What Is Culling in eDiscovery?

A raw collection is never the review set. Once data is collected from custodians, mailboxes, and shared drives, most of it, system files, duplicate copies, personal email, material clearly outside the date range of the dispute, has no bearing on the case. Culling is the step that separates that noise from the data actually worth an attorney's time.

Culling sits in the Processing stage of the EDRM, after collection and before review. It is a related but distinct activity from early case assessment, which is the broader strategic evaluation of a matter's facts, risk, and cost. ECA often uses culling as one of its tools, running early filters to see what a case actually looks like, but culling itself is the mechanical, criteria-driven reduction that continues throughout processing, not the strategic judgment layered on top of it.

How Culling Works

Culling generally runs in layers, each one narrowing the dataset before the next is applied.

• Technical Filters: Technical filters remove data by objective criteria. Date range excludes anything outside the relevant period, file type filtering separates document types worth reviewing from system and program files, and domain or custodian filtering isolates data tied to relevant people or organizations.
• DeNISTing: DeNISTing removes non-user files, such as .exe and .dll system files, by matching against the NSRL, the NIST National Software Reference Library of known software file signatures. It clears operating-system noise that has no evidentiary value before a reviewer ever opens a file.
• Deduplication: Deduplication and near-duplicate detection remove redundant copies of the same or similar files.
• Content Filters: Content filters narrow the set further using keyword or search-term hits, concept clustering, and email threading, which groups a conversation so reviewers see one thread instead of every reply in the chain separately.

Each layer is criteria-driven and, ideally, documented, since the culling methodology itself may need to be defended later, not just its results.

Why Culling Matters

Culling controls cost, keeps discovery proportional, and carries real defensibility risk if it's done carelessly.

1. Cost Savings 

The most direct reason for culling is to reduce expenses. Document review is consistently the most expensive phase of eDiscovery, billed by attorney hours or per-document review rates. Every document culled before review is a document that no reviewer has to spend time examining, and the effect compounds at scale. A raw collection spanning terabytes can shrink dramatically once date-range, file-type, domain, and deduplication filters are applied in sequence.

2. Case Proportionality 

The legal basis for culling comes from the principle of proportionality. Under Federal Rule of Civil Procedure 26(b)(1), discovery must be relevant to any party's claim or defense and proportional to the needs of the case, taking into account factors such as the amount in controversy, the parties' resources, and whether the burden of the discovery outweighs its likely benefit. Culling is, in practice, how a producing party operationalizes proportionality by narrowing the collection to what the case actually requires rather than reviewing everything that was collected.

3. Process Defensibility 

The main risk associated with culling is whether the process can withstand scrutiny. A methodology that is not documented, or search terms chosen without input from the people who actually generated the data, can invite a challenge. In William A. Gross Construction Associates, Inc. v. American Manufacturers Mutual Insurance Co., 256 F.R.D. 134 (S.D.N.Y. 2009), Magistrate Judge Andrew Peck had to craft the parties' keyword search methodology himself after they could not agree on search terms and had not consulted the custodian's staff about the language they actually used. The case is widely cited for the principle that keyword search is an art, not a science, and that culling decisions, especially search terms are more defensible when they are negotiated and documented rather than selected in isolation.

It's also worth separating culling from preservation. Culling happens on data that has already been collected under a duty to preserve; it is not a substitute for it. Over-aggressive culling of data that was never properly preserved in the first place is a spoliation risk, not a cost saving.

How Much Data Does Culling Remove?

Industry sources commonly describe culling as removing the large majority of a raw collection, and Venio's own ECA product materials cite reductions of up to 90% before full review begins. Treat figures like this as directional rather than a guarantee. The real number for any matter depends heavily on how broadly the data was collected in the first place, the file types involved, and how aggressively date range, domain, and keyword filters are applied. A narrowly collected dataset has far less to cull than one gathered with a wide net.

Key Takeaways

• Culling is the criteria-driven process of reducing a raw ESI collection to what's relevant and proportional before attorney review.
• It runs in layers, technical filters (date, file type, domain), DeNISTing, deduplication, and content filters like keyword search and concept clustering, each narrowing the set further.
• Federal Rule of Civil Procedure 26(b)(1) is the legal basis for culling: discovery must be proportional to the needs of the case, not just relevant to it.
• Undocumented or unilateral culling decisions, especially search terms, are a common source of discovery disputes; courts have stepped in to craft search methodology when parties fail to cooperate.
• Culling is not a substitute for preservation. It happens after data is preserved and collected, not instead of it.

Venio ECA culls data early and surfaces what matters before review begins, combining automated de-duplication, DeNISTing, and targeted search in a single workflow. Book a demo to see it run against your own dataset. 

‍

Frequently Asked Questions

What is culling in eDiscovery?

Culling is the process of reducing a raw ESI collection to the documents worth reviewing, by removing duplicate, irrelevant, or non-responsive data using criteria like date range, file type, custodian, and keyword search.

What's the difference between culling and deduplication?

Deduplication is one specific culling technique, removing redundant copies of the same file. Culling is the broader process, which also includes date range filtering, file type filtering, DeNISTing, and keyword or concept-based filtering.

What is DeNISTing?

DeNISTing removes non-user system files, such as program and application files, by matching them against the NIST National Software Reference Library (NSRL), a database of known software file signatures. It clears operating-system noise that carries no evidentiary value.

How much data does culling typically remove?

Industry estimates vary, and figures like a 90% reduction, sometimes cited in eDiscovery marketing, including Venio's own, should be treated as directional rather than guaranteed. The actual reduction depends on how the data was collected, its file types, and how the filtering criteria are applied.

‍