Exceptions Triage Cheat Sheet

DLC-M02-001 · Module 02 Deliverable

Matter

Vendor

A processing report is a set of receipts. This cheat sheet tells you which receipts to fight, which to quietly file, and which to escalate — so you spend your client's remediation budget where it moves the needle, not where it looks impressive.

The Triage Verdicts

Verdict	Meaning	When to use it
REMEDIATE $	Push the vendor to fix and re-process.	The document is likely responsive, is technically recoverable, and remediation cost is less than review cost of the recovered volume.
DEFER ?	Set aside for now; revisit if it becomes material.	Recoverable but low probability of responsiveness, or the corpus is still evolving.
ABANDON ✗	Document the exclusion; move on.	Not recoverable, or recovery cost exceeds the marginal review value even in the worst case.
ESCALATE !	Client + Delphoria advisor, same day.	Exception count exceeds threshold, or suggests systemic collection failure.

Exception Class Reference

Exception Class	Default	Rationale & vendor ask
Password-protected	REMEDIATE	Common and almost always crackable with modest compute. Ask the vendor for their cracking capacity and turnaround. If cracking fails, custodian re-ask is next.
Encrypted volume	DEFER → REMEDIATE if key surfaces	FileVault, BitLocker, VeraCrypt. Recovery requires the key. Escalate to Client for custodian outreach.
Corrupt container (partial)	REMEDIATE	Most modern tools can recover 60–95% of a corrupt PST/ZIP. Ask for a partial-recovery pass with an inventory of unrecovered items.
Corrupt container (total loss)	ABANDON	Document the container origin (custodian, source), the failure mode, and preserve the raw container. Note in production narrative.
Unsupported file type	DEFER	Depends on what it is. CAD files, proprietary EDA formats, media raws — assess responsiveness first, then decide.
Zero-byte file	ABANDON	Common noise. Log the filenames in case a pattern emerges (e.g. hundreds of same-named zero-bytes may indicate a truncated backup).
Oversized (> 500 MB single file)	DEFER	Often video, VM images, database exports. Sample metadata; decide based on custodian role. Do not push to review as-is.
Embedded objects (OLE, images-in-office)	REMEDIATE	Should extract as family members. If the vendor's default is "no", ask why — it's usually a settings choice.
Bad OCR text	DEFER → REMEDIATE for known-relevant	Do not push bad-OCR docs into TAR/GenAI (see DLC-M04-002). If the doc is known relevant, re-OCR with a better engine or manual transcription.
Foreign-language content	REMEDIATE	Language detection + routing to bilingual reviewers or MT. Do not silently exclude.
Duplicate hash — cross-custodian	DEFER (dedup treats it)	Global de-dup is standard. Confirm the vendor is preserving custodian-attribution metadata.
Timestamp anomaly	DEFER	Epoch-zero dates, future dates. Log and note in report; often noise from filesystem quirks.

Cost-of-Remediation Rules of Thumb

These are directional numbers based on 2026-Q1 vendor invoices we've seen. Use them for gut-check, not for SOW negotiations.

Remediation Type	Typical Cost	Turnaround	Notes
Password crack — commodity Office files	$5–15 / file	Same day	Batch discounts available.
Password crack — modern encrypted archives	$40–200 / file	1–5 days	Depends on password complexity.
PST repair (partial recovery)	$500–2,000 / PST	1–3 days	Ask for item-level recovery inventory.
Container triage (mixed corrupt/OK)	$150–400 / hr	Variable	Set a cap in advance.
Re-OCR pass	$0.02–0.10 / page	1–2 days / 100k pages	Choose engine based on language; ask about accuracy benchmarks.
Custodian re-collection (single source)	$1,500–5,000	1–2 weeks	Plus custodian time and access negotiation.
Media transcription (audio → text)	$0.50–1.50 / minute	3–5 days	Human review recommended for legally material segments.

Break-even heuristic Remediation is worth pursuing when: (estimated recovered docs) × (probability responsive) × (avg review cost per doc) exceeds the remediation quote. If in doubt, sample 100 items from the exception class and estimate responsiveness before committing.

Escalation Thresholds

Escalate to Client + Delphoria advisor within 4 hours if any of the following are true:

Total exceptions exceed 10% of processed doc count.
Any single exception class exceeds 5% of processed doc count.
A custodian's data appears materially smaller than declared usage (interviewed 5 GB/mo, delivered 0.5 GB total).
Container failures affect > 3 custodians — suggests systemic collection issue, not custodian-level noise.
Any indication of intentional deletion, backdating, or metadata alteration.

Client-Facing Summary Template

Use this three-paragraph structure when explaining a processing exceptions report to a non-technical client.

Paragraph 1 — What was processed "The vendor processed [X] GB of collected data across [Y] custodians and produced [Z] documents in the review environment. After de-duplication, the corpus is [%] smaller than what was collected. The processing report identified [N] items that did not process cleanly on the first pass."

Paragraph 2 — What we're recovering, at what cost "Of those exceptions, we're asking the vendor to remediate [count] items — primarily [class 1] and [class 2] — at a projected cost of $[amount]. We estimate this will surface [range] additional responsive documents, which is proportionate to the matter. [count] additional items are being deferred, and [count] are being documented and abandoned because recovery is not defensibly cost-justified."

Paragraph 3 — What we recommend next "Two custodians (X, Y) produced materially less data than expected — we recommend a targeted follow-up on those specifically. The full triage worksheet is attached; happy to walk through any of the calls above."

Handing Back to the Vendor

When issuing remediation asks, include:

The exception class (from the standard list above).
The item count and, where possible, item-level IDs from the exceptions worksheet.
The remediation type requested (crack, repair, re-OCR, re-collect).
The expected turnaround in business days.
The cost cap — above which the vendor pauses and re-quotes.
The delivery format — usually a supplemental load file with an overlay to the existing dataset, preserving DLPUniqueID.

One thing you never approve without discussion "We can just apply a filter to suppress those exceptions." No. Suppression is not remediation. The exceptions belong on the record even if the underlying items are ultimately excluded — that's what makes the exclusion defensible.