Digital evidence wins or loses on detail: what was collected, from where, and how. These are the points we see make the biggest difference when lawyers are framing preservation letters, subpoenas or discovery requests.
1. Preserve first, argue later
Cloud activity logs and device data can expire or be overwritten in weeks. A prompt preservation request, to your own client and, where appropriate, the other side, often matters more than anything that follows.
2. Name the sources precisely
- Custodians: whose accounts and devices are relevant.
- Date range: including a margin before and after key events, such as a resignation date.
- Systems: email mailboxes (including deleted and recoverable items), OneDrive and SharePoint or Google Drive, Microsoft 365 or Google Workspace audit logs, sign-in logs, laptops, phones, USB device records and backups.
- Messaging: Teams, Slack, SMS and messaging apps, where relevant.
3. Ask for native files, not printouts
Screenshots and printouts strip out the metadata (authors, creation and modification dates, device details) that often answers the key question. Ask for files in their original format, with metadata intact.
4. Ask how it was collected
- Hash values (such as SHA-256) recorded at collection, so integrity can be checked later.
- A chain-of-custody record showing who handled the evidence and when.
- A description of the tools and methods used.
5. Think about the other side’s devices early
Personal phones, home computers and personal cloud accounts are often where taken data ends up. Consider early whether orders for preservation or independent examination are appropriate.
6. Get technical input on the wording
A request that names the wrong log or system can be answered truthfully with nothing useful. A short conversation with a forensic examiner before you issue a request can save weeks.
We’re happy to review the technical side of a preservation letter or request before it goes out.
This checklist is general technical guidance for legal practitioners. It is not legal advice; requirements depend on the jurisdiction, court and rules that apply to your matter.