General: Notice to Preserve Electronic Evidence

[date/address] Re: Notice to Preserve Electronic Evidence [Legal Matter]

Dear ______________ :

Our law firm represents [name] in the above legal matter in which you [your business] are [is] [will be] named as a defendant. This letter requests your immediate action to preserve electronically stored information that may contain evidence important to the above legal matter. Briefly, the matter involves [short statement of facts in case].

This notice applies to your [custodian] cell phone, cell phone backups, removable electronic media, and computer systems. This includes, but is not limited to, e-mail and other electronic communications; electronically stored documents, records, images, graphics, recordings, spreadsheets, databases; calendars, system usage logs, contact manager information, telephone logs, internet usage files, deleted files, cache files, user information, and other data.

Further, this notice applies to archives, backup and disaster recovery tapes, discs, drives, cartridges, voicemail and other data. All operating systems, software, applications, hardware, operating manuals, codes, keys and other support information needed to fully search, use, and access the electronically stored information must also be preserved. The importance of immediate action cannot be overstated.

Electronically stored information is easily corrupted, altered, and deleted in normal daily operations. Even booting an electronic device, running an application, or reviewing a document can permanently alter evidence. The cell phone should be powered off, sealed inside of an evidence container, and placed in secure evidence storage until such a time whereas a cell phone forensics expert can create a forensic image of the device.

Full chain of custody should also be kept. Further, any external media or computer system used to create backups of the cell phone should also be powered off according to digital forensics best practices, placed into sealed evidence containers, and securely stored until forensic images of the evidence items can be created. Full chain of custody should also be kept.