By: George W. Swoyer III, Esq.
Over the past decade, the widespread shift to cloud-based platforms has introduced a new challenge into the legal discovery process: the emergence of modern attachments.
What are Modern Attachments?
Modern attachments (also known as hyperlinked files) are links embedded within documents or emails which direct a user to external digital files stored elsewhere on platforms such as Google Drive, Microsoft SharePoint, or Microsoft OneDrive. Unlike traditional attachments, modern attachments are not actually contained within the host document but rather the files are dynamic references to external files. To further complicate matters, the target files are often editable and may be altered over time by multiple parties. The dynamic characteristic of the files poses significant challenges in litigation, particularly when it comes to preservation, collection, and production of evidence in litigation. While the common nomenclature for these documents is ‘modern attachments’, other terms may be used intending to mean the same thing including hyperlinks, cloud attachments, embedded files and pointers.
Understanding Modern Attachments
Modern attachments are unlike an attached physical PDF or spreadsheet to an email or document. Rather, modern attachments are hyperlinks pointing to external files stored across various digital platforms, such as SharePoint or Google Drive for example. These links allow multiple users to access and edit the same document, meaning the linked file can (and often does) change over time.
These dynamic characteristics make modern attachments particularly difficult to handle in litigation, where accuracy, preservation, and data integrity are paramount.
In legal discovery, modern attachments may exist in emails, chat messages, collaborative tools such as Microsoft Teams or Slack, or within cloud-based repositories. These links may not be immediately apparent in the initial data collection but can contain critical informationthat is essential to a case. This makes it imperative to identify, collect, and preserve not just the hyperlink, but the actual content of the linked file as it existed at the time the link was shared.
Technical Challenges Associated with Modern Attachments
Handling modern attachments involves several technical and logistical hurdles which are not present in traditional physical file collections. Below are several key challenges associated with modern attachments:
- Identification of Linked Attachments
Identifying the modern attachments in a collection could be burdensome. The hyperlinked files are often hosted within extremely large and complex databases. They are not only located in emails, but may be embedded in chat messages (including Microsoft Teams and Slack), embedded in images or contained in cloud-based documents. Some platforms also convert URLs into ‘smart links’, making them less obvious without reviewing metadata fields. The use of advanced techniques, such as analysis of metadata and keyword searching, may be utilized to identify and then narrow the scope of relevant modern attachments requiring collection.
- Collecting Data with a Dynamic and Decentralized Nature
As modern attachments are not always stored in a single central location, another challenge associated with collecting modern attachments is likely to be encountered. The hyperlinked files are often stored across multiple cloud platforms and typically will not reside on the custodian’s local storage system. Furthermore, modern attachments are dynamic in nature. Because of this, the file pointed to may have been altered by other users after the link was initially created. Legal teams must ensure that, when possible, they preserve and collect the version of the file that was current when the link was shared; however, this may not always be technically possible unless versioning or retention policies were active at the time.
Collection of modern attachments may require the use of specialized tools (i.e. Forensic Email Collector), obtaining proper software licensing (i.e. obtaining an E5 Microsoft Purview license which offers the collection option of cloud attachments), developing custom scripting solutions or even a potential manual process to download hyperlinked data.
- Associated Permissions and Access to Modern Attachments
Accessing modern attachments can be difficult due to varying permission levels associated with cloud-stored files. The permissions a user has at the time a link is shared may not be the same at the time of collection, as access can be revoked, inherited from changing SharePoint or Teams groups, or altered through organizational policy updates. Even if a custodian originally had access to the linked file, there is no guarantee that the same access remains available later in the discovery process.
Additionally, some linked files may be protected by passwords, subject to time-limited external sharing links, or located in proprietary systems with restricted authentication requirements. In many environments, guest links or external-share links may have expired, removing access entirely. These shifting access rights make it challenging for legal teams to retrieve linked content and to ensure that the version accessed reflects the same state the file was in when originally shared.
- Preservation of Metadata and Versions
Metadata—such as file names, authorship, modification dates, access logs, and other key attributes—continues to play a critical role in legal discovery. Modern attachments introduce additional complexity because the metadata associated with the linked document may not be preserved if the collection is not performed correctly or if the linked content has changed since the time it was shared.
Because cloud-based documents can be modified by multiple users and often maintain extensive version histories, it is essential to preserve the version of the document as it existed at the time the hyperlink was created or shared. However, this is not always technically feasible unless versioning or retention policies were enabled at that time. When available, audit logs and version histories should also be preserved, as they may be relevant to establishing document authenticity, authorship, and the sequence of edits.
Capturing and preserving this information requires careful planning and the use of tools capable of extracting both the content and the associated metadata in a defensible manner.
- Data Volume and Complexity
Cloud-based storage solutions such as SharePoint, OneDrive, and Google Drive often house vast amounts of data. The sheer volume of information makes identifying relevant modern attachments inherently challenging. Moreover, cloud data often exists in multiple locations and can be replicated across different systems, further complicating collection efforts.
Even when a hyperlinked document is located, legal teams need to ensure that all associated metadata, permissions and version details are captured accurately to preserve the document’s context within the broader evidence collection.
Without the usage of advanced collection tools and expert involvement, maintaining the family relationship between modern attachments and their original documents, and ensuring that linked content is collected defensibly and fully, can become extremely problematic.
Best Practices to Overcome Modern Attachment Challenges
Given the many complexities involved in managing modern attachments throughout discovery, it’s essential for legal professionals to adopt best practices to mitigate risks. Below are several key practices to implement when modern attachments may be involved:
- Early Identification and Preservation Strategies
The importance of early identification cannot be overstated. Legal teams should prioritize locating modern attachments as soon as possible in the discovery process. This includes reviewing metadata fields that contain cloud link indicators, inspecting email and chat messages for embedded links, and analyzing cloud repositories where linked content may be stored.
Legal holds should extend to cloud-based locations—such as SharePoint, OneDrive, Google Drive, Teams, or Slack—where modern attachments are likely to reside. Wherever possible, versioning should be enabled on these platforms to preserve historical iterations of linked documents. Because courts increasingly expect parties to produce the version of a linked file that existed at the time it was shared, enabling version retention proactively is critical to defensible preservation.
- Engagement with Experts and Use of Advanced Tools and Software
It is crucial to involve forensic experts who have access to advanced software tools and are familiar with the best practices when collecting data that includes modern attachments. These professionals will ensure that the correct steps are taken to preserve the relationships between modern attachments and their source documents. Legal teams should engage with experts as early in the discovery process as possible, ensuring a comprehensive approach to the preservation and collection of modern attachments is in place.
Deployment of specialized forensic tools and software platforms designed for modern discovery challenges is essential. Utilizing tools such as Forensic Email Collector, Microsoft Purview (E5), and advanced eDiscovery platforms such as Relativity or Everlaw can help a party effectively identify, preserve, collect, process, review, and produce modern attachments. These specialized software programs are built to handle the complexity of modern attachments, and their proper usage will ensure both the links and the documents they point to are treated as a cohesive whole during discovery. Without such software, one may find they have collected modern attachments but lack a viable path to properly link families back together again.
Additionally, obtaining proper software licensing (for example, an E5 Microsoft Purview license that allows collecting cloud attachments) or even custom scripting may be required to ensure that data is collected accurately. This is especially true when dealing with proprietary or less common platforms, where access to version history or edit logs may be limited. Some cloud environments do not preserve or expose the “version at time of share,” making early coordination and documentation of technical limitations important. Legal teams should work closely with forensic experts and IT professionals to ensure that all relevant data is captured and preserved according to required legal standards, and to document feasibility and access issues that may affect proportionality.
- Drafting Comprehensive and Robust ESI Protocols
A cornerstone of effective discovery practices is a well-drafted ESI (Electronically Stored Information) protocol. The inclusion of a section addressing the treatment of modern attachments should be considered, especially as cloud storage continues to escalate among custodians. The language included within the ESI Protocol should outline clear procedures for handling modern attachments, including identification, preservation, collection methodologies, and production requirements. The protocol should also address how family relationships between the host document (for example, an email) and the linked file will be maintained.
Below are considerations when addressing modern attachments in an ESI protocol:
- The scope of modern attachments to be collected should be clearly defined.
- A process to identify hyperlinked files should be established, which may include the use of search terms, metadata fields, or date filters.
- The protocol may call for the review of a random sample of embedded files.
- Allowing a current file version to be produced when the original version no longer exists, provided the producing party documents the technical limitations or version history available.
- Including provisions for dealing with emerging data types, such as instant messaging apps (for example, Slack and Teams) or collaborative cloud channels where links are frequently shared.
- Ensuring compliance with data privacy regulations, including cross-border data collection and transfer issues.
- Providing the flexibility needed to adapt when good cause is shown by either party, ensuring a path to resolve disputes is in place. When good cause and technical challenges are present, the parties should meet and confer to discuss alternative solutions and amendment of the ESI protocol.
Courts increasingly expect parties to raise modern-attachment issues early in protocol negotiations and may consider the absence of such provisions when determining proportionality, motion practice, or disputes over linked content.
- Collaboration Across Teams
Open channels of communication between legal professionals, IT teams, forensic experts, and external litigation support vendors is paramount in ensuring the successful management of modern attachments. Clear communications across relevant teams, both internal and external, will go a long way in preventing costly mistakes or oversights. Mistakes that may be avoided include failing to identify important modern attachment files or neglecting to capture relevant versions of hyperlinked documents at the time of collection.
Because cloud-based systems and collaborative platforms frequently change ownership, permissions, and storage locations, close coordination also helps ensure that all parties understand where linked content resides, what access rights are available, and what technical limitations may affect collection. A collaborative approach for managing modern attachments will ensure that the legal team acquires the necessary technical insights, has access to appropriate tools, and develops defensible workflows capable of addressing the complexities modern attachments introduce into the discovery process.
- Continuing Education and Ongoing Training
Challenges associated with the legal discovery process continue to escalate as technology evolves. Legal professionals must engage in ongoing education and regular training to keep pace with these rapid changes. This includes staying informed about the latest software updates, understanding how cloud platforms modify their link-handling behaviors, attending relevant continuing education courses, and learning about new legal precedents as they emerge.
As modern attachments become more common, particularly within collaboration tools such as Microsoft Teams, Slack, and other cloud-based environments, it is critical for legal teams to remain current on the latest tools and techniques available for identifying, collecting, and preserving linked content. Regular training ensures that legal professionals, IT personnel, and forensic practitioners understand not only the technical workflows but also the evolving case law and proportionality considerations associated with modern attachments.
Future Developments Expected Regarding Modern Attachments
- Advances in AI and Machine Learning will Help with Identification of Hyperlinks
Artificial intelligence (AI) and machine learning will continue to play pivotal roles in the treatment of modern attachments during the discovery process. Computer-assisted technologies will help identify and categorize modern attachments by automating previously manual, time-consuming tasks. These technologies will reduce the volume of irrelevant hyperlinks requiring collection, review, or production by analyzing context, link-type patterns, and user-generated metadata.
AI-driven tools are also increasingly capable of detecting smart links, collaborative links generated by platforms like Microsoft Teams or Google Workspace, and links embedded within chat messages. Machine learning algorithms may further be used to identify patterns in version histories, determine whether linked files changed after sharing, and assist with defensibility by surfacing anomalies in access or edit logs.
- New Software Solutions Will Become Available in the Market
Continued advancements in software designed to handle modern attachments are expected. New tools will emerge that streamline the identification, preservation, collection, processing, review, and production of modern attachments throughout litigation. Cloud storage platforms themselves are also evolving, offering improved APIs, permission reporting, link metadata fields, and version-history capabilities that support more accurate collection workflows.
Integrated eDiscovery platforms are beginning to include native link-analysis and link-mapping features, giving legal teams clearer visibility into the relationships between host documents and linked content across emails, collaboration tools, and cloud repositories.
- Evolution of a New Method of Communication Using Modern Attachments
Communication workflows continue to shift toward cloud-based collaboration. Modern attachments are increasingly functioning not just as references to documents but as the core medium of communication. In email, Teams, Slack, Google Workspace, and similar tools, embedded links to live documents, shared drives, or collaborative workspaces serve as the primary means of exchanging information.
As this communication model expands, courts will face new questions about how to treat these linked materials, how to define “attachments” for discovery purposes, and how to handle situations where communications themselves depend on constantly changing cloud-based content. Hyperlinks and document versioning will play a more integrated role in digital dialogue, further complicating the discovery process.
- A Broader Interpretation of Modern Attachments by the Judiciary
Judicial interpretations of modern attachments continue to evolve. Courts increasingly recognize the importance of modern attachments and are more frequently ordering their collection and production when technically feasible. While courts do not require parties to develop or acquire new technology solely for the purpose of hyperlink collection, they expect parties to understand and document the technical capabilities and limitations of their systems.
Parties that use cloud-based collaborative platforms in the normal course of business are more likely to be expected to produce linked content, and courts may view failure to preserve or collect such materials—when feasible—as a discovery deficiency.
- Data Privacy and Globalization of Data Storage Issues
Data privacy concerns remain significant, particularly given that modern attachments are stored in cloud environments that may span multiple jurisdictions. Legal teams must be prepared to navigate privacy and data-transfer regulations, including GDPR, data-localization laws, and cross-border access restrictions.
Because cloud platforms increasingly offer regionalized hosting and international collaboration features, legal teams must evaluate where data is stored, under what conditions it may be accessed, and which laws govern its preservation and collection. These considerations are especially important when modern attachments contain sensitive or personal information.
- Enterprise Link Governance Will Shape Preservation and Collection Strategy
Organizations are increasingly instituting internal “link governance” policies that control how employees create, share, and maintain cloud-based hyperlinks. These policies may include auto-expiring links, restricting “anyone with the link” access, mandatory authentication, or automatic conversion of public links into internal-only versions. As companies tighten security and data governance practices, these rules directly impact the availability of linked content for discovery.
Link governance policies also affect the stability of modern attachments. Auto-expiration settings, migration of SharePoint sites, or restructured Teams channels can break existing hyperlinks or change permissions without notice. Legal teams must understand these enterprise-level controls early in the discovery process to avoid losing access to key linked documents and to ensure proper preservation of the underlying content, associated metadata, and version histories.
Conclusion
Modern attachments have introduced new challenges into the legal discovery process. As businesses increasingly rely on cloud-based platforms, the usage of modern attachments continues to rise. Going forward, the presence of modern attachments should be expected at the outset of litigation. Their dynamic, decentralized nature poses significant technical and logistical challenges for legal teams.
To effectively navigate these hurdles posed by hyperlinked files, legal professionals must adopt best practices including early identification, engagement of experts, negotiating well-drafted ESI protocols, using advanced forensic and discovery tools, team-wide collaboration, and continual education. Legal teams should also be aware of evolving case law, proportionality expectations, and the technical limitations of the systems involved, documenting feasibility wherever necessary.
As we look ahead, advancements in AI, machine learning, and specialized software will further enhance the ability of legal teams to manage modern attachments throughout litigation, and courts will continue to treat modern attachments more like traditional attachments when technically feasible. As cloud collaboration tools evolve, understanding how linked content is created, stored, versioned, and preserved will remain essential to defensible discovery practices.
For more information regarding Modern Attachments or to speak with one of our subject matter experts, you can contact us here. Thank you!
This article was originally published in October of 2024. It has been updated to reflect the latest information regarding collecting and preserving modern attachments and hyperlinked files.
