Menu
Services
Digital Evidence Preservation Forensic Data Acquisition Device Evidence Preservation & Acquisition Cloud Evidence
Process
Engagement Process Scope of Services Fees & Billing
Claims & Legal Teams
For Counsel For Insurers Preservation Planning Deliverables
Resources
Guides Sample Preservation Records Digital Evidence Handling & Matter Records
About
About Data365
Contact
Contact Privacy Terms
Start Intake
Preservation planning

Digital Evidence Preservation in Legal and Insurance Matters

In legal, insurance, and compliance matters, timing and source condition affect what remains available. Authorization determines whether Data365 can proceed; access conditions shape the available preservation method.

The scenarios below show how routine business activity—such as device turnover, access changes, and account administration—can change a source before preservation.

Start Intake Scope of Services Engagement Process

Preservation Timing Constraints

  • Scheduled device replacement, reassignment, or wiping that limits source availability.
  • Mailbox deprovisioning, account migration, or permission changes.
  • Travel, shipping, or transfer schedules that limit access to the source.
  • Continued business use that limits device or system availability.
  • Temporary portal access, expiring download links, or provider retention limits.

Account and Device Preservation

Preserving Mailboxes and Cloud Accounts Before Access Changes

Deprovisioning, reassignment, permission changes, or migration can change what remains accessible for preservation.

Access Authorization and Scope

  • Written authorization to access the mailbox or account and preserve or export data within scope.
  • Account owners and authorized users identified for the matter.
  • Folders, date ranges, shared repositories, cloud storage, and administrative exports included or excluded from scope.
  • Access limitations and scheduled changes that can affect availability.

Preservation Deliverables

  • Preservation documentation identifying the source, approved scope, and any exclusions.
  • An export record for any data exported, including applicable verification results.
  • A delivery record identifying what was provided, the recipient, and the delivery date.

Preserving Devices Before Reassignment or Wipe

  • Scheduled replacement or reassignment can make the device unavailable before preservation.
  • Remote wiping can delete data or otherwise change the source condition before preservation.

Authorization, Availability and Scope

  • Written authorization to access and preserve the device.
  • Any requirement for continued business use during preservation.
  • Any scheduled replacement, reassignment, or wipe and the resulting acquisition deadline.
  • Device backups, synchronized accounts, and removable media included or excluded from scope.

Preservation Deliverables

  • A record identifying the device or media and, when applicable, the account, backup, or system from which data was acquired.
  • Custody records documenting receipt, transfer, and return of the device or media.
  • An acquisition record identifying the data acquired, the method used, and the hash values recorded to verify its integrity.

Preservation During Ongoing Business Use

Some matters require preservation while a device, account, or system remains in active use.

Acquisition Scope and Timing

  • Device users and account owners identified for the matter.
  • Sources, date ranges, and data types included in the acquisition.
  • Which sources must remain operational and when data can be acquired from each.

Related Guides