Evidence Preservation Checklist

For clients and counsel in Maine family law, employment and civil matters. Print it, or save it as a PDF from your browser's print menu, and send it to the client the day you suspect a device or account matters.

Digital evidence is easy to destroy by accident. Most of the damage happens in the first 48 hours, before anyone has thought about a case. This list is what to do and not do until a forensic examiner has preserved the devices.

Do not

• Do not factory reset, wipe, or "clean up" any phone, tablet or computer.
• Do not delete messages, photos, emails, call logs or apps, even ones that seem embarrassing or irrelevant.
• Do not log out of accounts or change passwords on devices that may be examined. Changing a password can end a session and erase the trail of who was in it. Ask the examiner first.
• Do not install new apps, antivirus or "spyware detectors" on the device. They overwrite the data an examiner needs.
• Do not let the device run out of battery or power off if it is currently unlocked. Keep it charged.
• Do not hand the device to a friend, a repair shop or the other party.
• Do not restore a device from an old backup.
• Do not sign in to the suspected account from a new device to "check."

Do

• Keep the device with you or in a locked place only you can access.
• Write down, with dates and times, what you noticed and when. Unknown logins, messages you did not send, settings that changed, devices you did not add.
• Photograph the screen of anything suspicious with a different device. Do not screenshot on the affected device if you can avoid it.
• Note every account that may be involved: email, Apple or Google ID, bank, social media, cloud storage, phone carrier, home router, car app.
• Put the phone in airplane mode only if an examiner or attorney tells you to. Airplane mode stops remote wipes but also stops new evidence from arriving.
• Tell your attorney before you tell anyone else, including the other party.
• If you are in physical danger, call 911 or the Maine domestic violence helpline at 1-866-834-4357 first. Evidence can wait.

For counsel

• Send a preservation letter to the other side as early as the matter allows.
• Ask the client for the list of accounts and devices above before the first call with an examiner. Device count and account count drive the estimate.
• Decide early whether a protocol or stipulated order will govern the examination. It changes the method and the cost.
• If the client needs to be safe now, the examiner images devices first and the lockout follows the same day. Tell us which order matters more.