ESI collection is the process of identifying, preserving, and gathering electronically stored information so it can be produced in litigation and stand up under challenge. Done right, it starts before a lawsuit is filed, uses forensically sound tools, and produces a documented trail proving the data is complete and unaltered. Done wrong, it produces sanctions, adverse inferences, and in the worst cases dismissal of the case.
The steps below track what actually has to happen, in roughly the order it happens, from the moment litigation becomes foreseeable through the point where data is handed to the other side.
When the Duty to Preserve Starts
The obligation to preserve relevant evidence begins the moment litigation is reasonably anticipated, not when a complaint is filed. The standard is objective: if a reasonable person in the same position would foresee a lawsuit, the clock is running. From that point on, a party must take affirmative steps to prevent destruction of any data that could be relevant.
What has to be preserved is anchored in Federal Rule of Civil Procedure 26. Discovery covers any nonprivileged information relevant to a claim or defense, subject to proportionality.1Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery For collection purposes, the practical translation is that you preserve broadly early on and narrow later; you cannot un-delete something you failed to hold.
Legal Holds and Mapping Where the Data Lives
Before any forensic tool touches a device, someone has to figure out where relevant data actually sits. That means identifying every custodian who might possess relevant information and mapping every system where the data could exist: email servers, laptops, shared drives, collaboration platforms, cloud accounts, and mobile devices. This exercise almost always surfaces sources nobody expected.
Once litigation is reasonably foreseeable, a formal legal hold goes to every identified custodian. The hold suspends routine deletion and tells each person what to preserve, which systems are affected, and what actions are prohibited. Custodians acknowledge receipt, and those acknowledgments get tracked. That compliance trail is the primary defense if the other side later claims evidence was destroyed. A working hold process also includes periodic reminders and updates as the scope of the case shifts.
Personal Devices
Personal phones used for work create hard questions. Whether that data falls within the organization’s “possession, custody, or control” under the production rules is fact-specific and often contested.2Legal Information Institute. Federal Rules of Civil Procedure Rule 34 – Producing Documents, Electronically Stored Information, and Tangible Things Address personal-device preservation in the hold notice itself, and where possible have mobile device management in place before any dispute arises.
Slack, Teams, and Ephemeral Messaging
Collaboration platforms like Slack, Microsoft Teams, and Signal are now standard business tools, and their auto-delete features create a real preservation problem. The FTC and the DOJ Antitrust Division have both stated that messages on these applications are subject to the same preservation obligations as any other document, regardless of how the platform is configured.3Federal Trade Commission. Slack, Google Chats, and Other Collaborative Messaging Platforms Have Always Been and Will Continue to Be Subject to Document Requests
When a preservation obligation kicks in, automatic deletion has to be turned off on relevant channels, and some organizations may need to stop using an application entirely if it lacks adequate retention controls. This applies to communications on employee-owned devices too. Failing to preserve ephemeral messages can result in spoliation findings and, in the enforcement context, referrals to criminal prosecutors.3Federal Trade Commission. Slack, Google Chats, and Other Collaborative Messaging Platforms Have Always Been and Will Continue to Be Subject to Document Requests
Choosing a Collection Method
The collection itself has to use forensically sound methods so the resulting data is an accurate, unaltered copy of the original. Three approaches cover most situations, and picking the wrong one is a common and expensive mistake.
Forensic Imaging
A forensic image is a bit-by-bit copy of an entire storage device. It captures every sector, including deleted files, file fragments, and slack space. This is the most defensible method and the default for high-stakes litigation, regulatory investigations, and criminal matters. Because the image replicates the entire drive, it preserves evidence that targeted collection would miss, like recently deleted communications or hidden files. The tradeoff is volume: imaging a single laptop produces a massive dataset that has to be processed and reviewed.
Targeted Collection
Targeted collection extracts only specific files or folders based on predefined criteria: search terms, date ranges, custodian folders, file types. It is faster and cheaper than full imaging, and often appropriate for routine commercial disputes where the relevant data is well-defined. The risk is missing something. If the criteria are too narrow, or if the understanding of the data landscape is incomplete, relevant evidence slips through. Experienced practitioners treat targeted collection as a scoping tool, not a shortcut.
Remote Collection
With distributed workforces, in-person collection from every device is often impractical. Remote collection uses agent-based tools deployed to endpoints, gathering data over a network without physically handling the device. To be defensible, the tool has to maintain chain of custody, log every action, validate the integrity of collected data, and operate under attorney or forensic expert supervision. Unsupervised remote collection by non-technical staff is where defensibility problems start.
Metadata and Chain of Custody
Regardless of method, the collection has to capture each file’s metadata: author, creation date, last modified date, file path. Metadata is often as important as the document content because it establishes when a file was created, who touched it, and whether it was altered. Care matters here. Simply opening a file in its native application can modify metadata, which is exactly the outcome the collection is supposed to prevent.4U.S. Department of Justice. Standard Specifications for Production of ESI
Collecting the right data means nothing if you cannot prove it was handled properly afterward. Chain of custody is the chronological record of everyone who touched the evidence, when they accessed it, where it was stored, and why each transfer occurred. Courts expect the documentation to be thorough enough that any break can be identified and explained.
Data integrity is verified through cryptographic hash values, which function as unique digital fingerprints. A hash is generated at the moment of collection and rerun whenever the data changes hands. Matching values prove the data is unchanged. Federal Rule of Evidence 902(14) allows data copied from electronic devices to be self-authenticated through a “process of digital identification” like hashing, provided a qualified person certifies the process and the proponent gives advance notice to the opposing party.5Legal Information Institute. Federal Rules of Evidence Rule 902 – Evidence That Is Self-Authenticating More broadly, electronic evidence can be authenticated by showing the system or process used to collect it produces accurate results.6Legal Information Institute. Federal Rules of Evidence Rule 901 – Authenticating or Identifying Evidence
A complete chain of custody log documents the device description and serial number, the collection method and tool used, the date and location of acquisition, and the hash values generated at each stage. Gaps give opposing counsel an opening to challenge admissibility, and judges are increasingly skeptical of sloppily documented collections.
Form of Production and the Rule 26(f) Conference
How ESI comes out shapes how it goes in. Before discovery ramps up, the parties have to meet and confer about how ESI will be handled. Federal rules require the conference to happen at least 21 days before the court’s scheduling conference and to produce a written discovery plan.1Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery
The plan has to cover ESI-specific topics: any issues about disclosure, discovery, or preservation of electronically stored information; the form or forms in which ESI should be produced; and any procedures for handling privilege claims after production, including whether to seek a court order under Federal Rule of Evidence 502.1Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery This is where the practical details get resolved: search terms, date ranges, custodian lists, data sources, and whether the parties will use technology-assisted review. Treating the conference as a formality almost always produces expensive disputes later.
If a request does not specify a format, the producing party must deliver ESI in the form in which it is ordinarily maintained or in a reasonably usable form. A party never has to produce the same ESI in more than one format.2Legal Information Institute. Federal Rules of Civil Procedure Rule 34 – Producing Documents, Electronically Stored Information, and Tangible Things The choice between native files and static images (like TIFFs with load files) drives collection decisions. If native production is expected, the collection has to preserve files exactly as they sit in the source system with metadata intact. If the parties agree on image-based production, processing has more flexibility, but relevant metadata fields still need to be captured alongside the images.
Protecting Privilege with a 502(d) Order
Large-scale ESI collection inevitably sweeps in privileged communications. Attorney-client emails, litigation strategy documents, and work product end up in the collection pool alongside responsive material, and volume makes pre-production privilege review both expensive and error-prone.
A Federal Rule of Evidence 502(d) order lets a federal court rule that disclosure of privileged information during litigation does not waive the privilege, and that protection extends to any other federal or state proceeding as well.7Legal Information Institute. Federal Rules of Evidence Rule 502 – Attorney-Client Privilege and Work Product; Limitations on Waiver In practice, the parties negotiate a clawback agreement during the Rule 26(f) conference and ask the court to incorporate it into an order. With a 502(d) order in place, accidentally produced privileged documents can be clawed back without permanent waiver. Without one, a single inadvertent disclosure during a million-document production could waive privilege over the entire subject matter. Getting this order entered early is one of the simplest and most valuable protective steps available.
Why Self-Collection Fails
Letting custodians collect their own data is one of the most reliably catastrophic decisions in e-discovery. It seems efficient, but it introduces two problems courts take seriously: relevant data gets excluded, either through ignorance of where it sits or through deliberate omission of embarrassing material; and the absence of forensic controls makes the collection impossible to defend later.
Attorneys have a professional duty to oversee the adequacy of ESI identification, preservation, collection, and production. Courts have made clear that accepting a client’s representation that “everything has been produced” does not satisfy that obligation. In one case, defense counsel accepted the client’s claim that all relevant data sat on four hard drives and failed to check cloud-based sources including websites and email accounts. The resulting failure to preserve and produce relevant ESI led to a $2.5 million sanctions award. The court observed that competence in e-discovery is not optional and that the complexity of digital evidence does not excuse inadequate oversight.
Sanctions When Preservation Fails
Federal Rule of Civil Procedure 37(e) sets a two-tier framework for what happens when ESI that should have been preserved is lost because a party failed to take reasonable steps to keep it, and the information cannot be restored through other discovery.
- If the court finds the loss prejudiced another party, it may order measures no greater than necessary to cure the prejudice. That can include additional discovery, cost-shifting, or precluding certain arguments.
- If the court finds the party acted with intent to deprive the other side of the evidence, far more severe remedies open up. The court may presume the lost information was unfavorable, instruct the jury that it may or must presume the information was unfavorable, or dismiss the case entirely or enter default judgment.8Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery
The distinction matters. Under the intent standard, the court does not even need to find prejudice before issuing an adverse inference instruction. If you destroyed evidence on purpose, the rules assume the other side was harmed. Dismissal and default judgment are reserved for the most egregious conduct, but they are not theoretical. Courts have imposed both when parties deliberately wiped data after preservation obligations arose.
“Reasonable steps” is the threshold that separates a bad outcome from a manageable one. Organizations that can show a functioning legal hold process, validated collection tools, and qualified professionals involved throughout are far better positioned to defend against spoliation claims than those who treated preservation as an afterthought.8Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery