Practitioner resource

The Litigation Counsel ESI Preservation and Spoliation Defense Protocol

November 1, 2026

Before you read

Would you share your contact details with GDF? It helps us understand who finds these resources useful. It is optional, and every guide is yours to read either way.

Skip and read

We will remember your choice on this browser so you can browse the whole library without another request. You can read without sharing information.

Discuss Engaging an Expert All guides

(212) 561-5860 24/7: (800) 868-8189

A preservation notice is the start of the record. It does not establish that the right systems were covered, that deletion stopped or that a collection can be explained later. This protocol connects counsel's instructions to named technical owners, identifiable sources and documented verification. GDF practitioners work alongside legal counsel, internal auditors and corporate IT security teams to preserve available evidence and explain the limits of the record.

The time bands below organize urgent work. They are not a universal legal deadline or permission to wait. Counsel determines the preservation duty, applicable forum, authorized scope and any need for immediate court relief. Technical preservation supports that work; it does not guarantee admissibility, defeat a spoliation motion or establish privilege.

1. First Two Hours: Establish Authority and Stop Unrecorded Changes

Name the lawyer directing preservation, the business owner responsible for execution and the technical lead who can reach the relevant systems. Record the known dispute, the events that prompted action, the sources at immediate risk and the time each instruction was received. Give IT a specific instruction to pause relevant device reuse, account deletion, mailbox conversion and scheduled disposal while scope is settled. Avoid a blanket freeze that creates unnecessary operational risk. The useful record identifies what was stopped, who stopped it, when the change became effective and what could not be stopped.

Require each owner to acknowledge the instruction and identify exceptions. A response that a mailbox is retained is incomplete without the account identity, covered locations, applicable configuration and evidence that the control is active. If an administrator cannot confirm a source, mark it unresolved and assign an escalation time. Do not turn an unanswered request into an assumption that preservation is complete.

2. Define the Disputed Facts Before Narrowing the Sources

Translate the matter into the questions the evidence must answer. Identify the people, relevant period, business systems, transactions and communications involved. Include shared mailboxes, delegated accounts, collaboration spaces, mobile applications, shared drives and systems operated by outside providers when they may hold relevant records. Distinguish data the organization controls from material it can only request. Counsel should decide the legal boundaries; the technical team should explain how those boundaries map to actual account identifiers and storage locations.

Write down the initial assumptions behind any date or keyword restriction. A narrow search that misses aliases, attachments, linked documents or a shared workspace can leave a misleading impression of completeness. Broader preservation and narrower review may be appropriate where authorized and proportionate. Record why a source was included or excluded and set a time to revisit the decision as facts develop.

3. Separate Federal and New York Preservation Analysis

For federal civil matters, Rule 37(e) addresses ESI that should have been preserved, was lost because reasonable steps were not taken and cannot be restored or replaced through additional discovery. Curative measures based on prejudice and the specified measures requiring intent to deprive have different requirements. In New York state practice, Pegasus Aviation addresses preservation obligations, culpability and relevance within the state's spoliation framework. Do not assume the federal intent requirement controls every New York request for relief. Counsel must apply the governing authorities and current orders to the particular matter. [S1] [S2]

4. Hours Two Through Six: Convert the Hold Into Executable Instructions

Send each system owner a source specific instruction identifying the custodian, account or workspace, the relevant period and the action required. Address retention settings, device refresh schedules, backup expiration, collaboration history, mailbox rules and any pending employee departure. Require the owner to retain the original configuration record before making a necessary change, document the replacement configuration and explain the expected effect. Preserve the instructions and responses alongside the technical evidence rather than relying on recollection.

The execution record should distinguish notice sent, acknowledgment received, control configured and control verified. Those are different events. If a scheduled purge may occur before a hold is effective, escalate the timing immediately and agree on a lawful interim preservation method. Do not rely on a calendar entry or a screenshot of an unfinished configuration to establish that deletion was prevented.

5. Preserve Microsoft 365 Content and Activity Separately

Have an authorized administrator identify the relevant Exchange mailboxes, OneDrive accounts, SharePoint sites and Teams associated locations. Use the appropriate preservation controls for those locations and verify licensing, scope, deployment status and errors. Microsoft states that a new eDiscovery hold can take up to 24 hours to take effect. Treat that interval as an operational issue requiring an explicit plan for expiring material. Preserve the hold definition, location identifiers, status records and later changes. A hold on content is not a complete capture of tenant activity logs. [S3]

Assign a separate owner to preserve available audit, identity and security records. Record the actual coverage, earliest available time, export method and any failures. Microsoft audit retention depends on licensing, workload and policy, so a mailbox preservation decision should not be used as evidence that all relevant activity history is retained. Keep the query, returned files and export record together. Where a gap exists, identify other lawful sources that might corroborate the event. [S4]

6. Preserve Google Workspace Without Losing Account Context

For an authorized Google Workspace matter, identify the accounts, shared drives and supported services that require preservation. Confirm Vault entitlement, administrative scope and the actual hold configuration rather than treating an active Workspace account as a preservation control. Google describes holds as service specific and distinguishes their operation from retention rules. Protect relevant licensing and account state during offboarding, and verify the current administrative workflow before any deletion or downgrade. A hold cannot restore information that was already permanently removed. [S5]

Map Gmail, Drive, Chat and other relevant records separately. Google documents limits on which service data Vault supports; for example, Chat coverage depends on supported message conditions. Linked content and files owned outside the organization require separate attention. Preserve available activity exports and ownership information, and record any inaccessible source. Do not assume that a custodian's mailbox export contains every linked file, shared conversation or external record. [S6]

7. Make Mobile and Volatile Evidence Decisions Before Routine Handling

Identify phones and computers that may hold unique messages, application data or active session information. Record who has possession and the observable power, lock and connection state without casually exploring the device. Escalate decisions about network isolation, power changes and acquisition to a qualified examiner who understands the device and the operational risk. Turning a device off, interacting with it or allowing it to remain connected can each affect preservation. The decision must fit the actual device and circumstances. NIST's mobile guidance is a foundational reference, not a current capability guarantee for a particular handset. [S7]

For a running computer, volatile evidence collection can itself alter the system, while shutdown can remove information that exists only in memory. A technical lead should weigh those consequences against active harm and record the decision. Containment needed to protect people, essential operations or continuing exposure must not be delayed merely to pursue a more complete collection. Keep the reason, authorization and precise actions in the event record. [S8]

8. Hours Six Through Twenty Four: Collect Under a Reproducible Protocol

Before collection, identify the account or device, the lawful authority, the requested scope, the acquisition method and the person responsible. Preserve native records and associated metadata where available, together with export reports, errors and source identifiers. Record software versions, relevant settings and the distinction between a full acquisition and a selective export. A collection limited to visible documents should not later be described as a complete forensic image or a complete account history.

For cloud collections, retain the request parameters, job identifiers, location list, status reports, returned packages and exception records. Reconcile what the provider reports with what was actually received. If items were skipped, unavailable or encrypted, preserve that information and agree on the next step. A successful job status alone does not establish that every relevant source or item was collected.

9. Build Chain of Custody Around Every Meaningful Transfer

Assign a stable evidence identifier at receipt. Record the source, custodian, collector, acquisition time and time zone, method, storage location, access restrictions and every transfer of possession or control. For each exported package or acquisition file, record an appropriate cryptographic hash and verify it at relevant transfers. Retain the original acquisition and conduct examination on controlled copies where practicable. A hash can help identify a particular set of bytes; it does not establish who created the content, whether a collection was complete or whether a statement is true.

Federal Evidence Rules 901 and 902 provide different routes for authentication. Rule 902(14) addresses qualifying certified copied data and includes procedural requirements. Authentication does not by itself resolve relevance, hearsay or every other admissibility question. Counsel and the examiner should agree early on the foundation and records needed for the intended use. [S9]

10. Hours Twenty Four Through Forty Eight: Reconcile the Preservation Record

Bring the hold instructions, acknowledgments, configured controls and received collections into one source register. Give each source an explicit status such as verified preserved, collection pending, inaccessible, already expired or further scope decision required. Attach the supporting receipt and identify who will close each open issue. Revisit scheduled deletion, account changes and device reuse before ordinary operations resume. The purpose is a record another professional can follow without depending on the memory of the person who performed the work.

If information appears lost, preserve the facts of the loss and identify possible alternative sources such as another participant's account, a retained export, an authorized backup or a business system that recorded the same event. Document what was attempted, what was recovered and what remains unknown. Do not conceal an exception by quietly substituting a later export or a reconstructed document for the original record.

11. Prepare the Handoff Counsel Can Actually Use

The handoff should identify the matter reference, directing counsel, named technical owners, preservation start time and the next court or business deadline. For each source, describe its relevance, owner, control applied, verification evidence, collection method, custody identifier and known limits. Include a chronology of consequential changes and a short list of decisions still needed. Keep confidential legal advice in the channel counsel directs. Engaging a specialist through counsel does not automatically make underlying facts or every resulting document privileged.

The strongest technical explanation distinguishes what was requested, what was performed, what the records show and what they cannot resolve. That distinction gives counsel a basis to evaluate proportionality, explain exceptions and plan the next evidentiary step. A polished chronology without the source record behind it cannot do that work.

When to Escalate to a Specialist

Escalate when deletion may occur before controls are effective, a device may be wiped or reused, a mobile source contains unique evidence, a collection cannot be reconciled or an expert deadline is approaching. Ask for a practitioner whose experience fits the technology and the proposed testimony. Qualification is assessed in the context of the particular assignment and proceeding, and the court controls any decision to admit expert testimony.

Call the New York desk at (212) 561-5860 or the 24/7 emergency hotline at (800) 868-8189 for a Rapid Case and Scope Assessment. GDF practitioners work alongside legal counsel, internal auditors and corporate IT security teams to define the preservation question, identify urgent source risks and scope the engagement. Have the systems involved, device locations and deadline ready. Arrange secure transfer before sending evidence, credentials or sensitive personal records.

Preservation workflow from sources and authority through collection and documented handling — Planning illustration. Apply it to the authorized scope and actual systems described in this guide.

Information Gathering Q&A Checklist

Complete this record with counsel and the people who administer the systems. Identify what is known, what remains unknown and who can confirm each answer. Ownership, account registration, management enrollment and authority to collect are separate questions. Record the source of an answer and the date it was confirmed. Do not change a setting, sign out an account or test a recovery process merely to complete the checklist.

Do not write passwords, recovery keys, unlock codes or authentication secrets here. Record whether authorized access is available, who controls it and how a secure handoff can be arranged. Keep completed copies in the location counsel or the company approves. Do not send a completed record containing sensitive account or employee details through a public contact form.

Who is directing the matter and who can authorize technical access?

Identify directing counsel, the business decision maker, the IT security owner and any outside administrator. Record the immediate deadline, relevant period and known preservation risk. An employee's possession of a device or an administrator's ability to access an account does not by itself settle the authorized examination scope.

Answer: