Below is suggested language to include for the preservation of electronic devices in various cases. Please keep in mind that preservation does not mean that the data will be used in litigation. However, since we won’t know which devices are/not relevant within a reasonable time, any potentially relevant device should be preserved. As you will see in the language below, preservation can be accomplished by discontinuing device usage and powering the device off (specific steps below). Also, THIS IS NOT LEGAL ADVICE, please consult an attorney.
Intellectual Property Theft Case
Relating to the unauthorized exfiltration of [Company] [Type – Client, customer, supplier, financial, marketing, etc.] data [if applicable – including PII], you are directed to immediately identify and forensically preserve the following:
1) Any/all devices used to view/up-download/photograph/copy/store or communicate about [Company-Type] data [if applicable – including PII]. Preservation of a device can be accomplished by (if applicable) placing the device in Airplane Mode, disabling Bluetooth (an additional necessary step after disabling Bluetooth) and powering off the device. If the custodian MUST continue using the device a forensic preservation by a qualified Digital Forensic Professional must be completed within a reasonable time. If a temporary device swap is necessary please consult with a digital forensic professional to ensure no data is compromised during the process. A digital forensic service provider may provide a loaner device for this purpose. A backup of the device to the cloud (e.g, iCloud) is not an adequate method of forensic preservation.
2) Any/all Email accounts, or other digital communications services (i.e., mobile/computer applications), controlled or used (directly or indirectly) to view/download/copy/store or communicate about [Company-Type] data [if applicable – including PII].
3) Any/all cloud service accounts (including cloud storage, i.e., Dropbox, Google Drive, Box, iCloud, OneDrive, Amazon Drive/Web Services, etc.) owned, controlled, or used (directly or indirectly) to view/up-download/copy/store or communicate about [Company-Type] data [if applicable – including PII]. A backup of devices to the cloud prior to Cloud Preservation (i.e., iCloud) will cause irreparable deletion of previously backed-up data that may be relevant.
4) Any/all historical data relating to devices activated by and/or connected to and used with the email and/or cloud accounts identified above (i.e., Apple, Google, MSN, Hotmail, Drobox, Amazon, etc. history/log data) and any additional identified accounts, including any identified cloud storage account.
A forensic preservation should be completed without delay to avoid the destruction of (whether intended or unintended) data relevant to the unauthorized exfiltration of and/or continued use of [Company-Type] data [if applicable , including PII]. Continued use of the identified devices, including mobile devices and computers, can and likely will, cause irreversible deletion of relevant data thereby impeding legal proceedings regarding this matter and may be considered to be Spoliation of Evidence as defined by section 1.38 of the Florida Rule of Civil Procedure. Furthermore, deletion of ANY data thought to be irrelevant to the instant matter/case/litigation is not a decision to be made by a custodian.
Traffic Crash/Distracted-Driving Case
[Served to any/all involved drivers regardless of a fault since distracted driving may be contributing factor to either side]
Relating to the Traffic Crash that occurred on [DATE] at approximately [TIME], on [Street/Road/highway] in [State/County], hereinafter referred to as the Traffic Crash, you are directed to immediately identify and forensically preserve the following:
1) Any/all devices in the possession of [DRIVER] at the time of the crash, including any device that uses any type of mobile communication, GPS, and or Bluetooth/Wireless technology, including (but not limited to) Cellular Telephones, Smart Phones, GPS devices, Custom Devices used by Companies to track locations, inventory, sales, etc.. Preservation of a device can be accomplished by placing the device in Airplane Mode, disabling Bluetooth (an additional necessary step after disabling Bluetooth), and keeping he device powered on and charged. If the custodian MUST continue using the device a forensic preservation by a qualified Digital Forensic Professional must be completed within a few days of the crash. If a temporary device swap is necessary please consult with a digital forensic professional to ensure no data is compromised during the process. A forensic service provider may provide a loaner device for this purpose. A backup of the device to the cloud (e.g, iCloud, Samsung, Google) is not an adequate method of forensic preservation and will cause relevant data to be destroyed.
2) Any/all Email accounts, or other digital communications services (i.e., mobile/computer applications), controlled or used (directly or indirectly) to view/up-download/copy/store/share or communicate information about the Traffic Crash3) Any/all cloud service accounts (including cloud storage, i.e., Dropbox, Google Drive, Box, iCloud, OneDrive, Amazon Drive/Web Services, etc.) owned, controlled, or used (directly or indirectly) to view/up-download/copy/store/photograph or communicate about the Traffic Crash. A backup of devices to the cloud prior to Cloud Preservation (i.e., iCloud) will cause irreparable deletion of previously backed of data that may be relevant.
4) Any/all historical data relating to devices activated by and/or connected to and used with the email and cloud accounts identified above (i.e., Apple, Google, MSN, Hotmail, Drobox, Amazon, etc.) and any additional identified accounts, including any identified cloud storage account.
Since the most relevant data relating to device activity at or near the time of a crash can be highly volatile, a forensic preservation should be completed without delay to avoid the destruction of (whether intended or unintended) data relevant to the traffic crash. Continued use of the identified device(s), even a few days after the Traffic Crash, WILL CAUSE irreversible deletion of relevant data thereby impeding legal proceedings regarding this matter and may be considered to be Spoliation of Evidence as defined by section 1.38 of the Florida Rule of Civil Procedure. Furthermore, deletion of ANY data thought to be irrelevant to the instant matter/case/litigation is not a decision to be made by a custodian.
This section will be updated with additional case types as time permits.
