Family relationship
A family relationship in eDiscovery is the link between a parent document and the items attached to or embedded within it: an email and its attachments, a document and an embedded spreadsheet, a container and its contents. Family members are kept together through processing, review and production, and the relationship travels in the load file as an attachment range.
Also called: parent-child relationship · family group · attachment family · document family · BEGATTACH
Updated October 2, 2026
How are document families kept together?
Processing is where families are established. When a container is expanded, the tool records which items came out of which: messages out of a PST, attachments out of a message, embedded objects out of a document. That parentage is stored as a field on every item and has to survive every later step.
Three consequences follow. Families are usually assigned to a reviewer as a unit, so one person sees the transmittal and the attachment together. Deduplication operates on families rather than loose items: an attachment identical to one already in the set is not suppressed if its parent email is unique, because removing it would break a family that is otherwise new. And at production, families are numbered contiguously, so the attachment range is a continuous span of Bates numbers.
The relationship is fragile in exactly one place: production. A family split across two rolling volumes, or an attachment withheld for privilege while its parent is produced, leaves a gap that the receiving party will notice and ask about. Where a member is withheld, the usual answer is a slip sheet in its place, so the range stays continuous and the omission is visible rather than silent.
Checking family completeness before a volume leaves is a standard pre-production step. It is item 6 on the production checklist.
What do document families look like in practice?
An email with one spreadsheet attachment, as the DAT records it:
| Field | Parent email | Attachment |
|---|---|---|
| BEGBATES | SMITH-000148 | SMITH-000151 |
| ENDBATES | SMITH-000150 | SMITH-000155 |
| BEGATTACH | SMITH-000148 | SMITH-000148 |
| ENDATTACH | SMITH-000155 | SMITH-000155 |
Both rows carry the same BEGATTACH and ENDATTACH. The family spans SMITH-000148 through SMITH-000155, the parent occupies the first three pages, and the attachment occupies the remaining five. A receiving platform groups the two rows on that shared range without needing any other field.
How do document families show up on an eDiscovery invoice?
Family relationships are built during processing, as part of expanding containers and extracting attachments, and they are written out again during export and production. Neither is normally a separate line, and a provider charging extra to preserve parentage is charging for something the pipeline does anyway.
Where families do cost money is when they break. A production reissued because attachments were orphaned is a second export and production charge, a second format conversion run if images are rebuilt, and project management hours to assemble the corrected volume, billed hourly at a rate the Fee Field Guide records as discretionary and rarely capped.
Worth asking: does the platform validate family completeness before an export, is that validation report available, and is a re-production issued to repair broken families billed as a new production.
Sources
- EDRM, Production Guide on family relationships and attachment ranges.
- The Sedona Conference, Glossary: eDiscovery & Digital Information Management, “family.”
- Fed. R. Civ. P. 34(b)(2)(E) on the form of production.
- Fee ranges: the Fee Field Guide dataset.
Related terms
Document production · Load file · DAT file · Deduplication · Email threading · Redaction
eDiscovery at one flat monthly rate
$3,250 a month on a 12-month agreement. No per-user fees and no per-GB hosting charges.
Common questions
What is a parent-child relationship in eDiscovery?
The parent is the item that carries the others: an email, or a document with something embedded in it. The children are the attachments. The pair is a family, and platforms treat the family as one unit for review assignment, coding and production, because an attachment read without its transmittal email, or an email read without what it sent, is frequently misleading.
Do you have to produce the whole family if only one member is responsive?
No rule requires it in terms, but most ESI protocols do, and the practice is common enough that departing from it usually needs agreement. The argument for family production is that the parent supplies the context that makes the attachment intelligible. The argument against is that it produces non-responsive material. Settle it in the protocol rather than at production, and note that privilege is decided per document even when responsiveness is decided per family.
What are BEGATTACH and ENDATTACH?
Load-file fields that record the family's span. BEGATTACH holds the first Bates number of the family, usually the parent's first page, and ENDATTACH holds the last Bates number of the last child. Every member of the family carries the same pair of values, which is how a receiving platform reassembles families from a flat list of documents.