Email threading
Email threading in eDiscovery is the analysis that reconstructs an email conversation from its individual messages, orders them, and identifies the inclusive messages, those that contain all the text and attachments of every earlier message in the thread. Reviewing only inclusive messages covers the whole conversation without reading each reply separately.
Also called: thread analysis · inclusive email · thread group · most-inclusive message · email thread suppression
Updated September 6, 2026
How does email threading work?
Threading works from the messages themselves: header fields such as In-Reply-To and References, subject-line normalization, and comparison of quoted text. The platform assembles each conversation into a tree, ordered by time, with branches where a message was replied to twice or forwarded.
It then marks inclusive messages. In a simple linear thread of six replies, the sixth is inclusive of the first five and is the only one a reviewer needs to read. A branched thread has an inclusive message at the end of each branch. Attachments are tracked so that a message dropped from a later reply is not lost.
In review, the thread is shown as a whole, with non-inclusive messages available but not queued. Coding can be propagated across the thread. In production, the ESI protocol decides whether non-inclusive messages must still be produced.
What does email threading look like in practice?
A five-message thread:
| # | Message | Inclusive? | Why |
|---|---|---|---|
| 1 | Mendez → Apex: “Q1 forecast attached” (forecast.xlsx) | No | Contained in 3 |
| 2 | Apex → Mendez: “Numbers look low” | No | Contained in 3 |
| 3 | Mendez → Apex: “Revised” (forecast_v2.xlsx) | Yes | Quotes 1 and 2; forecast.xlsx not re-attached |
| 4 | Apex → Lee: forwards 3 | No | Contained in 5 |
| 5 | Lee → Apex: “Approved” | Yes | Quotes 3 and 4 |
Message 1 remains attachment-inclusive for forecast.xlsx, which appears nowhere later.
How does email threading show up on an eDiscovery invoice?
Threading is an analytics feature and is priced like near-duplicate analysis: included on some platforms, a per-gigabyte or per-matter analytics surcharge on others. Its return is in review: inclusive-only review commonly removes a substantial share of email from the queue. Ask whether threading is included, whether the protocol permits inclusive-only production, and whether the platform can export the thread-group and inclusive flags in the load file.
Sources
- The Sedona Conference Glossary, “email threading.”
- EDRM Analytics guidance on threading and inclusiveness.
Related terms
Near-duplicate · Deduplication · Family relationship · ESI protocol · Document production
eDiscovery at one flat monthly rate
$3,250 a month on a 12-month agreement. No per-user fees and no per-GB hosting charges.
Common questions
What is an inclusive email?
A message in a thread whose body contains the full text of every prior message and whose attachments include every prior unique attachment. Reviewing it is equivalent to reviewing everything before it. A thread may have several inclusive messages where it branches.
Can non-inclusive emails be excluded from production?
Only by agreement. Some ESI protocols permit production of inclusive messages only, provided every unique attachment is produced and lesser-included messages are identified in the load file. Others require every responsive message. Absent a provision, produce them all.
How does threading handle attachments?
An attachment is tracked separately from the message body. A later message that drops an earlier attachment is not inclusive of it, so the earlier message stays in the inclusive set for that attachment. Platforms report this as an attachment-inclusive flag.