Organizing messages by conversation context, not 24-hour chunks, can cut review burden and surface more relevant records — a rare win for both sides in discovery.
When courts confront Slack, Teams, and other messaging data, their first instinct is not a rule but a referral: the parties are better positioned than the court to design the protocol. That leaves it to the parties to decide how a conversation is divided into reviewable and producible units, a choice that quietly governs everything downstream. Made well, that decision can lower the producing party’s burden and give the requesting party a more relevant record. Parties should consider whether unitizing messaging data based on a context window around each search hit is better than today’s de facto standard of unitizing based on rigid 24-hour chunks.
Today, each channel is typically cut into calendar days, and each day is searched, reviewed, and produced as a unit. Under a context window, the parties instead search conversations as they actually occurred, without regard to midnight. Each search hit, together with an agreed number of messages before and after it, becomes the unit that is reviewed and produced. In effect, the parties replace a boundary the clock imposes with one they choose on the merits.
The 24-hour convention took hold for good reasons. Review platforms were built for documents, and Relativity Short Message Format, or RSMF, gave messaging data a document’s shape: a transcript a reviewer could open, code, and produce. Cutting channels at midnight kept transcripts bounded and gave everyone a simple rule. Along the way, though, the daily transcript became the working unit for every step, shaping both which messages a search finds and how much unrelated conversation a reviewer reads alongside them.
None of this makes the 24-hour unit fundamentally improper. Parties are free to agree to it, and some write same-day or 24-hour units into their ESI protocols. Where channels are quiet and conversations rarely run past midnight, it may be a sensible choice. The question is whether the calendar day should be a default adopted out of habit or one option the parties weigh. A default that no one chooses deliberately deserves a closer look.
A Conversation Doesn’t Follow a Calendar
An email or memo is composed and sent as a discrete item, even when the email sits within a thread. A Slack channel or Teams chat is a running exchange whose meaning lives in the back-and-forth, which pays no attention to the calendar. In Lubrizol Corp. v. IBM Corp., No. 1:21-cv-00870, ECF No. 82 (N.D. Ohio May 15, 2023), the court made that point when it ordered a context window for Slack data, treating the messages as more like text messages than hard-copy documents. A unit that follows the conversation keeps related messages together for whoever searches, reviews, or reads them.
Picture a phone call that runs from 11:50 p.m. to 12:10 a.m. No one would transcribe it as two calls filed under different dates, or split the minutes of a late board meeting into two folders because the discussion ran past midnight. Yet 24-hour unitization does exactly that to any conversation that crosses midnight, leaving whoever searches, reviews, or receives it to put the halves back together.
The calendar boundary causes two problems at once. The first is separation. Related messages on either side of midnight land in different units, so a search requiring two terms together may miss the exchange, and a reviewer may see only part of the discussion. Moreover “midnight” turns on timezones, and many chats span timezones. The second is bundling. In a busy channel, one hit pulls the entire day into review, along with every unrelated conversation that took place that day. The unit can be too small and too large at the same time.
What Both Sides Are After
The Federal Rules describe the target, and most state rules are modeled on them. Rule 26(b)(1) limits discovery to what is relevant and proportional to the needs of the case, weighing factors that include the importance of the issues, the parties’ resources, and whether the burden of the discovery outweighs its likely benefit. Under Rule 26(g), counsel certifies after a reasonable inquiry that a discovery response is consistent with the rules and not unreasonable or unduly burdensome. Neither rule requires perfection or asks a producing party to find every responsive message. Both ask for a reasonable, proportionate process the party can explain and stand behind.
Within those limits, the parties’ interests overlap more than the usual discovery fight suggests. A requesting party wants responsive messages and enough surrounding conversation to understand them. A producing party wants a review it can afford and a production it can defend. A unit that tracks how people actually communicated gives the requesting party exchanges it can read and use, and gives the producing party a sound basis for its search and review choices.
For the Producing Party: A Smaller, Denser Review
The cost of the 24-hour unit falls most visibly on the producing party. Review is usually the largest expense in discovery, and it scales with the number of messages someone has to read. When the unit is a calendar day, one hit brings every message from that day into review, including conversations unrelated to the case. In a busy channel, that can mean reading hundreds of unrelated messages to evaluate one relevant exchange, at the producing party’s expense and to no one’s benefit.
StreemView, the e-discovery firm where one of us works, has modeled the difference in a matter involving about 39.2 million Slack messages. By its estimate, converting the data into 24-hour transcripts before searching would have produced a review set of roughly 13.8 million messages. Searching conversations instead, with a context window of five messages on either side of each hit, would have yielded about 1.15 million, a reduction of more than 90 percent. StreemView put the corresponding review and hosting costs at about $1.1 million and about $158,000. Results will vary with the data, but the direction is what one would expect from a unit that no longer pulls whole days into review.
StreemView reported a similar pattern in a case study of more than 700,000 Slack messages, where the court had required a context window of ten messages before and after each hit. According to the study, applying the search terms to whole conversations with that window, and limiting results to a 30-day period around the hits, reduced the population to 10,563 items for export. StreemView reports that the 30-day limit alone removed 13,467 peripheral items and improved precision by 56 percent, when compared to enabling AND operators to traverse the full conversation. For a producing party, that is the difference between reviewing a channel and reviewing the parts of it that matter.
Numbers like these matter. Burden objections built on generalities tend to fail. In Lubrizol, IBM quantified the burden of the original demand for whole channels but offered nothing on the context window proposal actually before the court, and the court therefore could not find that proposal unduly burdensome. The better course is to avoid that contest. A context window agreed to before review begins rarely has to be defended in a motion, and the producing party can use its own figures to shape its proposal without putting them in a brief or disclosing them to the other side.
For Both Sides: A More Relevant Record
The separation problem has a cost for both sides. When a discussion runs past midnight, a search needing two terms together may not find it, and a reviewer may see one part of the exchange without the other. The requesting party wants responsive messages it can understand. The producing party’s counsel needs to know what the client’s people said, in context, to assess the case, prepare witnesses, and avoid surprises from the client’s own messages.
StreemView’s case study illustrates this side as well. According to the study, the parties’ terms returned 192 hits (2,012 messages when expanded for context) against 24-hour transcripts and 1,206 hits (10,563 messages when expanded for context) against the same messages organized as conversations. StreemView attributes the difference to the day boundary, because an AND or proximity search cannot connect terms that midnight has placed in separate transcripts. Two caveats apply. The comparison comes from a single matter and measures one method against the other, not against an independently validated set of responsive messages. And StreemView let terms combine across a 30-day span, wider than a ten-message context window, so the figures show what a day boundary can separate, not what a particular window will find.
The producing party has its own reasons to keep exchanges together. Rule 26(g) asks counsel to sign off on a reasonable inquiry, and a search and review organized around conversations is easier to describe and defend than one shaped by the calendar. It also lowers the risk of rework, since revisiting a search or review after production is almost always slower and costlier than choosing the right unit at the start.
A Context Window Instead of a Midnight Boundary
Parties spend real effort negotiating and testing search terms. The unit those terms run against deserves the same attention, because it shapes search and review as much as the terms do. Under the approach proposed here, conversations are searched as continuous exchanges, and each hit with its context window becomes what is reviewed and produced. RSMF remains the format for delivering that result, not the structure that decides it in advance.
How much context is enough? A calendar day can be too narrow in one place and too broad in another, and an entire conversation can be broader still. In a channel that has run for two years, two terms joined by AND could match messages written months apart about unrelated things. The context window draws that line. Terms count as a combined hit only within the agreed window, and the same window determines how much of the conversation travels with each hit into review and production. The parties set one number, and it governs both.
Parties who want more reach can set the search range separately from what is reviewed and produced. Depending on the tool, that range can be measured in messages, through a proximity connector that runs across the conversation rather than within a daily transcript, or in time, such as within a week or, as in the StreemView case study above, within 30 days. A single window is the simpler place to start, but a separate search range gives the parties a second lever for balancing breadth against review volume.
Seen this way, the 24-hour chunk was always a context window, just a crude one. It is too strict at midnight, where it separates messages written minutes apart, and too loose across a busy day, where it groups messages written hours apart that have nothing to do with each other. A negotiated window replaces that accident with a number chosen for the matter, such as five or ten messages on either side of each hit. Parties who want more precision can set one range for the search and another for what is reviewed and produced, but a single window is the simpler place to start.
Courts that have had to set a context window themselves have chosen a bounded one. In Lubrizol, the court treated the question as one of first impression, described three approaches courts had taken with text messages (the whole conversation, the producing party’s discretion, and a middle ground), and chose the middle ground for that case. IBM had to produce in full any Slack conversation of 20 or fewer messages containing a responsive message and, for longer conversations, the ten messages before and after each responsive one. The same rule applied to Lubrizol’s own Teams messages. Two years later, in Soqui v. England Logistics, Inc., No. 2:24-cv-00261, ECF No. 63 (D. Utah Nov. 4, 2025), a Utah federal court adopted the same rule for Teams messages, holding that production of isolated messages was incomplete.
Those decisions should not be read for more than they hold. Both courts were responding to productions of isolated hits, not calendar-day units, and neither suggested that 10-on-each-side is right for every case. They show that a bounded window is workable, and the Soqui court chose one partly to avoid ambiguity about how many surrounding messages had to be produced. The right size may depend on how busy the channels are, how conversations unfold, and what the requests seek. That is a proportionality judgment the parties are best placed to make.
Checking Your Own Process
A producing party need not take any of this on faith. Before committing to a unit, a review team can sample the daily transcripts that hit on the agreed terms and note how much of each relates to the hit. If most of each hitting day is unrelated conversation, the 24-hour unit is inflating review. If the hits sit in quiet channels, the calendar day may serve well enough. Either way, the team learns about its own data before committing to a review budget or a negotiating position.
A second check looks at separation. Counsel can examine a handful of conversations that run past midnight, for the term combinations that matter most, and see whether related messages would land in different daily units. The check need not be exhaustive. Its value is a record of why the chosen unit fits the data, if anyone later asks how the search and review were designed.
Put It in the Protocol
The rules already provide a place for this decision. Rule 26(f) directs the parties to address the form in which electronically stored information will be produced, and Rule 29 lets them stipulate to their own discovery procedures. An ESI protocol is the natural home for a context window. When a protocol is silent, a court resolving a later dispute will choose for the parties, after review is underway. In Soqui, the court observed that the producing party could have avoided much of its burden by consulting the other side about the form of production first, and it quoted the advisory committee’s note that doing so lets parties resolve disputes before the expense of production.
A workable provision can be short. It should define the conversation, so the parties agree whether a channel, a direct message, or a thread is the unit being searched. It should set the context window around each search hit and say whether conversations below some threshold will be produced whole, as in Lubrizol and Soqui. And it should state the production format, so that RSMF or any other format is chosen for delivery rather than left to decide the unit by default.
Each side should also confirm that its tools can carry out the window. A party whose processing or review platform cannot search across midnight, or cannot export a hit with a defined number of surrounding messages, may end up back at the calendar day whatever the protocol says. That question is best put to vendors while the protocol is still being negotiated.
The Bottom Line
The 24-hour transcript became the default because it was convenient, not because anyone chose it on the merits. For messaging data, a context window around each search hit is usually a better fit. It keeps related messages together, spares the producing party from reviewing whole days of unrelated conversation, and gives the requesting party exchanges it can read and use. Above all, it is a decision the parties can make for themselves, early and on their own terms, before a court makes it for them. Context, in other words, should count for more than the calendar.
Steve guides clients through the complexities of state, federal, and international laws like the California Consumer Privacy Act (CCPA), Section 5 of the Federal Trade Commission Act, and the EU General Data Protection Regulation (GDPR). He helps clients to develop robust privacy and security policies, and to respond to government investigations and other inquiries.
He also advises clients on emerging issues in discovery as AI reshapes the business ecosystem and best practices. His recent publications in this area address the defensibility of using AI for document review, privilege in the context of these new tools, and better practices for collecting, processing, reviewing, and producing corporate messaging data such as Microsoft Teams or Slack.
Steve has a background in software development and launched a successful digital media start-up before attending law school. He was then a fellow at Harvard’s Berkman Klein Center, was Associate Director of the Center for Information Technology Policy at Princeton, and spent four years at the U.S. Department of State running programs related to digital security, encryption, and online freedom of expression. Steve also clerked for the Honorable Joshua Deahl of the U.S. Court of Appeals for the District of Columbia.
Steve has published articles on legal liabilities of internet encryption systems, government liability for cross-border cyber attacks, and agencies’ authority to enforce privacy, consumer protection, and antitrust violations.