Union
• Automatic deletion — Files removed after 24 hours
• No software installation — Works in any browser, reducing the forensic footprint
• Batch processing — Handle multiple files efficiently

Common legal conversion paths through MailtoPst:

• PST to EML for review platform ingestion
• OST to PST for orphaned mailbox recovery
• MBOX to EML for Gmail/Thunderbird data processing
• MSG to EML for format normalization

Dedicated eDiscovery Platforms

For large-scale legal processing, dedicated eDiscovery platforms offer:

• Automated metadata extraction
• Text extraction and OCR
• Email threading and near-duplicate detection
• Privilege logging
• Production formatting
• Audit trails

These platforms typically accept EML, MSG, or PST as input — making MailtoPst useful for preparing data for ingestion.

Cost Management

Factors Affecting Cost

Enterprise legal email conversion costs depend on:

• Data volume — The primary cost driver
• Complexity — Number of source formats, languages, custodians
• Urgency — Rush conversions cost more than planned migrations
• Verification level — Full validation is more expensive than spot-checking
• Compliance requirements — Documentation and audit trails add overhead
• Tool licensing — Per-GB or per-user licensing models

Cost Reduction Strategies

• Early case assessment — Use keyword culling and date filtering before full conversion to reduce volume
• Deduplication — Remove duplicate messages before conversion
• Phased approach — Convert priority custodians first, then expand as needed
• Right-size your tools — Use online tools like MailtoPst for smaller conversions; invest in dedicated platforms only for very large matters

Frequently Asked Questions

Is email conversion admissible in court?

Yes, provided the conversion process is properly documented and the chain of custody is maintained. Courts generally accept format conversion as a necessary step in processing ESI, as long as the content, metadata, and integrity of the original data are preserved. Document your process thoroughly.

What format should I produce email in for litigation?

Negotiate the production format with opposing counsel and the court. EML is the most versatile choice — it is universally readable, preserves headers and metadata, and works with all major review platforms. For court filings and exhibits, PDF is standard. Some courts still require TIFF.

How do I handle privileged emails during conversion?

Conversion should happen before privilege review. Convert all potentially relevant email first, then use the review platform to identify and log privileged documents. Privileged documents are withheld from production, but the conversion itself is a processing step that does not waive privilege.

Can I use MailtoPst for legal eDiscovery work?

Yes. MailtoPst provides reliable format conversion with full metadata preservation, processing on GDPR-compliant EU servers, and automatic file deletion. For legal work, document the conversion parameters, record hash values of source and output files, and maintain the chain of custody log. Convert PST to EML or OST to PST are common legal conversion paths.

What about deleted emails in PST files?

Standard conversion tools convert active messages only. Deleted items in the Deleted Items folder are converted normally. Permanently deleted messages in unallocated PST space require forensic recovery tools (EnCase, FTK). If deleted message recovery is relevant to your case, use forensic tools before standard conversion.

How do we handle email from departed employees?

If the Exchange account is still active, export to PST from the server side. If the account has been deleted, check for OST files on the employee’s workstation — convert OST to PST to recover the cached data. Also check for PST files the employee may have saved to their workstation, network drives, or cloud storage.