Toolkit · Litigation

The Litigation Hold and Electronic Discovery Toolkit

18 U.S.C. § 1519

Type
Toolkit
Jurisdiction
National
Date
2026-02-25
Topic
Litigation

This toolkit contains the working documents of an electronic discovery process. It supplies the hold notice, its acknowledgment form, and the register that tracks both, together with a custodian interview script and a data map. It contains a complete ESI protocol, a Rule 502(d) non-waiver order, search term and validation worksheets, and three privilege log formats. It supplies the production cover letter, the deficiency letter that resolves most disputes without a motion, and a spoliation motion outline built around the element movants most often skip. It closes with a mobile device collection protocol, a chain of custody form, a hold release, and an authority quick card. Each tool carries a note on its purpose and its failure modes, and all are drafted for federal practice and must be conformed to the protocol and local rules of the case at hand.

The Litigation Hold and Electronic Discovery Toolkit

Litigation > Electronic Discovery and Digital Evidence | Published 25 February 2026 - Updated 24 August 2026 | UpLaw - uplaw.us

What Is In This Toolkit

Sixteen working documents. Use them with the checklist for sequence, the guide for the governing rules, and the article for orientation.

⚠️ The hold notice is the least important part of preservation. Configuration changes, custodian interviews, and documentation do the actual work. A notice sent and forgotten is evidence of a process that did not happen.

Tool 1 — Legal Hold Notice

CONFIDENTIAL — ATTORNEY WORK PRODUCT LEGAL HOLD NOTICE — ACTION REQUIRED BY [DATE]

To: [Custodians] From: [Legal] Date: [Date] Matter: [Short name]

Why you are receiving this. [Company] is involved in a legal matter concerning [plain-English subject]. The law requires us to preserve information that may be relevant. This notice suspends normal deletion for the material described below until Legal cancels it in writing.

Time period: [start] to present.

Preserve everything relating to [subjects], including: ☐ Email and attachments — including anything in Deleted Items or archives ☐ Microsoft Teams / Slack messages, including direct messages and channels ☐ Text messages and iMessage on any phone you use for work ☐ WhatsApp, Signal, or other messaging apps used with colleagues, customers, or vendors ☐ Documents, spreadsheets, presentations, and PDFs on any drive, including local and personal cloud storage ☐ Calendar entries, meeting invitations, and meeting notes ☐ Notebooks, notes apps, and whiteboard photos ☐ Voicemail, call logs, and recordings ☐ Photographs and videos, including those on personal devices ☐ Database records, tickets, and reports you generated ☐ Paper files

What to do today:

  1. Stop deleting. Do not delete anything relating to these subjects, from anywhere.
  2. Turn off auto-delete. In each messaging app you use for work, disable disappearing messages for these conversations. Instructions are attached.
  3. Do not edit, back-date, rename, or reorganize any existing material.
  4. Do not create new summaries or commentary about the underlying events.
  5. Do not discuss this notice outside the recipient list.
  6. Reply to acknowledge by [date].

Questions: [Name, email, phone]. Ask before you act, not after.

Failure to preserve can result in court sanctions against the company and, in serious cases, personal liability. Deliberate destruction of records can be a federal crime under 18 U.S.C. § 1519.

Tool 2 — Acknowledgment and Hold Register

Acknowledgment: "I have read the Legal Hold Notice dated [date] regarding [matter]. I understand what I must preserve and that I must not delete or alter it. I have disabled automatic deletion in the applications I use. I will contact Legal with questions. — [Name], [Date]"

Register (one row per custodian):

Custodian Role Notice sent Acknowledged Interviewed Devices Apps in use Auto-delete disabled Reminders Released

⭐ The register is the single artifact most likely to decide a later Rule 37(e) motion. One named person owns it.

Tool 3 — Custodian Interview Script

  1. Describe your role and your involvement in [subject].
  2. What devices do you use for work? Company laptop, personal laptop, company phone, personal phone, tablet, home desktop?
  3. What email accounts do you use for work, including any personal account?
  4. Which of these do you use with colleagues about work: Teams, Slack, text/iMessage, WhatsApp, Signal, other?
  5. For each: do messages disappear automatically? Do you know the setting? Have you changed it?
  6. Where do you store documents? Network drive, SharePoint, OneDrive, Google Drive, Dropbox, local desktop, USB?
  7. Do you keep notes? Paper notebook, notes app, whiteboard photos?
  8. Do you record calls or meetings? Where do the recordings and transcripts go?
  9. Who else was involved in [subject]? Anyone outside the company?
  10. Has anyone who worked on this left the company? When?
  11. Have you deleted anything relating to this subject since [trigger date]?
  12. Is there anything you think we should be looking at that we have not asked about?

Record answers in writing the same day. Question 11 is asked neutrally and answered honestly; the answer, whatever it is, is far better known now than discovered later.

Tool 4 — Data Map

Source Owner System of record Retention setting Est. volume Hold applied Verified by Accessible? Notes
Exchange Online IT Yes 7 yr 240 GB ✓ 3/4 J. Park Yes
Teams (tenant) IT Yes 30 days — ✓ 3/4 J. Park Yes Timer disabled 3/4; loss before that date
SharePoint "Project X" PMO Yes Indefinite 90 GB ✓ 3/5 J. Park Yes Version history retained
Personal phones (3) Custodians No Varies — Notice 3/4 — Targeted only Vendor protocol pending
Legacy ERP (retired 2021) IT Yes Archive tapes Unknown N/A — Not reasonably accessible Rule 26(b)(2)(B); est. $40k to restore

Rule: every row that says "not reasonably accessible" must be identified to the other side in the discovery response. Silence forfeits the position.

Tool 5 — ESI Protocol (Stipulation)

STIPULATED ORDER GOVERNING THE DISCOVERY OF ELECTRONICALLY STORED INFORMATION

1. Scope. This Order governs the production of ESI. It supplements Rules 26, 34, and 45. 2. Custodians. Each party will identify custodians whose ESI will be searched. A party may request up to [n] additional custodians on a showing of relevance; disputes are presented to the Court. 3. Date range. [Start] to [end], unless otherwise agreed. 4. Sources. Each party will identify sources searched and sources withheld as not reasonably accessible under Rule 26(b)(2)(B), with the basis stated. 5. Search methodology. [Search terms, exchanged with hit counts and negotiated / Technology-assisted review, with the protocol and stopping criterion disclosed.] 6. Validation. The producing party will draw a random sample of at least [n] documents from the null set, review it for responsiveness, and disclose the elusion rate with the confidence level and interval. 7. Form of production. Single-page Group IV TIFF at 300 dpi with document-level extracted text, plus a Concordance-format load file (.DAT with ¶ and þ delimiters) and an Opticon image cross-reference. Spreadsheets, presentations, audio, video, and files whose utility depends on native format will be produced natively with a slip-sheet image. 8. Metadata fields. BegBates; EndBates; BegAttach; EndAttach; Custodian; DuplicateCustodians; FileName; FileExtension; FileSize; DocType; Author; From; To; CC; BCC; Subject; DateSent; TimeSent; DateReceived; DateCreated; DateLastModified; MD5Hash; NativeLink; TextLink; Confidentiality; Redacted. 9. Families. Attachments will be produced with their parents. A responsive family member causes the family to be produced unless a member is privileged, in which case it is logged. 10. Chat and collaboration data. Produced as [channel-day / thread] units with participants, timestamps, edits, reactions, and thread structure preserved. 11. Deduplication. Global deduplication by MD5 hash across custodians, with all custodians listed in DuplicateCustodians. Email threading may be used; the most inclusive message will be produced. 12. Redactions. Redactions will be applied to images with a "Redacted" field set to Yes, and the basis stated on the log. Redacted natives will be produced as images. 13. Privilege log. Categorical logging is permitted for [categories]. Communications with outside counsel after [complaint date] need not be logged. 14. Non-waiver. The Court's Federal Rule of Evidence 502(d) Order applies. 15. Rolling production. Productions will be made every [n] days beginning [date] and substantially completed by [date]. 16. Costs. Each party bears its own costs, except as ordered for restoration of inaccessible sources. 17. Destruction. Within 60 days of final resolution, each party will return or destroy productions and certify in writing.

Tool 6 — Rule 502(d) Order

Short, free, and the highest-value paragraph in electronic discovery.

ORDER UNDER FEDERAL RULE OF EVIDENCE 502(d)

"The production of any document, electronically stored information, or other information in this action, whether inadvertent or otherwise, shall not constitute a waiver of any privilege or protection, including the attorney-client privilege and work-product protection, in this or any other federal or state proceeding. This Order is entered under Federal Rule of Evidence 502(d). Nothing in this Order requires a party to conduct any particular privilege review, and the reasonableness of any review is irrelevant to the non-waiver protection provided here. A producing party may request the return of any produced material at any time, and the receiving party shall promptly sequester or destroy it and any copies, consistent with Rule 26(b)(5)(B), pending resolution of any dispute."

Tool 7 — Search Term Negotiation Worksheet

# Proposed term Documents with hit Unique hits Family count Sampled false-positive rate Status
1 "retaining wall" 4,120 1,880 6,300 12% Agreed
2 wall 61,400 44,900 88,000 91% Rejected — too broad
3 wall w/10 (collapse OR fail* OR crack*) 5,880 2,010 8,400 18% Agreed
4 "cover your" 340 340 590 40% Agreed — colloquial

Rules of engagement: exchange counts before agreeing; test each term against a sample; specify stemming and wildcard behavior; specify whether terms run against attachments and metadata; specify family behavior; and agree a mechanism to revisit terms once documents are reviewed and vocabulary is learned.

Tool 8 — Validation Report Template

"Producing Party applied [methodology] to a collection of [N] documents after [filters]. Documents produced: [n]. Null set: [N − reviewed]. Elusion sample: [k] documents drawn at random from the null set and reviewed by [qualified reviewer]. Responsive documents found in sample: [r]. Estimated elusion rate: [r/k]%, with a 95% confidence interval of [±x]%. Estimated recall: []%. Conclusion: the estimated number of responsive documents remaining in the null set is approximately [], which Producing Party submits is proportional under Rule 26(b)(1)."

Tool 9 — Privilege Log Formats

Document-by-document | Log # | Bates/Control | Date | Author | Recipients | CC/BCC | Type | Privilege | Description |

Categorical "Category 3: Communications between [Company] employees and outside counsel at [Firm] between [date] and [date] concerning the [subject] investigation, seeking or reflecting legal advice. Approximate count: 480. Participants: [list]. Basis: attorney-client privilege; work product."

Metadata-only — generated from the review platform, populating From, To, CC, Date, Subject, and privilege basis, with a stipulation that subject lines may be redacted where privileged.

Tool 10 — Production Cover Letter

"Enclosed is [Party]'s [ordinal] production in this matter. Bates range: [] through []. Custodians included: [list]. Sources: [list]. Date range: []. Format: per ¶ 7 of the ESI Protocol; natives for spreadsheets and presentations. Confidentiality: documents designated per the Protective Order entered [date]. Withheld: [n] documents withheld as privileged; log to follow by [date]. [n] documents redacted. Not produced: [source] is designated not reasonably accessible under Rule 26(b)(2)(B) for the reasons stated in our response to Request []. Please confirm the load file processes correctly."

Tool 11 — Deficiency Letter

This letter resolves most disputes without a motion, and it is the exhibit that wins the motion when one is necessary.

"Dear [Counsel]: We have reviewed [Party]'s production of [date] and have questions before raising anything with the Court.

1. Process. Please identify: (a) the custodians whose materials were searched; (b) the date range applied; (c) each source searched; (d) each source excluded as not reasonably accessible and the basis; (e) the search terms with hit counts, or the technology-assisted review protocol and stopping criterion; and (f) the validation performed, with the elusion rate and confidence interval.

2. Specific gaps. (a) PROD000412 is an email referring to 'the attached revised drawings.' No attachment was produced with it. (b) Custodian Ruiz's production contains no documents between March 4 and May 20, 2023, the period in which the events at issue occurred. (c) Three witnesses testified they coordinated by text message; the production contains no text messages from any custodian. (d) Images were produced without the metadata fields required by ¶ 8 of the ESI Protocol, specifically DateSent and Custodian.

3. Relief requested. Supplemental production addressing (a) through (d) by [date], or a written explanation of why each is not required.

We are available to confer on [dates] as Rule 37(a) requires. We would prefer to resolve this without motion practice."

Tool 12 — Spoliation Motion Outline

I. Introduction. What was lost, when, and why it matters to a specific issue. II. The duty attached on [date] because [demand letter / incident report / internal complaint], Exhibit []. III. The lost information should have been preserved. It is relevant to [claim/defense] because []. IV. Reasonable steps were not taken. [No hold issued until [date]; tenant auto-delete remained enabled until [date]; custodian device wiped on [date] after the hold; no reminders; no IT verification.] V. It cannot be restored or replaced. We checked: backups [result]; other custodians [result]; counterparties [result]; cloud version history [result]. Exhibit []. VI. Prejudice. The lost material is the only source of [], and its absence prevents proof of []. VII. Intent to deprive (only if seeking severe measures). [Deletion occurred after the hold; the party was warned on [date]; explanations have shifted; affirmative deletion is documented at [].] VIII. Relief. [Curative measures / adverse-inference instruction / dismissal], and fees.

⚠️ Section V is the section movants skip and courts require. Do the work.

Tool 13 — Mobile Device Collection Protocol

"1. Scope. Collection is limited to the following applications: [Messages/iMessage, WhatsApp, Signal, Teams], for the period [start]–[end]. 2. Filters. Only communications with the following counterparties or containing the following terms will be reviewed: [list]. 3. Vendor. [Neutral vendor] will perform a targeted logical extraction. No full physical image will be retained beyond the extraction period. 4. Chain of custody. The vendor will record device identifiers, extraction method, date, and hash values. 5. Privacy review. The extracted set will first be provided to counsel for the device owner, who may withhold personal content unrelated to the scope, logging withheld items by date, participant, and general subject. 6. Production. The remaining set is produced under the ESI Protocol and the Protective Order. 7. Destruction. The vendor will destroy all extraction data within 30 days of final resolution and certify in writing. 8. Cost. Borne by [party], subject to reallocation by the Court."

Tool 14 — Chain of Custody Form

Field Entry
Matter
Custodian / source
Device or account identifier
Collected by
Date and time (with time zone)
Method (administrative export / logical / forensic image)
Tool and version
Volume (items, GB)
Hash algorithm and value
Storage location
Transferred to Date

Tool 15 — Hold Release

Organizations that never release holds end up preserving everything forever, and a program that cannot say what is on hold and why is not defensible.

"LEGAL HOLD RELEASE — [Matter] The matter identified above has been finally resolved. Effective [date], the Legal Hold Notice dated [date] is released. You may resume normal retention and deletion practices for the materials described in that notice.

Important: if you are subject to any other legal hold, that hold remains in effect. If you are unsure, contact [Legal] before deleting anything.

Legal will confirm with IT that system-level holds are removed and that any preserved data no longer required by another matter or by our retention schedule is disposed of according to that schedule."

Tool 16 — Authority Quick Card

Scope and proportionality: Rule 26(b)(1) · Rule 26(b)(2)(B) Requests and format: Rule 34 · Rule 33 · Rule 36 Conference and scheduling: Rule 26(f) · Rule 16 Non-parties: Rule 45 · 18 U.S.C. § 2702 · § 2703 Depositions: Rule 30 Sanctions: Rule 37 · Rule 26(g) · 28 U.S.C. § 1927 · Chambers Criminal: 18 U.S.C. § 1519 · § 1512 · § 1030 · Van Buren Privilege: FRE 502 · Rule 26(b)(3) · Rule 26(b)(5) Admissibility: FRE 901 · FRE 902 · FRE 803 · FRE 801 · FRE 1001 · FRE 1003 · FRE 1006 Cross-border: 28 U.S.C. § 1782

Tool 17 — Weekly Status Template

Send this to the client every week. It prevents the two conversations nobody wants: the surprise invoice and the surprise gap.

ESI status — [matter] — week of [date] Volume: collected [] GB / [] docs · processed [] · after filters [] · reviewed [] · produced []. This week: [custodians added and why; sources newly collected; productions made with Bates ranges]. Spend: to date $[] · this month $[] · hosting run rate $[]/month · forecast to substantial completion $[]. Exceptions outstanding: [encrypted/corrupt/inaccessible items and the plan for each]. Risks: [any known or suspected loss; any custodian not acknowledging the hold; any source we cannot reach]. Next 30 days: [deadlines from the scheduling order and the protocol].

Tool 18 — Production Memo

Write this when fact discovery closes. It becomes the declaration you attach if a deficiency or spoliation motion arrives, and it takes an hour.

1. Trigger. The preservation duty attached on [date] because [event]. Documented at [reference]. 2. Hold. Notice issued [date] to [n] custodians; [n] acknowledged; reminders on [dates]; custodians added on [dates] for [reasons]. 3. System measures. Holds applied in [systems] on [dates], verified by [name] on [dates]. Auto-deletion disabled in [platform] on [date]. 4. Custodians. [List, with role and rationale.] 5. Sources. Collected: [list]. Excluded as not reasonably accessible: [list, with basis and cost estimate], identified to opposing counsel on [date]. 6. Collection. Method per source; vendor; dates; volumes; hash verification. 7. Processing. Deduplication scope; filters applied; volumes at each stage; exceptions and their resolution. 8. Search. [Terms, with counts / TAR protocol and stopping criterion.] Validation: elusion sample of [k], [r] responsive, estimated recall []% at []% confidence. 9. Review and privilege. Reviewers; quality control; privilege log format and date; clawbacks and their resolution under the Rule 502(d) Order. 10. Productions. Dates, Bates ranges, custodians, formats. 11. Known losses. [None / description, date discovered, remedial steps, whether replaced.] 12. Certification. Responses were certified under Rule 26(g) on [dates] by [counsel].

Related Documents