RESOURCE 01 / PRESERVATION

Annotated Model Evidence Preservation Letter

Nine clauses of generic preservation drafting, each one printed beside what it actually preserves and what it leaves exposed. The letter is the easy half. The annotation is why this page exists.

CLAUSES: 9, annotated in pairs
SCOPE: Digital evidence and ESI
STATUS: Generic · not court-approved
FORMAT: HTML · print · Save as PDF
GATING: None · no email required
ADVICE: Not legal advice

IN SHORT

An evidence preservation letter puts the other side on notice of a duty to preserve and records the date they received it. It does not touch any system. Cloud logs, endpoint telemetry and volatile Windows artifacts keep expiring on their own schedules until a retention setting changes or an image is taken, so the letter is the first step in preservation and never the whole of it.

This is an educational template, not legal advice

The language on this page is generic drafting, published to be read and understood. No court has approved it, it is not this firm’s filed language in any matter, and it has not been accepted or rejected in any specific proceeding. Nothing here is tailored to your case, your forum, or the order that governs your matter, and using it unadapted is the error the page exists to help you avoid.

A preservation letter is drafted against a real dispute: a real trigger date, real custodians, real systems, and a real assessment of what is proportionate. Sending generic clauses unmodified is how a letter becomes either unenforceably vague or so broad that the recipient’s first response is a motion rather than a hold.

Reading it creates no attorney–client relationship and no expert-engagement relationship. Check the rules, standing orders, local practice and case law of your own forum before relying on any of it.

How to read this page

Each clause is printed with two annotations: what it actually accomplishes, and what it does not reach. The second one is the half that is normally missing.

Preservation letters circulate freely and most of them are serviceable as drafting. What is genuinely hard to find is a straight account of the gap between what a clause demands and what survives: the difference between putting a custodian on notice and stopping a retention timer, between setting a laptop aside and capturing its state, between naming a cloud platform and suspending the policy that is deleting from it.

That gap is where preservation disputes actually happen. Under Fed. R. Civ. P. 37(e) the question a court is asked is whether electronically stored information that should have been preserved was lost because reasonable steps were not taken, and whether it can be restored or replaced. “Reasonable steps” is about conduct, not correspondence, and a letter is evidence of notice rather than evidence of steps. What follows is written to make that distinction visible clause by clause.

The letter, clause by clause

The matter, the trigger, and the date range

MODEL LANGUAGE — GENERIC

This firm represents [PARTY] in connection with [DESCRIBE THE DISPUTE]. Based on [THE EVENT, DEMAND, OR CLAIM AND ITS DATE], litigation is reasonably anticipated. The subject matter of the dispute concerns [SUBJECT], and the period presently relevant runs from [START DATE] through the date of this letter and continues.

WHAT IT PRESERVES

Fixes the three facts every later clause is scoped by, and records a date on which the recipient was on notice. That date is what a later preservation argument is measured from, so it is worth stating the triggering event rather than only the claim.

WHAT IT DOES NOT

Does not settle when the duty arose. A recipient may have been on notice earlier — from an internal complaint, a demand, or its own investigation — and nothing in a letter can narrow that. It also does not make a date range binding; an open-ended “and continues” is a request, not an order.

The duty, and what counts as a document

MODEL LANGUAGE — GENERIC

You are requested to preserve all documents and electronically stored information relating to the subject matter, in whatever form and wherever located, including material held by agents, contractors, and personnel on personal accounts or devices used for business purposes. “Electronically stored information” includes metadata, system and application logs, and deleted material recoverable from the media on which it resided.

WHAT IT PRESERVES

Puts metadata, logs and recoverable deleted content expressly inside the scope, which forecloses the narrow reading that a hold covers documents a user would recognise as documents. It also names personal accounts and devices used for work, which is where a departing-employee matter usually lives.

WHAT IT DOES NOT

Does not make the recipient able to comply. Recoverable deleted content exists only until the space it occupies is reused, and it is consumed by ordinary use of the machine. A duty to preserve what is already being overwritten is satisfied only by taking the device out of service, which is clause 5.

The sources, enumerated

MODEL LANGUAGE — GENERIC

Preservation should extend to, without limitation: laptops, desktops, and servers used by [CUSTODIANS]; email and collaboration platforms and their audit logs; file shares and document management systems; cloud storage and its sync logs; identity and authentication records; remote-access, VPN, proxy, firewall, and DNS records; endpoint security and detection telemetry; mobile devices and removable media; and backups, archives, snapshots, and disaster-recovery copies.

WHAT IT PRESERVES

Replaces a demand the recipient gets to interpret with a list they have to answer. It also reaches the enterprise records most often missed because nobody thinks of them as a document repository — identity logs, network egress records, and security telemetry — which are exactly the sources that establish what left an environment.

WHAT IT DOES NOT

Does not extend a single retention window. Several of these sources have the shortest retention of anything in an enterprise, and some are governed by a licence tier rather than by a policy anyone at the recipient can change. Naming a log is not preserving it; see which windows are closing.

NOTETailor the list. A demand to preserve every category above in a two-custodian dispute invites a proportionality fight that delays the preservation you actually need.

Suspension of routine destruction

MODEL LANGUAGE — GENERIC

Please suspend, for the sources identified above, all automatic and routine deletion, including message retention and auto-expiry policies, log rotation and overwriting, snapshot consolidation and expiry, backup recycling and tape rotation, account deprovisioning and mailbox deletion, and any scheduled or manual disposition under a records-retention schedule. Please also suspend reimaging, reassignment, and disposal of any device identified above.

WHAT IT PRESERVES

Names the mechanisms that destroy evidence without anyone deciding to destroy anything, which is how most digital evidence is actually lost. Device reimaging and account deprovisioning belong here: both are routine IT hygiene and both are catastrophic to a matter in progress.

WHAT IT DOES NOT

Does not suspend anything by itself, and some of it cannot be suspended retroactively. A log that has already rotated is gone; a mailbox already purged past its recoverable window is gone. The clause protects the future and says nothing about the interval between the trigger and the letter.

Forensic imaging, and taking devices out of service

MODEL LANGUAGE — GENERIC

For the devices used by [KEY CUSTODIANS], we request that each be removed from service and that a forensic image be created using a write-blocked process, with the acquisition hash recorded and retained. We request that imaging be performed by a qualified examiner and that the images, hash values, and acquisition notes be preserved pending agreement on a collection protocol.

WHAT IT PRESERVES

This is the clause that actually preserves something. A write-blocked image captures the media as it stood on the acquisition date — including unallocated space, the file system change journal and shadow copies — and the recorded hash is what later establishes the copy has not changed.

WHAT IT DOES NOT

Does not preserve what the machine has already overwritten, and does not reach data that never lived on the device. An image of a laptop says nothing about what the server, the cloud tenant or the phone holds, and a device left running while the request is negotiated keeps consuming the space its deleted content occupies.

NOTEImaging every device in an enterprise is neither proportionate nor usually possible. Identify the devices the case turns on and say why they are the ones. What the acquisition record has to capture is the chain of custody form, and the hash fields on it are the ones that get asserted from memory when they are not written down.

Method: native format, metadata, and no self-collection

MODEL LANGUAGE — GENERIC

Please preserve material in its native format with metadata intact. We request that preservation not be effected by copying, moving, printing, converting, or re-saving files, by exporting to a container that discards system metadata, or by any process that alters access, modification, or creation timestamps.

WHAT IT PRESERVES

Closes the most common good-faith destruction of evidence there is. A custodian dragging folders to a network share believes they are preserving; in fact they are writing new timestamps, flattening the record of how the files were handled, and capturing nothing outside the files themselves.

WHAT IT DOES NOT

Does not prevent it. By the time a letter arrives, an instruction to “save everything to the shared drive” has often already gone out internally. It also cannot recover the original filesystem timestampsonce they have been rewritten — the copy is now the only version and its metadata describes the copying.

Cloud, collaboration, and third-party accounts

MODEL LANGUAGE — GENERIC

For cloud and software-as-a-service platforms, we request that you apply any available tenant-level litigation hold or retention lock to the relevant accounts and workspaces, and preserve the platform’s audit and sign-in records for the relevant period. Where relevant material is held by a third-party provider, please identify the provider and the account so that preservation can be addressed directly.

WHAT IT PRESERVES

Asks for the configuration change rather than the promise, which for a cloud tenant is the only step that stops deletion. Asking the recipient to identify third-party providers and accounts is the clause that makes a subpoena possible while the records still exist.

WHAT IT DOES NOT

Does not bind any provider, and does not guarantee the hold is available: audit-log retention and the existence of a hold feature are frequently functions of the licence tier the recipient bought, not of what they are willing to do. See what the unified audit log retains and cloud forensics on how short those windows are.

Written confirmation, and a technical contact

MODEL LANGUAGE — GENERIC

Please confirm in writing, within [N] days, the steps taken in response to this letter: the custodians and systems covered, the date each step was taken, the retention or deletion processes suspended, the method and date of any imaging or collection, and the person responsible. Please identify a contact for technical questions concerning preservation.

WHAT IT PRESERVES

Converts a future argument about notice into an argument about a document, and it costs the recipient nothing to answer. A named technical contact also short-circuits the round of correspondence in which counsel relay questions neither of them can answer.

WHAT IT DOES NOT

Does not compel a response, and a response is not verification. A confirmation that a hold was “implemented” is consistent with a notice that nobody acted on. What makes it checkable later is the specificity the clause asks for — dates, methods, and names.

Reference to the governing rule

MODEL LANGUAGE — GENERIC

We draw your attention to the obligations governing the preservation of electronically stored information, including Fed. R. Civ. P. 37(e), and reserve all rights in respect of any loss of information that should have been preserved. This letter is not exhaustive and does not limit any other preservation obligation.

WHAT IT PRESERVES

Identifies the framework without overclaiming what follows from it. Rule 37(e) asks a court to find that information which should have been preserved was lost because reasonable steps were not taken, and that it cannot be restored or replaced; the more serious measures require a finding of intent to deprive.

WHAT IT DOES NOT

Does not establish any of those findings, and a letter that predicts sanctions has told the recipient something the rule does not say. The reservation is also not a substitute for raising preservation at the Rule 26(f) conference, which is where scope normally gets settled.

Scope: the two ways this letter fails

A preservation letter fails in one of two directions and they pull against each other. Drafted too narrowly, it lets the recipient read the duty down to the sources they were always going to keep, and the network and identity records that would have established scope expire while everyone agrees about email. Drafted as a maximal demand — every system, every custodian, indefinitely — it produces a proportionality objection instead of a hold, and the argument about the letter runs longer than the retention windows it was meant to protect.

The workable middle is a short list of named custodians and systems with a stated reason for each, plus the general duty language as a backstop. That is harder to object to and much harder to comply with badly, because the recipient cannot claim not to have known what was being asked for.

The clock nobody controls

The sources that decide scope questions in an intrusion or a data-theft matter are usually the ones with the shortest retention: proxy, firewall and VPN records, DNS logs, and endpoint detection telemetry. On the host side, several of the most useful artifacts are capped by design rather than by policy — Prefetch holds a fixed number of entries, SRUM rolls over on a short window, and the Windows event logs roll by volume, so a busy server can lose a week in a day.

Send the letter, then calendar the windows. The letter is not a preservation step; the configuration change and the collection are. Between the two sits an interval during which the record is still being consumed.
Treat non-party sources as a separate track. A letter puts a provider on notice at best. Where the case depends on records a non-party holds, process is the operative step and the window is usually measured in weeks.
Do not let a device stay in service while the request is negotiated. Ordinary use overwrites unallocated space and prunes shadow copies. A machine held “pending discussion” is a machine being degraded as evidence.
Ask what the licence tier permits, not what the policy says. On cloud platforms the availability of a hold and the length of audit-log retention are frequently functions of the subscription, and no amount of willingness changes them.

If you are on the receiving end

Two responses do most of the work and neither is adversarial. Act on the suspensions immediately and document what was done, when, and by whom — a record of reasonable steps is built at the time or not at all. Then answer the scope in writing: what is being preserved, what is not and why, and which sources have already expired. A recipient who silently narrows the scope is building the other side’s motion for them; what the preserved material is normally used to establish is set out on the departing-employee and Daubert pages.

Questions counsel ask

Does a preservation letter stop evidence from being deleted?

No. It creates an obligation on the recipient and a record of when they were on notice. It does not touch any system. Cloud audit logs, endpoint telemetry, proxy and VPN records and volatile Windows artifacts all continue expiring on their own schedules until someone changes a retention setting, applies a tenant-level hold, or takes a forensic image. A letter that is never followed by a configuration change and a collection has documented a duty rather than preserved anything.

What should a preservation letter identify beyond 'all relevant documents'?

Systems and custodians by name. A generic demand to preserve relevant material is easy to comply with badly, because the recipient decides what is relevant and what counts as a system. Enumerate the endpoints, the enterprise and cloud platforms, the identity and network records, the mobile and removable media, the backups and snapshots, and the third-party or personal accounts in play — and identify the custodians whose devices should be imaged rather than merely left alone.

Can a preservation letter reach a third party's records?

It can put them on notice, which has value, but it cannot compel them. A letter creates no obligation in a non-party to retain anything, and a provider holding a party's data will generally act on its own retention policy and on legal process rather than on correspondence between litigants. Where a non-party holds material the case depends on, the letter is the first step and a subpoena is the operative one — and the retention window is usually short.

Why should a device be imaged rather than just set aside?

Because continued use overwrites the parts of the disk nobody sees. Unallocated space, the file system journal, volume shadow copies and the capped execution and usage artifacts are all consumed by ordinary operation, so a machine left running in the corner is losing evidence every day even though no one has deleted a file. A write-blocked forensic image captures the state as it was on the date it was taken and nothing after that erodes it.

Is a self-collection by the client an adequate response to a hold?

It preserves the documents and loses most of what makes them evidence. Copying files to a network folder or a USB drive typically rewrites timestamps, discards the filesystem metadata around the file, and captures nothing of the deleted content, the journal, or the artifacts that record how the file was handled. Where the dispute is about conduct rather than content, the metadata is the case and the copy is what destroyed it.

What this template does not do

It is not drafted for your matter, and it is not legal advice. Scope, proportionality and the identity of the custodians are the substance of a preservation letter, and all three are facts about a case this page knows nothing about.
No clause here has been approved by any court. This is generic drafting. It is not this firm’s filed language in any matter and has not been accepted or rejected in any specific proceeding.
It does not preserve anything. A letter creates notice. Suspending a retention policy, applying a tenant hold, and taking a write-blocked image are the acts that preserve, and none of them happens because a letter was sent.
It reflects the Federal Rules, not your forum, and cannot tell you whether a duty has arisen. Preservation duties, when they begin, and the consequences of loss vary by jurisdiction and standing order. When litigation becomes reasonably anticipated is a judgment the template assumes somebody else has already made.

PRESERVATION IS TIME-SENSITIVE

If a retention window is closing, the useful call is the one that happens before the image is taken rather than after. A conflicts check comes first, and imaging can normally be arranged without any substantive discussion of the matter.

START A CONFLICTS CHECK→

DIRECT → info@lawandforensics.com·855-529-2466

A conflicts check and scoping call follow, normally within one business day. Please do not send privileged or case-sensitive material until conflicts have cleared.

Other resources

RESOURCE 02 / DEPOSITION
Forensic Expert Deposition Outline
A topic-organised question outline for the deposition of an opposing digital forensics expert — qualifications, scope, tool validation, reproducibility, timestamps, custody, and what they were never asked to do.
RESOURCE 03 / DISCLOSURE
Rule 26 Report Checklist
The six statutory elements of a retained expert's report quoted verbatim, then — counted separately, because the rule imposes six and not sixteen — the practice points that decide whether the six are met.
RESOURCE 04 / CUSTODY
Chain of Custody Form
A blank, printable custody form, plus a field guide explaining why each field exists and what a gap in it costs when the custody record is put to a witness.
RESOURCE 05 / PROTECTIVE ORDER
Source Code Inspection Protocol
Model protective-order terms for source code review, each paired with the failure mode it prevents — including the two terms that are routinely omitted and routinely fought over later.
RESOURCE 06 / DILIGENCE
Expert CV Red Flags
How to read a digital forensic expert's CV and testimony list for what they do not say — roles in place of examinations, curated publication lists, and what a missing four-year list means.

Attorney advertising / expert services. This page publishes an educational template and general information about forensic practice and the procedural rules that govern expert evidence. It is not legal advice, it does not create an attorney–client or expert-engagement relationship, and it is not a substitute for checking the rules, standing orders, and case law of your own forum. Prior results do not guarantee a similar outcome.