Litigation Hold and Legal Hold Notice: A Practical Preservation Guide

Quick Answer. A litigation hold, also called a legal hold, is a written notice instructing people and systems to stop deleting information that may be relevant to a reasonably anticipated or pending dispute. The duty to preserve arises when litigation is reasonably foreseeable, not when a complaint is filed. A defensible hold identifies custodians and data sources, suspends automatic deletion, gives clear and specific instructions, is acknowledged in writing, is reissued and updated, and is followed by timely forensic preservation of the highest risk sources such as departing employee devices and mobile phones.

Legal hold questions answered

Key terms defined

Litigation hold

A written directive suspending routine destruction of potentially relevant information, issued when litigation is reasonably anticipated.

Custodian

A person who holds or controls potentially relevant information, including on personal devices and accounts used for work.

Electronically stored information

Any information created or stored electronically, including email, files, chat, text messages, database records, logs, and cloud content.

Spoliation

The loss, alteration, or destruction of evidence that a party had a duty to preserve.

Defensible collection

Preservation performed and documented so that the process, dates, scope, and integrity of the copy can be proven later.

Forensic image

A complete, hash verified copy of a device or account that captures more than a user visible file copy, including deleted and system level data.

When the duty to preserve begins

The obligation attaches when a party reasonably anticipates litigation. A demand letter, an internal complaint, a serious injury, a regulator inquiry, a resignation followed by suspicious data activity, or a threat to sue can all trigger it. Waiting for service of a complaint is a common and expensive mistake, because the most volatile evidence, such as a departing employee's laptop and phone, is usually gone within weeks.

Under Federal Rule of Civil Procedure 37(e), a court may order measures to cure prejudice when electronically stored information that should have been preserved is lost because reasonable steps were not taken. If the court finds a party acted with the intent to deprive another of the information, it may presume the information was unfavorable, instruct the jury it may do so, or dismiss the action or enter default judgment. State rules vary but trend the same direction.

What a litigation hold notice should contain

• A plain statement that the matter is anticipated or pending and that preservation is now required.
• A description of the subject matter in terms the recipient recognizes, not legal shorthand.
• A relevant date range, with a clear instruction that it may expand.
• A specific list of data sources: email, files and shares, laptops and desktops, mobile phones, chat and collaboration tools, voicemail, calendars, cloud storage, databases, ticketing systems, physical notebooks, and personal accounts used for work.
• An express instruction to disable automatic deletion and message expiration features.
• An instruction not to delete, edit, reinstall, reset, trade in, or reformat devices, and not to run cleaning utilities.
• A contact for questions and a written acknowledgment the recipient must return.
• A note that the hold remains in effect until counsel lifts it in writing.

Keep it readable. A notice written for litigators, sent to warehouse supervisors, produces confident noncompliance.

The technical steps that make a hold real

Notices change behavior. Systems change outcomes. The operational half of a defensible hold usually includes the following work with IT.

• Suspend mailbox retention policies and apply platform holds in Microsoft 365 or Google Workspace, and document when they were applied.
• Disable message expiration and automatic deletion in chat platforms and on mobile devices.
• Pull affected laptops and phones out of the refresh, reimage, and trade in pipeline.
• Preserve departing employee devices before reassignment, and image rather than simply archive.
• Extend or export log retention for systems where logs roll in days, including endpoint, VPN, and cloud audit logs.
• Capture cloud audit logs that have short default retention windows.
• Track backup rotation so a needed restore point is not overwritten.
• Record dates, scope, and hash values for everything preserved.

See ESI preservation and litigation hold support and forensic data collection for how we carry out this work.

High risk sources that get overlooked

• Mobile phones. Text messages and app chats are relevant in most employment, trade secret, and business disputes, and phones are replaced constantly.
• Departing employee devices. The single most litigated data loss. Image before reassignment, always.
• Personal accounts and devices used for work. Relevance follows the data, not the ownership of the hardware.
• Ephemeral messaging. Disappearing message features must be switched off, and the switch off date documented.
• Cloud audit logs. Many default to a short window, and are irreplaceable in data theft and unauthorized access cases.
• Shared drives and orphaned accounts. Deprovisioning often deletes content on a schedule.

For departing employee matters, our page on employee theft and trade secret cases explains what the device usually shows.

Sending and responding to a preservation letter

The hold notice goes to your own people. A preservation letter goes to the other side. It should identify the dispute, describe the categories of information to be preserved in operational language, name the devices and accounts you expect to be preserved, and ask for written confirmation. If you receive one, do not argue about scope before you preserve. Preserve broadly, then negotiate the scope of collection and review.

Hold notice compared with forensic preservation

What matters most

• Preserve early and broadly, then narrow. Over preservation is a budget problem, under preservation is a sanctions problem.
• Document dates, scope, and instructions. The record of your process is what a court evaluates.
• Reissue the hold periodically and when custodians or claims change.
• Treat mobile devices as first class evidence, not an afterthought.
• Image departing employee devices before they are reassigned or wiped.
• Lift the hold in writing, not by silence.

Common misconceptions

• The duty starts when we are served. It starts when litigation is reasonably anticipated.
• Sending the notice is enough. Courts look at whether reasonable steps were actually taken, including suspending automatic deletion.
• IT backups cover us. Backups rotate, exclude mobile data, and rarely capture deleted user activity or logs.
• Personal phones are out of scope. If work communications live there and they are relevant, they are in scope.
• Forensic imaging everything is required. No. Preservation should be proportional and targeted at risk.

When this applies, and when it does not

This applies when

• A demand letter, charge, claim, or regulatory inquiry has arrived or is expected.
• An employee with access to sensitive data has resigned or been terminated.
• A device or account central to a dispute is scheduled for reset, return, or deprovisioning.
• Automatic deletion or ephemeral messaging is running on relevant systems.

This does not apply when

• No dispute is reasonably anticipated and routine retention governs.
• The information at issue is outside your possession, custody, or control, where a preservation letter to the holder is the right tool.
• The matter is fully resolved and counsel has lifted the hold in writing.

How Elite Digital Forensics helps

We support counsel with preservation scoping, hold notice review from a technical standpoint, platform hold verification, and forensic preservation of laptops, desktops, servers, mobile devices, and cloud accounts. Every preservation is hash verified and documented with chain of custody so the process can be proven years later. Where a preservation failure has already happened, we analyze what was lost, when, and by what mechanism, and we provide testimony on those findings. See our e-discovery expert witness page for the testimony side.

About Elite Digital Forensics

Elite Digital Forensics is an independent digital forensics practice that works with attorneys, paralegals, legal assistants, in house counsel, businesses, and individuals nationwide. Our examiners include former law enforcement forensic examiners and court qualified expert witnesses. Every engagement starts with a scoped plan, hash verified evidence, and documented chain of custody, and ends with a written forensic report suitable for attorney review, negotiation, mediation, or court. When we are retained through counsel, our work is performed under the direction of the attorney and treated as protected work product.

Related Digital Forensics Resources