De-NISTing
De-NISTing in eDiscovery is the removal from a collection of files known to be standard operating-system or commercial-software components, identified by matching each file's hash against the National Software Reference Library (NSRL) maintained by NIST. It eliminates files that cannot be evidence (executables, DLLs, fonts, installers) before processing and review.
Also called: de-NIST · deNIST · NIST filtering · NSRL filtering · known-file filtering
Updated September 6, 2026
How does de-NISTing work?
A forensic image of a laptop contains hundreds of thousands of files, most of them the operating system and installed applications. None of them can be relevant to a dispute, but each would otherwise be processed, indexed, hosted and possibly reviewed. De-NISTing runs first: every file is hashed, the hash is looked up in the NSRL Reference Data Set, and matches are removed and logged.
It is most valuable on full-device and file-share collections and nearly irrelevant to targeted mailbox collections, which contain few system files. The ESI protocol commonly lists de-NISTing among the culling steps a producing party may apply without further agreement, alongside deduplication and date filtering.
What does de-NISTing look like in practice?
A 200 GB laptop image: after de-NISTing, roughly 60 to 80 percent of files by count are typically removed (the operating system, Office binaries, drivers, fonts) leaving user-created and downloaded content for the next culling step. The proportion by volume is often lower, since user data includes large media files. (Ranges are illustrative; results vary with the machine.)
How does de-NISTing show up on an eDiscovery invoice?
De-NISTing is a processing step. Some providers include it; others charge it as part of an ECA or culling fee per gigabyte, and a few bill processing on the pre-de-NIST volume, which means paying to process files that are then discarded. Ask at which stage volume is measured for the processing fee, and whether de-NISTing happens before or after.
For what the surviving gigabytes translate to in documents and pages, see the pages-per-gigabyte guide.
Sources
- NIST, National Software Reference Library, Reference Data Set documentation.
- The Sedona Conference Glossary, “de-NIST.”
- EDRM Processing Standards.
Related terms
Culling · Hash value · Processing · Deduplication · Collection
eDiscovery at one flat monthly rate
$3,250 a month on a 12-month agreement. No per-user fees and no per-GB hosting charges.
Common questions
What is the NIST list?
The National Software Reference Library, a collection of hash values for files in published software packages, maintained by NIST and updated periodically. eDiscovery platforms load the NSRL Reference Data Set and drop any collected file whose hash appears in it.
Does de-NISTing remove user documents?
No. The NSRL contains hashes of files shipped with software, not files a person created. A Word document, an email or a spreadsheet will never match. Template and sample files installed with an application will, and are removed.
Is de-NISTing the same as deduplication?
Both use hash values, but they answer different questions. De-NISTing asks whether a file is known system content and removes it regardless of how many copies exist. Deduplication asks whether two collected files are identical and keeps one.