A client sends over a .pst, or an ex-employee's Gmail Takeout, and asks the question every matter starts with: which of these thousands of emails actually matter? You need an honest picture of what is in the archive before you can advise on strategy, budget or exposure. This post walks a first pass through an archive in mailin, from preserving it untouched, through Early Case Assessment and First-Pass Review, to Privilege QC & Redaction.
Get the archive in without changing it
mailin opens .pst and .ost files up to 50 GB, .mbox from Gmail Takeout, .nsf from Lotus Notes up to 64 GB, and single .eml, .emlx and .msg messages, all with native parsers and nothing uploaded anywhere. Every email is hashed with SHA-256 at import, so you have a fingerprint of what you received before anyone has touched it. If the Takeout came as a .zip, unzip it first; mailin 2.0 does not extract archives itself.
Before review starts, the Legal Hold & Preservation workflow is the place to record custodians and place holds. mailin tracks custodians, assigns their mail to them, and lets you issue, acknowledge, preserve and release holds. Held messages are protected from deletion, which means a later cleanup pass cannot quietly remove something you were obliged to keep.
Early Case Assessment: getting oriented
The Early Case Assessment workflow is about shape, not detail. The analytics view answers the first questions quickly: the volume timeline shows when the activity happened and whether sent or received dominated, top contacts and communication pairs show who was talking to whom, and the activity heatmap by day and hour shows whether anything was happening at odd times. The contact network and entity graph turn those pairs into a picture.
Then you search. mailin's full-text index is built on-device and ranks results by BM25 relevance, with boolean AND, OR and NOT, wildcards, regex, and proximity such as "budget" NEAR/5 "deadline". Smart filters narrow by sender, domain, date range, folder, label or attachment, and AI Smart Filters accept a plain-English description of what you want. The search post goes through each operator with examples.
When a search lands you in the middle of an argument, Thread Story reconstructs the whole conversation as a cited, chronological timeline with one click. The optional on-device AI narrative is grounded only to that thread's emails, and every claim in it points back to a message. Like all AI output, the narrative can be inaccurate or incomplete, so read the cited emails before relying on it.
First-Pass Review: coding at scale
The First-Pass Review workflow is where you commit to decisions. Split the set into review batches, then code each message as responsive, non-responsive or privileged, adding evidence tags and annotations where a bare code is not enough. Every step of the workflow auto-saves into a numbered document, and the optional one-tap sign-off records who coded what and when.
Two engineering details matter more than they sound at this stage. mailin's keyset pagination means jumping to the millionth message responds immediately rather than freezing while the app scans everything before it, and the year-sharded search index means a query bounded to a date range only touches that year's shard. Reviewing a large archive should feel the same on page 4,000 as on page 1.
Predictive coding: letting the review teach the tool
On the Professional tier, predictive coding, also called technology-assisted review or TAR, learns relevance from the decisions you make. As you code messages, mailin's on-device AI learns what relevance looks like in this matter, so reviewer time can go where it is most needed rather than being spread evenly across the set.
The limits deserve stating plainly. Predictive coding, like every AI feature in mailin, can produce inaccurate or incomplete results. It is a prioritization aid, not a decision-maker, and a human still codes each message. Every AI output carries an AIProvenance tag naming the engine that produced it, so you can always tell what was suggested by a model and what was decided by a person. The on-device AI post explains which engine runs where and why nothing is sent off the device by default.
Privilege QC & Redaction
The Privilege QC & Redaction workflow is the second look at everything coded privileged, plus redaction of what is going out. The privilege log is built from codes already recorded against specific messages. Redaction can remove personal data or mark redactions on the page, and mailin's PII detection gives the reviewer a list of emails, phone numbers, SSNs, card numbers and IPs to check rather than relying on catching every one by eye.
From here the natural next step is Production Run, which applies Bates numbers and writes Concordance or Relativity load files. That is covered in the production post.
What the first pass does and does not establish
A first pass tells you what the archive contains and lets you document how you looked. It does not by itself establish that any message is what it appears to be; that is a question for header and authentication analysis and, ultimately, for counsel.
These features are designed to support common records-integrity and eDiscovery workflows. Admissibility of digital evidence is jurisdiction-specific and depends on factors beyond any single software tool — consult qualified legal counsel for evidentiary use. mailin makes no warranty of fitness for any specific legal or regulatory purpose.
FAQ
Do I need the Professional tier for a first pass?
Search, filters and analytics do not require Professional. Predictive coding, custodians and legal holds, redaction, Bates numbering and Offline Mode with the audit log are Professional features. The Free tier handles up to 500 emails if you want to try the flow on a sample first.
Does anything leave my Mac during review?
No. Import, indexing, search and on-device AI all run locally, mailin has no account, and it never contacts an email server. The optional Cloud AI mode is off by default and uses your own API key only for excerpts you choose.
What if the client's archive is very large?
mailin streams imports in batches of 200 messages, so peak memory stays flat regardless of file size, and imports resume from the last checkpoint after a crash. PST and OST files are supported up to 50 GB each.