Litigation Hold and Evidence Preservation Checklist: A Practical Checklist

Summary. The duty to preserve attaches when litigation is reasonably anticipated, which is usually before anyone has filed anything and often before counsel is retained. This checklist covers the whole lifecycle: recognizing and documenting the trigger, scoping custodians and systems, issuing a notice people can act on, executing the technical suspensions that make the notice real, and maintaining and releasing the hold. It gives particular attention to the sources that cause most modern spoliation findings — collaboration platforms with short default retention, ephemeral messaging, personal devices, departed employees, and third-party cloud data. Each phase is paired with the reason it matters and the authority behind it.

What this checklist is for. Discharging the preservation duty in a way you can prove later. The standard is reasonable steps, not perfection, and the difference between a defensible position and a sanctions motion is almost always documentation. For the sanctions framework, see Litigation Holds, Spoliation, and Rule 37(e).

Phase 1 — Recognize and document the trigger

Identify the event that made litigation reasonably anticipated and record the date and the reasoning in a memo.
Treat each of these as a presumptive trigger: a demand or cease-and-desist letter; a litigation hold letter from an adversary; an internal complaint foreshadowing a claim (harassment, whistleblower, safety); a serious accident or product failure; an employee departure to a competitor with suspicious file activity; a government inquiry, subpoena, or civil investigative demand; a material breach notice; and your own decision to sue.
Note that the duty applies to plaintiffs at least as strongly, and attaches when you decide to pursue a claim.
Assess whether the trigger is matter-specific or broad enough to touch multiple business units.
Escalate to counsel the same day; preservation decisions should not sit in a queue.

Why this matters. Everything downstream is measured from this date. A party that can show a documented trigger analysis and a hold issued within days is in a fundamentally different position under Rule 37(e) than one reconstructing the timeline in a deposition.

Phase 2 — Scope

Define the subject matter and date range, generously at first; narrowing later is easy, expanding after deletion is impossible.
Identify custodians: decision-makers, participants, their assistants, IT and systems owners, and anyone the complaint or demand names.
Inventory systems and repositories: email, chat platforms, file shares, cloud storage, CRM, ERP, ticketing, code repositories, design tools, databases, voicemail, phone records, badge access, video, and paper.
Include AI assistants — prompts and outputs used for work may be relevant and discoverable, and retention varies by product and configuration.
Identify data held by third parties you control by contract: SaaS vendors, payroll processors, outsourced developers, and consultants.
Identify physical evidence: products, samples, equipment, and vehicles. Rule 37(e) does not apply to physical evidence, which is governed by harsher common-law spoliation rules. Silvestri v. General Motors Corp., 271 F.3d 583 (4th Cir. 2001).
Apply proportionality: the scope should reflect the matter's stakes and the party's sophistication, per the 2015 advisory committee note.

Why this matters and the trap. The most common scoping failure is inventorying email and stopping. Modern disputes are decided in chat, and chat is where the retention defaults are shortest.

Phase 3 — Custodian interviews

Interview key custodians individually, promptly, and do not rely on the notice alone.
Ask what they actually use: which platforms, which devices, which personal accounts, which shadow tools.
Ask about habits that destroy data: mailbox cleanup, disappearing-message settings, local-only files, notes apps, and personal drives.
Ask who else was involved and what systems they used — this is how you find custodians nobody listed.
Record the interviews in a log: date, custodian, systems identified, actions taken.

Why this matters. Zubulake v. UBS Warburg LLC, 229 F.R.D. 422 (S.D.N.Y. 2004), holds that counsel must communicate directly with key players rather than relying on a mass email. The interview log is the single most useful document in defending a spoliation motion.

Phase 4 — Issue the hold notice

Plain-language description of the matter, enough to recognize relevant material without disclosing strategy.
Date range and subject matter scope.
Categories of information, in operational terms: email, chat (name the platforms), text messages, voicemail, documents, spreadsheets, notes, calendars, tickets, code, designs, databases, photographs, and physical items.
Locations: company systems, personal devices used for work, home offices, cloud accounts, and personal email if used for business.
Affirmative instructions: stop deleting; do not edit, reorganize, or "clean up"; disable disappearing-message and auto-delete features; do not use ephemeral modes for matter-related communications.
A named point of contact for questions.
Acknowledgment required, with a deadline.
A statement that the hold remains in effect until released in writing.
Send it in a medium recipients actually read, and consider a short second channel (manager cascade, intranet notice).

Why this matters. The notice is the artifact opposing counsel will demand. Its content may be privileged, but the fact, timing, and distribution are frequently discoverable, and some courts order production of the notice itself once a prima facie spoliation showing is made. Write it assuming a judge will read it.

Phase 5 — Execute the technical suspensions

Suspend auto-delete and retention purges for affected accounts and repositories — via IT, with a ticket number, not via the custodian.
Place mailboxes on hold using the platform's legal hold or retention lock features.
Do not delete departed employees' accounts; convert them to held accounts.
Preserve devices before reimaging or reissue. Build a preservation step into the offboarding process.
Configure collaboration platforms: suspend workspace and channel retention, and confirm direct messages are covered; confirm your license tier can actually export DMs.
Disable ephemeral features for custodians, and instruct against Signal, WhatsApp disappearing messages, and similar tools for matter communications.
Notify SaaS vendors and cloud providers whose systems hold relevant data.
Image devices where the facts warrant (departure cases, alleged misappropriation), using a qualified examiner and before anyone opens files.
Verify the holds actually took effect. Test them; do not assume the setting saved.

Why this matters. The notice tells people what to do; the technical suspension is what preserves the data. The overwhelming majority of spoliation findings involve an auto-delete policy that ran on schedule because nobody told IT.

Phase 6 — Maintain

Reissue the hold at defined intervals (quarterly is common) and whenever scope changes.
Add custodians as discovery reveals them, and document when and why.
Include hold checks in onboarding and offboarding processes.
Maintain a written log of every step with dates: trigger, notice, acknowledgments, IT actions, interviews, scope changes.
Track non-responders and escalate.
Confirm the hold survives system migrations, platform changes, and vendor transitions, which routinely destroy held data.

Why this matters. A hold issued once and never revisited fails on the second year of a three-year case. The log is the evidence of reasonable steps.

Phase 7 — Release

Confirm the matter is fully resolved, including appeals and any related proceedings.
Release in writing, to the same recipients, stating that ordinary retention resumes.
Notify IT to remove the technical holds.
Update the hold register.
Reconcile with privacy obligations — data minimization and storage limitation require that data not be kept longer than necessary. See Data Minimization and Avoiding the Over-Retention of Personal Information.

Why this matters. Holds that are never released accumulate, defeat the retention schedule, create privacy exposure, and make the next collection vastly more expensive. Release discipline is part of preservation discipline.

Phase 8 — Readiness, before any dispute

Data map: what categories of information exist, where they live, and who owns them.
Retention schedule with a hold override capability and an audit trail.
Policy on personal devices and messaging apps, with an enforceable right of access.
Confirmed export capability on every communication platform in use — tested, not assumed.
Offboarding checklist with a preservation step.
A named owner for legal holds and a standing process to route triggers to them.
Vendor contracts requiring preservation cooperation and data export.

Why this matters. Preservation is almost entirely solvable in advance and almost never solvable afterward. The company that discovers in month nine that its chat platform deletes DMs after ninety days and cannot export them has a problem no lawyer can fix.

Common mistakes

Waiting for a complaint. The duty attaches on reasonable anticipation, which is usually earlier.
Sending the notice and stopping. The notice is not preservation; the IT suspension is.
Forgetting chat and text. The most candid and most perishable evidence.
Reimaging a departed employee's laptop on the normal thirty-day cycle.
Blanket confidentiality instructions to custodians, which can raise labor-law issues; give case-specific justifications.
Over-preserving everything forever, which is expensive, creates privacy exposure, and signals a program that is not thought through.
No log. The single most damaging omission, because reasonable steps you cannot describe did not happen.
Never releasing holds, which quietly disables the retention schedule.

Primary authority

Rules: Fed. R. Civ. P. 37(e) (lost ESI; curative measures and the intent-to-deprive standard for severe sanctions); 26(b)(1) (proportionality); 26(f) (ESI conference); 34 (production); 26(b)(5)(B) (clawback); Fed. R. Evid. 502(d) (non-waiver orders).
Cases: Zubulake v. UBS Warburg LLC, 220 F.R.D. 212 and 229 F.R.D. 422 (S.D.N.Y. 2003-2004); Silvestri v. General Motors Corp., 271 F.3d 583 (4th Cir. 2001); Klipsch Group, Inc. v. ePRO E-Commerce Ltd., 880 F.3d 620 (2d Cir. 2018); Goodyear Tire & Rubber Co. v. Haeger, 581 U.S. 101 (2017); Chambers v. NASCO, Inc., 501 U.S. 32 (1991).
Secondary: Advisory Committee Note to the 2015 Amendment to Rule 37(e); The Sedona Conference Commentary on Legal Holds.

This checklist is educational and not legal advice. Preservation obligations depend on the facts, the jurisdiction, and the systems involved. Consult qualified litigation counsel as soon as litigation is reasonably anticipated.