Issuing a Litigation Hold and Running an ESI Production: A Practical Checklist

Litigation > Electronic Discovery and Digital Evidence | Published 26 July 2026 - Updated 15 August 2026 | UpLaw - uplaw.us

How to Use This Checklist

If something just happened, start at Part 1 today. If a case is already filed, start at Part 4 and work backward through Parts 2 and 3 to confirm nothing was missed. Doctrine is in the comprehensive guide; the orientation piece is the text message nobody saved; the forms are in the toolkit.

⚠️ The duty to preserve starts before the lawsuit does. It attaches when litigation is reasonably anticipated. If you are reading this because something happened, the clock has already started.

Part 1 — The First Seventy-Two Hours

☐ Record the trigger and its basis in writing. Date, event, who knew, and why litigation became foreseeable. This single document decides most later spoliation motions.

☐ Identify a preliminary custodian list. Anyone who made, received, or acted on the relevant information. Err wide; you can narrow later.

☐ Call IT before you call anyone else. Ask three questions: what systems hold this data, what are the retention settings, and can you apply a legal hold at the system level.

☐ Apply system-level holds immediately in the mail platform, collaboration platform, and file storage. This is a configuration change, not a request to users.

☐ Suspend backup rotation overwrite for the relevant period if backups are the only source for any window.

☐ Turn off ephemeral messaging timers for the relevant custodians and channels. Confirm the change with a screenshot.

☐ Freeze device refresh and offboarding for custodians. Departing-employee laptops and phones are routinely wiped on a fixed schedule.

☐ Preserve departed employees' accounts before they are deleted or reassigned.

☐ Issue the written hold notice to all custodians with an acknowledgment mechanism.

☐ Do not send the notice and stop. Schedule interviews.

Part 2 — The Hold Notice

☐ Write it for a non-lawyer. Short sentences, no citations, no "hereby."

☐ State plainly what the matter is about, to the extent you can.

☐ List the categories to preserve by name and by application: email, attachments, chat, texts, shared drives, personal notes, calendars, photos, voicemail, recordings, databases, and paper.

☐ Name the systems and apps explicitly. "Slack, Teams, WhatsApp, personal text messages" is far more effective than "electronic communications."

☐ State the relevant time period.

☐ Instruct recipients to stop deleting and to disable auto-delete, with instructions for each app.

☐ Instruct recipients not to edit, back-date, reorganize, or "clean up" anything.

☐ Instruct recipients not to create new commentary or summaries about the underlying events.

☐ Give a named contact for questions.

☐ Require written acknowledgment and track who has not responded.

☐ Set a reminder cadence — 60 or 90 days — and a trigger to re-issue when the case scope changes.

☐ Log every issuance, acknowledgment, and reminder.

☐ Release the hold in writing when the matter is finally over, and not before.

Part 3 — Custodian Interviews and the Data Map

☐ Interview every custodian. Fifteen minutes each is enough for most.

☐ Ask what devices they use for work, including personal phones, tablets, and home computers.

☐ Ask what accounts they use, including personal email used for work.

☐ Ask what messaging apps they use with colleagues and with the counterparty, and what retention settings those apps have.

☐ Ask where they keep notes — notebooks, note apps, whiteboards photographed and stored.

☐ Ask about shared drives, team sites, and folders they use for the subject matter.

☐ Ask who else was involved. This is how the custodian list grows correctly.

☐ Ask about departed colleagues and whether their materials were retained.

☐ Build the data map: source, owner, system of record, retention setting, estimated volume, preservation status, and accessibility assessment.

☐ Identify sources you will designate not reasonably accessible under Rule 26(b)(2)(B) and record the reason.

☐ Record what you decided not to preserve and why. A documented, reasoned exclusion is defensible; a silent omission is not.

Part 4 — The Rule 26(f) Conference and the ESI Protocol

☐ Prepare before the conference. Bring the data map, a custodian proposal, a date range, and a format proposal.

☐ Agree the custodian list and a process for adding custodians.

☐ Agree the date range, including any pre-period needed for background.

☐ Identify sources in scope and sources excluded as not reasonably accessible.

☐ Agree the search methodology — terms, technology-assisted review, or both.

☐ Agree validation: elusion sampling, sample size, confidence level and interval, and whether results are disclosed.

☐ Agree the production format: images plus load file, natives for spreadsheets and presentations, and the exact metadata field list.

☐ Agree the treatment of families, embedded objects, hidden rows and columns, and speaker notes.

☐ Agree the unit of production for chat and collaboration data.

☐ Agree deduplication scope and confirm custodian attribution is preserved in a field.

☐ Agree redaction conventions and confidentiality tiers.

☐ Agree privilege logging format — categorical, metadata-based, or document-by-document — and any date cutoff.

☐ Enter a Rule 502(d) order. Non-negotiable, one paragraph, protects against waiver in every other proceeding.

☐ Enter a protective order with data destruction obligations at the end of the case.

☐ Agree a rolling production schedule with dates.

☐ Address cost allocation for any restoration of inaccessible sources.

☐ Put all of it in the Rule 16 scheduling order so it is enforceable.

Part 5 — Collection

☐ Match the method to the risk. Forensic imaging where deletion or manipulation is at issue; targeted export otherwise.

☐ Preserve metadata. Do not collect by dragging files or forwarding email.

☐ Record chain of custody — who collected, what, when, by what method, with hash values.

☐ Avoid custodian self-collection where possible. Where unavoidable, supervise, document, and validate against an independent sample.

☐ Collect from the system of record, not from a custodian's local copy, where both exist.

☐ Collect cloud data through administrative export, which preserves metadata that manual download destroys.

☐ Collect messaging data with its structure — participants, timestamps, edits, reactions, and threading.

☐ Document every source that could not be collected and why.

☐ Generate a collection report for each custodian and keep it.

Part 6 — Processing and Review

☐ De-duplicate globally and preserve custodian attribution in a field.

☐ Expand containers, extract text, and run optical character recognition on images and scans.

☐ Report exceptions — encrypted, corrupt, or password-protected files — and resolve them rather than silently dropping them.

☐ Apply the agreed date and file-type filters and record the volume at each stage.

☐ Test search terms before fixing them. Report hit counts, unique hits, and false-positive rates from a sample.

☐ If using technology-assisted review, document the workflow, the stopping criterion, and the validation.

☐ Run quality control: second-level review of a sample, privilege coding consistency, and family reconciliation.

☐ Never produce an attachment without its parent or withhold one without logging it.

☐ Track review metrics — documents reviewed, responsive rate, privilege rate — and report them to the client weekly.

Part 7 — Privilege

☐ Screen by counsel name, domain, and law-firm address as a first pass, then review.

☐ Watch for privilege that does not look like privilege: business advice from in-house counsel, communications with consultants under a common-interest agreement, and materials prepared in anticipation of litigation under Rule 26(b)(3).

☐ Watch for waiver by use. Asserting reliance on an internal investigation frequently waives privilege over it.

☐ Log withheld documents as Rule 26(b)(5)(A) requires, in the agreed format.

☐ Redact rather than withhold where only part of a document is privileged, and log the redaction.

☐ Confirm the Rule 502(d) order is entered before the first production leaves.

☐ Have a clawback procedure ready under Rule 26(b)(5)(B) and use it promptly when something slips.

Part 8 — Production

☐ Produce in the agreed format. Verify a sample loads correctly in a review platform before delivering the whole set.

☐ Confirm the metadata field list matches the protocol exactly.

☐ Apply Bates numbers and confidentiality legends consistently.

☐ Produce spreadsheets and presentations natively with a placeholder image.

☐ Send a cover letter identifying the Bates range, custodians, sources, and any withholdings.

☐ Produce on the agreed rolling schedule and communicate slippage before it happens.

☐ Supplement under Rule 26(e) when new material appears.

☐ Certify accurately under Rule 26(g). Sanctions for an improper certification are mandatory.

Part 9 — Hard Sources

☐ Mobile devices: negotiate a targeted protocol — applications, date range, counterparties or keywords, neutral vendor, owner's-counsel privacy review, and image destruction at case end.

☐ Personal accounts used for work: determine control, and where control exists, collect narrowly with the same privacy safeguards.

☐ Ephemeral messaging: disable timers for relevant custodians, document the change, and be prepared to explain any loss before the change.

☐ Collaboration platforms: agree the unit of production and confirm whether the export preserves threads, edits, reactions, and links.

☐ Databases and structured data: negotiate a query specification and field list, not a keyword search. Ask for the schema.

☐ Third-party data: use a Rule 45 subpoena, and remember that 18 U.S.C. § 2702 bars providers from producing content to civil litigants — the content must come from the account holder.

☐ Foreign data: identify blocking statutes and data protection limits early, and plan the Hague route or 28 U.S.C. § 1782 months ahead. See the cross-border checklist.

☐ Video and audio: confirm retention windows immediately; surveillance systems commonly overwrite within days.

Part 10 — When Their Production Looks Thin

☐ Diagnose before moving. Look for missing attachments, empty months, absent chat data, missing metadata, and Bates gaps.

☐ Ask in writing for custodians, date ranges, sources searched and excluded, search terms with hit counts, and validation results.

☐ Compare the production against deposition testimony about how people communicated.

☐ Identify concrete evidence of a gap — a produced email referencing an unproduced attachment is worth more than a page of argument.

☐ Confer in good faith and document it, as Rule 37(a) requires.

☐ Move with specificity: the request, the response, the deficiency, the evidence, and the precise relief.

☐ Ask for fees. Rule 37(a)(5) makes them the default against the losing side.

Part 11 — When Evidence Is Actually Missing

☐ Establish all four Rule 37(e) thresholds before arguing remedies: ESI; should have been preserved; lost through unreasonable steps; cannot be restored or replaced.

☐ Prove the trigger date with documents.

☐ Prove you checked alternatives — backups, other custodians, counterparties, cloud version histories. Motions fail on this element more than any other.

☐ Separate prejudice from intent. Curative measures require only prejudice; presumptions and dismissal require intent to deprive.

☐ Argue intent from circumstances: timing relative to the hold, warnings received, affirmative deletion, shifting explanations.

☐ If you are defending, lead with process. The hold, the acknowledgments, the IT confirmations, the interviews, the collection reports.

☐ If loss occurred, disclose it promptly and propose a cure. Concealment converts a curable problem into an intentional one.

Part 12 — Cost Control and Closeout

☐ Budget by stage — collection, processing, hosting, review, production — and re-forecast monthly.

☐ Remember hosting accrues monthly. Volume decisions made in week six are paid for every month for two years.

☐ Cull before hosting, not after.

☐ Use technology-assisted review above a volume threshold. Below it, the setup cost exceeds the saving.

☐ Negotiate categorical privilege logging.

☐ Set a destruction date in the protective order.

☐ At case end, return or destroy productions, confirm in writing, decommission the hosted database, and release the hold — in writing, once no appeal or related matter remains.

Part 13 — Mistakes This Checklist Prevents

☐ Sending a hold notice while a tenant-level auto-delete rule keeps running. ☐ Letting a departing custodian's laptop be reimaged on schedule. ☐ Relying on custodians to decide what is relevant and forward it. ☐ Producing spreadsheets as flat images and being ordered to reproduce. ☐ Producing images with no metadata, destroying sorting and threading. ☐ Skipping the Rule 502(d) order and litigating waiver. ☐ Agreeing to search terms without testing hit counts. ☐ Subpoenaing a provider for message content that 18 U.S.C. § 2702 forbids it to give. ☐ Demanding a full forensic image of a personal phone and getting nothing. ☐ Bringing a spoliation motion without showing the information cannot be replaced. ☐ Failing to document the preservation trigger and reconstructing it two years later. ☐ Never releasing holds, so the organization preserves everything forever.

Part 14 — Role-by-Role Assignments

Discovery failures happen at the seams between people. Assign each line to a named person and confirm in writing.

☐ Outside counsel: trigger determination; scope and custodian decisions; relevance and privilege judgments; the Rule 26(g) certification; all representations to the court; the Rule 26(f) negotiation.

☐ In-house counsel or client contact: who actually did the work; unapproved tools in use; departed employees; escalation authority when IT says no.

☐ IT and security: where data lives; retention configuration; applying and verifying system-level holds; export capability; backup schedules.

☐ Records or compliance: retention schedule; regulatory retention obligations that operate independently of the litigation duty.

☐ Vendor: collection, processing, hosting, and production mechanics; volume and cost reporting; format validation.

☐ Custodians: device and account preservation; interview participation; acknowledgment.

☐ Named single owner of the hold log. One person, named in writing, keeps the register of notices, acknowledgments, reminders, additions, and releases.

Part 15 — Weekly Status Discipline

☐ Volume at each stage — collected, processed, filtered, queued for review, reviewed, produced.

☐ Spend to date and forecast to completion, with hosting shown as a recurring monthly line.

☐ Custodian additions and the reason for each.

☐ Exceptions outstanding — encrypted, corrupt, or inaccessible items — and the plan for each.

☐ Deadlines in the next thirty days.

☐ Any known or suspected loss, immediately and in writing to counsel.

⭐ A closing discipline. Once fact discovery closes, write a one-page production memo: what was preserved, from whom, over what period, by what method, searched how, validated how, and produced when. It takes an hour, it is the declaration you will attach if a deficiency motion arrives, and it is the record that converts "we believe we were thorough" into a defense a court can act on under Rule 37(e). Keep it with the hold log, the collection reports, and the Rule 502(d) order, and hand the package to trial counsel with the file. The admissibility work that follows — certifications under Federal Rule of Evidence 902, business-records foundations under Rule 803, and summaries of voluminous material under Rule 1006 — all depends on it.

Part 16 — Decision Trees

Has the duty to preserve attached?

1. Has a complaint, demand letter, notice of claim, subpoena, or regulatory inquiry arrived? → Yes, today.
2. Has an internal complaint alleging unlawful conduct been made? → Yes.
3. Has a serious incident occurred involving your premises, product, or personnel? → Almost certainly yes.
4. Has a departing employee threatened to sue, or retained counsel? → Yes.
5. Are you the prospective plaintiff and have you consulted counsel? → Yes, and earlier than the defendant's duty.
6. None of the above, but a dispute is escalating in writing? → Treat as yes and document the reasoning; the cost of an early hold is small and the cost of a late one is not.

Is this source "not reasonably accessible"?

1. Can it be exported through ordinary administrative tools? → Accessible. Volume alone does not make it inaccessible.
2. Does it require restoring backup media, rebuilding a decommissioned system, custom programming, or forensic recovery? → Candidate for Rule 26(b)(2)(B).
3. If a candidate, quantify: hours, dollars, weeks, and vendor estimate. Identify the source in your response — identification is required, and silence forfeits the position.
4. Be prepared for the court to order production for good cause with cost-shifting.

Should I collect this personal phone?

1. Is there work data on it that exists nowhere else? If no → stop.
2. Does the employer have control under its policy and practice? If unclear, ask the custodian to consent.
3. Can the need be met by a targeted export — named apps, date range, named counterparties? → Propose that.
4. Is deletion or manipulation genuinely at issue? → Forensic imaging may be justified; otherwise it is not.
5. Build in a privacy review by the custodian's own counsel and a destruction obligation.

Do I have a spoliation problem?

1. Was information lost that should have been preserved? If no → no.
2. Can it be restored or replaced from backups, other custodians, or counterparties? If yes → no Rule 37(e) remedy; produce the replacement.
3. Were reasonable steps taken? If yes and documented → strong defense even if information was lost.
4. Is the other side prejudiced? → Expect curative measures.
5. Is there evidence of intent to deprive? → Expect the severe measures, and consider disclosure and remediation immediately.

Is this production adequate?

1. Do the custodians and date range match the protocol?
2. Do the metadata fields match the protocol?
3. Do families hold together — attachments with parents?
4. Does the volume make sense against the deposition testimony about how people communicated?
5. Is there any chat or messaging data at all, in a case where witnesses say they used it?
6. Was validation disclosed, and what does the elusion sample say?

If two or more of these fail, write the letter described in Part 10 before drafting a motion. Most deficiencies are resolved by a specific letter, and the letter is what makes the motion succeed when one is genuinely needed.

Part 17 — Small-Case Version

Not every case justifies a full program, and a disproportionate process is its own failure. For a matter worth under $250,000 with two or three custodians, this is the whole checklist:

☐ Record the trigger date and the reason, in one paragraph. ☐ Send a one-page hold notice to each custodian and get an acknowledgment email back. ☐ Ask IT to apply a system hold in the mail platform and confirm it. ☐ Ask each custodian, in a five-minute call, what apps they used with the other side and whether anything auto-deletes. ☐ Turn off any auto-delete affecting those conversations, and screenshot the change. ☐ At the Rule 26(f) conference, agree three things in writing: custodians, date range, and production format. ☐ Enter a Rule 502(d) order — it is one paragraph and it is free. ☐ Export from the mail platform for the agreed custodians and range. ☐ Filter by a short list of tested keywords, review, and produce as searchable PDFs with a load file, natives for spreadsheets. ☐ Log privileged items categorically. ☐ Keep the hold notice, the acknowledgments, the IT confirmation, and the export report in one folder. ☐ Release the hold in writing when the case ends.

That is a defensible process, it costs a few thousand dollars rather than a hundred thousand, and it satisfies the same Rule 37(e) standard as a program ten times its size. Proportionality under Rule 26(b)(1) is a two-way instrument, and a party that scopes honestly and documents the scoping is far better positioned than one that either over-collects or quietly under-produces.

Related Documents

• Electronic Discovery and Digital Evidence: A Comprehensive Guide to Preservation, Production, and Sanctions
• The Text Message Nobody Saved: How Electronic Discovery Actually Works
• The Litigation Hold and Electronic Discovery Toolkit
• Moving to Compel Discovery and Seeking Rule 37 Sanctions: A Practical Checklist
• Answering Rule 33 Interrogatories: A Practical Checklist
• Getting Website Evidence Admitted: A Practical Authentication Checklist
• Drafting a Complaint, Answering It, and Moving to Dismiss: A Practical Checklist
• Serving Abroad, Taking Foreign Evidence, and Enforcing a Judgment: A Practical Checklist
• Running the First Seventy-Two Hours of a Security Incident: A Practical Checklist
• The Questions You Must Answer: How Discovery Actually Decides Cases
• Deposition Day: A Practical Checklist for Counsel and Witness
• Preparing a Case for Trial: A Practical Checklist