- Nationwide Digital Forensic & Cyber Investigation Services
Quick answer. ESI preservation means taking affirmative steps to stop relevant electronically stored information from being lost once litigation is reasonably anticipated. It usually requires more than a hold notice: automatic deletion and retention settings must be suspended for relevant data, cloud accounts must be placed on hold, departing employee devices must be imaged before reissue or wipe, and mobile devices must be preserved before trade in or reset. Federal Rule of Civil Procedure 37(e) allows sanctions where information that should have been preserved is lost because reasonable steps were not taken, and severe measures where there was intent to deprive. Documentation of what was preserved, when and how is what makes a reasonable steps argument possible.
| Question | Short answer |
|---|---|
| When does the duty attach? | When litigation is reasonably anticipated, which is often before a complaint is filed. |
| Is a hold notice enough? | Rarely. Automatic deletion, reimaging and device reissue continue unless affirmatively stopped. |
| What about a departing employee? | Image the laptop and phone before reissue or wipe, and hold the cloud accounts. |
| Can we preserve without alerting staff? | Cloud holds and server side preservation are invisible to users. |
| Do we need to image every device? | No. Preservation is scoped by relevance and proportionality, and documented. |
| What about personal devices? | Preserve where business data resides on them, with a documented and privacy limited scope. |
| Does preservation stop business? | No. Imaging is scheduled around use and cloud holds have no user impact. |
| What proves we preserved? | Hash verified images, hold configuration evidence and a written preservation record. |
Preservation begins with mapping, because you cannot preserve a source nobody has listed. Custodian interviews and information technology interviews identify systems that never appear on an organization chart.
| Source | Preservation risk if not addressed |
|---|---|
| Employee laptops and desktops | Reimaged and reissued as routine information technology practice, destroying local artifacts |
| Mobile phones | Traded in, factory reset or replaced, eliminating messages and location artifacts |
| Email and cloud accounts | Retention policies purge on schedule, and license reclamation can delete a mailbox |
| Cloud storage | Version history expires and deleted file recovery windows close quickly |
| Chat platforms | Short default retention and history off settings remove content within days or weeks |
| File servers and network shares | Backup rotation overwrites, and shares are consolidated or migrated |
| Backups and snapshots | Rotation schedules overwrite the only copy of deleted material |
| Line of business systems | Records are updated in place with no historical version retained |
| Removable media | Drives are reused, lost or wiped between the events and the collection |
| Physical and video systems | Access control and camera systems overwrite on very short cycles |
| Personal accounts and devices | Business communications on personal email or messaging apps are outside the organization's control |
| Third party and vendor systems | Data held by a service provider requires a preservation request to the provider |
Video surveillance and access control logs deserve urgency out of proportion to their size. Retention is frequently measured in days, and by the time a matter is staffed the footage is gone.
A write blocked, hash verified image of a full drive, taken before a device is reissued or wiped, preserving deleted and unallocated content.
Where full imaging is disproportionate, defined folders, mailboxes and accounts are collected forensically with hash verification and documented scope.
Full file system or logical extraction of iPhone and Android devices, preserving messages, media, app data and location artifacts.
Purview eDiscovery holds and Google Vault holds preserve mail, files and chat server side, invisible to the user and immune to their deletion.
Audit, sign in and activity logs are exported and hashed immediately, because their retention is short and license dependent.
Every preserved item is recorded with source, method, examiner, timestamp and hash value in a chain of custody log.
Preservation and collection are not the same decision. Preserving broadly and collecting narrowly is usually both cheaper and safer than the reverse: a preserved image can be examined later, while a lost device cannot be recreated at any price.
The departing employee scenario produces more spoliation motions than any other, because the destructive act is ordinary administration. A laptop is reimaged for the next hire, an account is deleted to free a license, and the evidence goes with them.
Where data theft is suspected, preserve before confronting the employee. A confrontation frequently triggers remote wipes, account deletions and factory resets within hours.
Rule 37(e) applies where electronically stored information that should have been preserved is lost because reasonable steps were not taken and it cannot be restored or replaced. Curative measures require prejudice; the severest measures, including adverse inference instructions and dismissal, require a finding that a party acted with intent to deprive another of the information.
| What the court asks | What the record should show |
|---|---|
| When did the duty attach? | The trigger event and the date, with the corresponding preservation actions |
| What steps were taken? | Hold notices, retention suspensions, holds applied, devices imaged, with dates and evidence |
| Were the steps reasonable? | Scope and proportionality reasoning, and the sources considered and excluded with reasons |
| Was anything lost? | An honest accounting of loss, cause and whether the information is restorable or replaceable |
| Was there prejudice? | Analysis of whether the lost material is available from an alternative source |
| Was there intent? | Evidence about the cause, whether routine operation, oversight or deliberate act |
We supply the technical half of that record: hash verified preservation, hold verification evidence, log exports, chain of custody documentation and, where loss has already occurred, an objective analysis of what was lost, when, by what mechanism and whether it can be recovered or reconstructed from another source.
This page is part of the Elite Digital Forensics E-Discovery services hub. Related coverage:
We work with counsel to map custodians and data sources, scope preservation proportionately and document the reasoning. We then preserve: forensic images of computers and mobile devices before they are reissued or reset, cloud holds across mail, files and chat, immediate export of short retention audit logs, and hash verified chain of custody records for everything preserved. Where loss has already occurred, we investigate what was lost, how and whether it can be recovered, and provide written findings and testimony.
Elite Digital Forensics is an independent digital forensics firm providing nationwide E-Discovery services, computer and mobile device forensics, cloud and email investigations and expert witness testimony. Our examiners include former law enforcement forensic examiners and court qualified expert witnesses. We work for law firms on both sides of the docket, for corporations and in house legal departments, and for insurers. When retained through counsel, our work is generally treated as attorney work product prepared in anticipation of litigation.
When litigation is reasonably anticipated, which routinely precedes a filed complaint. A demand letter, a regulatory inquiry, an internal complaint or a credible threat can all trigger it. Because the trigger date is later contested, we recommend recording the date, the reason and the preservation actions taken in response at the time rather than reconstructing it afterwards.
Usually not. A notice tells people not to delete, but it does not stop the systems that delete automatically: retention policies, backup rotation, chat retention, log expiry, device reimaging and license reclamation. Preservation requires affirmatively suspending those processes for relevant data and preserving devices and accounts, then verifying that the suspension actually took effect.
Yes. Microsoft 365 eDiscovery holds and Google Vault holds operate server side with no change to the user experience and no notification from the platform. Whether to notify a custodian is a legal decision for counsel, but the technology does not force disclosure.
No, and proportionality does not require it. Preservation scope is a judgment made with counsel: key custodians may warrant full forensic images, while others may be adequately preserved with targeted collection of defined accounts and folders. What matters is that the scoping reasoning is documented so it can be defended, and that the decision is made before devices are reissued rather than after.
Remove them from the reissue and trade in pool immediately and preserve them before any reimage, reset or wipe. Suspend rather than delete the cloud accounts and place holds across mail, files and chat, and export audit logs for the preceding months. If data theft is suspected, complete preservation before confronting the employee, because confrontation frequently prompts remote wipes and account deletions.
They are potentially discoverable where the organization has a legal right to them or where they contain relevant business records. Preservation there is scoped narrowly and with privacy protections, commonly by preserving a defined date range and relevant applications rather than the entire device, and by using a protocol that keeps unrelated personal content out of the review population. Counsel should drive that scope; we implement and document it.
Yes, for two reasons. First, apparent loss is often partial: deleted material can persist in unallocated space, backups, snapshots, cloud recycle bins, sync clients and other devices. Second, even where data is genuinely unrecoverable, the forensic record of when and how it was deleted is itself evidence, and it is central to the intent question under Rule 37(e).
Preservation is treated as time critical. Remote preservation sessions can frequently begin the same day, and on site imaging is scheduled nationwide, usually within days. If a device is scheduled for reimage or a license for reclamation, the first step is a phone call to stop that process, and the second is scheduling preservation.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic and E-Discovery services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder