Preserving Evidence the Moment a Dispute Starts

Purpose

The duty to preserve evidence attaches when litigation is reasonably anticipated, which is well before anything is filed and frequently at the angry phone call. Most shops act at the summons instead, by which time the messaging app has pruned at 30 days, the dashcam has overwritten and a departed tech's phone has been wiped and reissued.

This procedure freezes the record while it still exists, and it does one thing nothing else can do: it separates records that went missing through ordinary business practice from records that went missing after somebody knew there was a dispute. Under Federal Rule of Civil Procedure 37(e), where electronically stored information that should have been preserved is lost because reasonable steps were not taken, a court may order measures to cure the prejudice, and only on a finding that a party acted with intent to deprive may it instruct a jury to presume the lost material was unfavourable. State courts apply their own standards, several less demanding.

This is not legal advice, and the scope of your own obligation is a question for counsel. What follows is the operational half, which you can run today without one.

Scope

Covers any matter where a dispute is reasonably anticipated: a demand letter, a lawyer's call, a customer or employee saying they are getting one, a serious injury, a fire or flood, a total loss of a customer's property, or an inspection naming an incident.

Does not cover the sequence after a lawsuit is served, which has hard deadlines of its own and runs under the served card. Does not cover ordinary records retention, a standing policy rather than a response, or a subpoena in someone else's case, which carries a different clock.

Roles and responsibilities

The handoff that fails is the first, because it does not look like one. A dispatcher takes a call, decides it was a frustrated customer, and nobody with authority to start a hold hears about it.

Procedure

Step 1. Date the trigger and name what produced it. One line in the matter file: date, time, what happened, who received it, the job number. The standard is anticipation, not filing, so a lawyer's voicemail counts. Acceptance: a dated entry within one business day naming event, receiver and job. Wrong looks like waiting to see whether it gets serious, which decides no hold is needed without saying so. Stop rule: where two people disagree about whether litigation is anticipated, treat it as anticipated - an unnecessary hold costs a few hours and a missed one costs a jury instruction. Hazard: none at this step, a decision made at a desk.

Step 2. Draw the scope before touching any system. One page, four fields: every job number, the date range, every custodian by name, every category. Start the range 30 days before the first work on that job and leave the end open. Categories: texts, photos, voicemail, email, dispatch and GPS, vehicle video, accounting, the physical part. Acceptance: all four filled, custodians named individually rather than as departments. Wrong looks like "everything on the Miller job", which no administrator can execute. Stop rule: if you cannot name the custodians, pull the dispatch history and list everyone on it, then flag any name that has since left, because a departed employee's device is the highest-risk item on the page. Hazard: none at this step.

Step 3. Switch off automatic deletion, shortest overwrite window first. Order matters here and nowhere else. Vehicle video overwrites on cycles measured in days and goes first; messaging apps prune at 30 days by default on many handsets; dispatch and email rules run in months. Acceptance: written confirmation per system naming the setting, its old value and its new one, within one business day of step 1. Wrong looks like a confident "we never delete anything" - most defaults delete, and the ones that bite live on phones nobody counts as a system. Stop rule: where a vendor platform cannot be changed from your account, file a written support ticket that day and record the number, and where the window expires first, export it yourself now. Hazard: none at this step, though it carries the shortest fuse here.

Step 4. Issue the written hold notice and collect acknowledgements. Dated notice to every custodian naming the matter, the date range, the categories and three prohibitions: nobody deletes, edits, backdates or tidies any record touching the job, nobody contacts the other side, nobody posts about it. Acceptance: a written acknowledgement from each within 2 business days. Wrong looks like a verbal instruction at the morning huddle, which proves nothing later. Stop rule: anyone not acknowledged by the third business day gets a call and a re-send that day; a former employee gets a letter to their last known address and counsel is told, because you have no authority over their device. Hazard: none at this step.

Step 5. Capture the volatile records by copy, not by instruction. Anything living on a person can vanish in one tap, so an instruction is not a control. Export the full thread rather than screenshots of the interesting parts, the camera roll across the range with metadata intact, and voicemail audio. Acceptance: one export per custodian per category with its date recorded, originals left in place. Wrong looks like screenshots of selected messages, which strip timestamps and invite the argument that you curated the record. Stop rule: where a custodian refuses access to a personal device, do not compel it and do not go into the phone yourself - record the refusal in writing and route it to counsel that day, because how far preservation reaches into an employee's own device carries real privacy limits. Hazard: none at this step.

Step 6. Photograph the condition and secure the part before service is restored. Safety governs this step and comes before any photograph. Do not run the equipment to reproduce the failure. Before photographing inside an electrical enclosure, de-energize at the disconnect, lock and tag it, and prove dead on a known live source before and after per NFPA 70E-2021, 120.5, under 29 CFR 1910.333(b)(2), written for a qualified person under 1910.332; where nobody on site is qualified the photographs wait for an electrician. On any gas odour everyone leaves immediately, no switch touched, no light operated, no phone used inside, and the call goes to the utility from outside. On a hot or pressurized system, isolate and let it cool first. Then bag the failed part, tag it with date, job and who removed it, and store it un-repaired and untested. Acceptance: photographs from three positions including one wide shot establishing location, date stamp intact, plus a log entry for the part. Wrong looks like photographing the repair rather than the fault, or bench-testing the part, which alters the one object everybody will argue about. Stop rule: where service must be restored now, photograph first and keep the component, and if restoration will destroy evidence and the customer insists, tell counsel that day and record who asked and what was lost.

Step 7. Re-scope every 30 days and release only in writing. Matters grow: another job, a name that was not on the list, a category nobody thought of. Acceptance: a dated re-scope note every 30 days while the matter is open, and at the end a written release confirming normal retention resumes. Wrong looks like a hold issued once and never mentioned again, which decays into noise and teaches the crew to ignore the next one. Stop rule: release no category without counsel's written confirmation that the matter is closed, including after a settlement, because an appeal window or a related claim can still be live when the cheque clears. Hazard: none at this step.

The record this produces

One folder, six artifacts: the dated trigger entry, the one-page scope, a per-system confirmation naming each retention setting and its old value, the hold notice with its acknowledgements, the export index with dates, and the physical-evidence log with photographs. The re-scope notes and the written release join them at the end.

Two cannot be reconstructed afterwards at any price. The retention-setting record is how you show a gap predates the dispute; the acknowledgement set is how you show the instruction reached people. Later readers are your own counsel, opposing counsel in discovery, and possibly a judge deciding whether something went missing through ordinary business or through something else.

The exception path carries as much weight as the happy one. A trigger that never becomes a dispute still gets a written release rather than silent decay, a custodian who has left is documented as unreachable rather than quietly dropped, and an unchangeable system gets a ticket number and an export instead of a shrug.

A worked pass

An HVAC shop. On August 14 at 9:40 the office manager takes an email from a homeowner's lawyer about a condensate overflow that damaged a finished ceiling, naming a service visit on August 11 and a maintenance visit in May. Step 1 passes: entry logged that day naming the email, the receiver and jobs 4471 and 4318. Step 2 passes the same morning: both jobs in scope, range April 1 to open, five custodians named, nine categories listed.

Step 3 fails on its first run. Four systems clear: dispatch retention goes from 12 months to indefinite, the messaging app's 30-day auto-delete is switched off (the setting that would have taken the May thread on September 12), the email archive rule is suspended, voicemail is extended from 90 days. The fifth is a vendor-hosted vehicle video platform overwriting on a 14-day cycle the shop's account cannot change, and the May 22 footage is already gone.

The stop rule runs instead of the step. A written ticket goes in that day with its number recorded, and because the August 11 footage has three days left it is exported immediately: the vendor's hold does not land until August 19, five days after that footage would have been overwritten. The May footage is written up as lost to ordinary retention before any trigger existed, with the date and the cycle that took it - a different sentence entirely from the one a shop writes when footage disappears after a demand letter.

Step 4: notice issued August 14 to five custodians, four acknowledging that day; the fifth is on leave, so the third-business-day stop rule runs and a call on August 19 gets it. Step 5: threads exported, camera roll pulled for April through August. Step 6: the ceiling is already cut out by the customer's restoration contractor, so that condition is recorded as gone, and what survives is the float switch replaced on August 11, now bagged, tagged and stored untested - nobody benches it, which is a real temptation and exactly the wrong move. Step 7: re-scoped September 13 to add a tech appearing in the May thread.

Every acceptance is met except step 3's, and the pass is a good one because of that failure: the shop can say which record was lost, when and to what cycle, and prove the rest was frozen within one business day of the first email.

References

• Federal Rule of Civil Procedure 37(e), failure to preserve electronically stored information; state courts apply their own spoliation standards, several less demanding
• NFPA 70E-2021, 120.5, the before-and-after proving sequence; 29 CFR 1910.333(b)(2) with 1910.332, electrical work practices and who is qualified to perform them
• See related: A Demand Letter Arrives, You Have Been Served: The First Two Weeks, Discovery What the Other Side Can Make You Produce
• See related: The Data Backup Habit That Saves a Shop From Disaster, Field Photo Documentation Before During After Protocol