Updated 3/6/25
Below is suggested language to include for the preservation of electronic devices in various cases. Please keep in mind that preservation does not mean that the data will be used in litigation. However, since we won’t know which devices are/not relevant within a reasonable time, any potentially relevant device should be preserved, especially in high-stakes matters. As you will see in the language below, preservation can be accomplished by discontinuing device usage and taking certain steps (specific steps below). Also, THIS IS NOT LEGAL ADVICE, please consult an attorney before making any legal decisions regarding this information.
Traffic Crash/Distracted-Driving Case
[Served to any/all involved drivers regardless of a fault since distracted driving may be contributing factor to either side]
Relating to the Traffic Crash that occurred on [DATE] at approximately [TIME], on [Street/Road/highway] in [State/County], hereinafter referred to as the Traffic Crash, you are directed to immediately identify and forensically preserve the following:
1) Any/all devices in the possession of [DRIVER] at the time of the crash, including any device that uses any type of mobile communication, GPS, and or Bluetooth/Wireless technology, including (but not limited to) Cellular Telephones, Smart Phones, GPS devices, Custom Devices used by Companies to track locations, inventory, sales, etc.. Preservation of a device can be accomplished by:
- Placing the device in Airplane (AP) Mode
- Disabling Bluetooth/WiFi (additional necessary step after turning on AP mode)
- Disabling “Stolen Device Protection” (see https://support.apple.com/en-us/120340)
- Disabling automatic updates (see the “Turn automatic app updates on or off” section at https://support.apple.com/en-us/102629), and DO NOT UPDATE THE DEVICE OR ANY APPLICATIONS!
- Powering off the device (or leaving the device powered on and charged if it is anticipated to be imaged within a week or two).
If the custodian MUST continue using the device a forensic preservation by a qualified Digital Forensic Professional MUST be completed within a few days of the crash (preferably within 5-6 days). It is important that the device is not updated. If a temporary device swap is necessary please consult with a digital forensic professional to ensure no data is compromised during the process. A forensic service provider may provide a loaner device for this purpose. A backup of the device to the cloud (e.g, iCloud, Samsung, Google) is not an adequate method of forensic preservation and will cause relevant data to be destroyed.
2) Any/all Email accounts, or other digital communications services (i.e., mobile/computer applications), controlled or used (directly or indirectly) to view/up-download/copy/store/share or communicate information about the Traffic Crash3) Any/all cloud service accounts (including cloud storage, i.e., Dropbox, Google Drive, Box, iCloud, OneDrive, Amazon Drive/Web Services, etc.) owned, controlled, or used (directly or indirectly) to view/up-download/copy/store/photograph or communicate about the Traffic Crash. A backup of devices to the cloud prior to Cloud Preservation (i.e., iCloud) will cause irreparable deletion of previously backed of data that may be relevant.
4) Any/all historical data relating to devices activated by and/or connected to and used with the email and cloud accounts identified above (i.e., Apple, Google, MSN, Hotmail, Drobox, Amazon, etc.) and any additional identified accounts, including any identified cloud storage account.
Since the most relevant data relating to device activity at or near the time of a crash can be highly volatile, a forensic preservation should be completed without delay to avoid the destruction of (whether intended or unintended) data relevant to the traffic crash. Continued use of the identified device(s), even a few days after the Traffic Crash, WILL CAUSE irreversible deletion of relevant data thereby impeding legal proceedings regarding this matter and may be considered to be Spoliation of Evidence as defined by section 1.38 of the Florida Rule of Civil Procedure. Furthermore, deletion of ANY data thought to be irrelevant to the instant matter/case/litigation is not a decision to be made by a device owner or company representative.
Intellectual Property Theft Case
Relating to the unauthorized exfiltration of [Company] [Type – Client, customer, supplier, financial, marketing, etc.] data [if applicable – including PII], you are directed to immediately identify and forensically preserve the following:
1) Any/all devices used to view/up-download/photograph/copy/store or communicate about [Company-Type] data [if applicable – including PII]. Preservation of a device can be accomplished by (if applicable) placing the device in Airplane Mode, disabling Bluetooth (an additional necessary step after disabling Bluetooth) and powering off the device. If the custodian MUST continue using the device a forensic preservation by a qualified Digital Forensic Professional must be completed within a reasonable time. If a temporary device swap is necessary please consult with a digital forensic professional to ensure no data is compromised during the process. A digital forensic service provider may provide a loaner device for this purpose. A backup of the device to the cloud (e.g, iCloud) is not an adequate method of forensic preservation.
2) Any/all Email accounts, or other digital communications services (i.e., mobile/computer applications), controlled or used (directly or indirectly) to view/download/copy/store or communicate about [Company-Type] data [if applicable – including PII].
3) Any/all cloud service accounts (including cloud storage, i.e., Dropbox, Google Drive, Box, iCloud, OneDrive, Amazon Drive/Web Services, etc.) owned, controlled, or used (directly or indirectly) to view/up-download/copy/store or communicate about [Company-Type] data [if applicable – including PII]. A backup of devices to the cloud prior to Cloud Preservation (i.e., iCloud) will cause irreparable deletion of previously backed-up data that may be relevant.
4) Any/all historical data relating to devices activated by and/or connected to and used with the email and/or cloud accounts identified above (i.e., Apple, Google, MSN, Hotmail, Drobox, Amazon, etc. history/log data) and any additional identified accounts, including any identified cloud storage account.
A proper forensic preservation should be completed without delay to avoid the destruction of (whether intended or unintended) data relevant to the unauthorized exfiltration of and/or continued use of [Company-Type] data [if applicable , including PII]. Continued use of the identified devices, including mobile devices and computers, can and likely will, cause irreversible deletion of relevant data thereby impeding legal proceedings regarding this matter and may be considered to be Spoliation of Evidence as defined by section 1.38 of the Florida Rule of Civil Procedure. Furthermore, deletion of ANY data thought to be irrelevant to the instant matter/case/litigation is not a decision to be made by a device owner or company representative.
This page will be updated with adjustments, additional information, and case types as time permits.
