I’m sure that you have reviewed a lot of preservation letters. Some of them are excellent — thorough, specific, and sent at exactly the right moment. Others read like they were written in 1997 and then never updated, which, in fairness, some of them were.
Still others never got sent. So many times I have talked with a client whose STBX (soon-to-be-ex) spouse or otherwise opponent was still using their phone when incriminating texts may not yet have been nuked – but were about to be, and no preservation letter yet sent.
The common ESI preservation letter asks for emails, text messages, and documents on the company laptop. And maybe some Cl
oud-stored stuff. That’s a start. It’s just not nearly enough anymore. The average person in 2026 interacts with digital data across a dozen different platforms and devices every day, and most of that data isn’t sitting in anyone’s email inbox waiting to be requested. Here’s what’s missing from most of the preservation letters that cross my desk.
Cloud storage. Dropbox, Google Drive, OneDrive, iCloud, Box — documents, photos, and entire folder structures live here, often synced automatically without the user giving it much thought. And it’s pretty hard for the user to fake certain metadata with
items stored in the Cloud. Employees routinely save work files to personal cloud accounts. People share contracts and photos and videos through cloud links. And when someone deletes a file from a cloud account, the provider may retain version history or deleted-file recovery for weeks. Your letter needs to name the platforms, not just say “any cloud storage.”
Collaboration tools. Slack, Microsoft Teams, Google Chat — these have become where business actually happens for many. Decisions get made in Slack channels. Strategies get discussed in Teams threads. Embarrassing things get said in what people wrongly believe are ephemeral DMs. These platforms retain message histories, shared files, and even the edited or deleted messages in many cases. If the case involves workplace conduct, a dispute between business partners, or anything that happened inside a company in the last several years, this data is essential.
Vehicle telematics. This one surprises people. Many modern vehicles record GPS routes, speed data, hard braking events, phone call logs through Bluetooth, and in some cases even audio clips. That data often syncs to the manufacturer’s cloud. In a personal injury case, a business dispute over where someone was and when, or any matter involving vehicle use, a car can be a witness. A surprisingly reliable one, actually — unlike human witnesses, it doesn’t misremember and it doesn’t have an agenda.
Smart home and IoT devices. Alexa heard something. The Ring doorbell recorded it. The Nest thermostat kn
ows when someone was home. Fitness trackers log sleep patterns and heart rates. These devices generate and store data continuously, and that data is often synced to cloud accounts that can be subpoenaed. I’ve worked cases where a FitBit let us know when a person had likely died and what led up to it. Don’t overlook these.
Social media, including private messages. Most attorneys remember to ask about public social media posts. Fewer remember to ask about the direct messages, the stories that disappear after 24 hours (though not always from the platform’s servers), and the private groups. Instagram DMs, Facebook Messenger, Snapchat, WhatsApp, Signal — these are where candid conversations happen. People say things in private messages they would never commit to email.
Backup systems. Time Machine on a Mac, 
Windows Backup, NAS drives, corporate backup servers — these can contain historical versions of files that no longer exist on the primary device. The document that was altered before it was produced? An older version may be sitting in a backup that nobody thought to preserve.
Send the letter early. Send it before filing if you can. And when you send it, be specific — general language gives the other side every opportunity to claim they didn’t understand what was covered. The data you fail to preserve is the data you’ll spend the rest of the case wishing you had.
Steve Burgess is a digital forensics expert witness with 40+ years of experience and more than 20,000 cases examined. He founded Burgess Forensics in 1984.
Don’t miss a single issue of our informative newsletter … Subscribe!