E-Discovery For Law Firms: How To Preserve And Store Electronic Data Defensibly

To preserve and store electronic data defensibly, a law firm should follow five steps:

1. Identify the data and its sources
2. Notify custodians and pause deletion
3. Preserve content and metadata in place
4. Collect copies the right way
5. Document everything

At CMIT Solutions, we help law firms handle e-discovery by building this five-step workflow into their everyday IT. With our security-first managed IT services, we help keep your electronic data protected and defensible while it is preserved and stored, so your attorneys can handle review and production with confidence.

Explore our IT support for law firms to see how we keep client data secure and defensible.

 

How to preserve and store electronic data defensibly

Preserving electronic data defensibly means keeping relevant records safe, unchanged, and traceable from the moment litigation is reasonably expected. Much of the work happens in your firm’s everyday IT, though larger matters may need specialist platforms or forensic tools, so each step below needs an owner and a record.

1. Identify the data and its sources: Counsel names the people and matters involved, and IT maps their mailboxes, file shares, chat tools, phones, and cloud accounts. Record the list, because you cannot preserve what you have not found.
2. Notify custodians and pause deletion: Counsel sends a written legal hold, and IT switches off the scheduled purges that apply to those people. Record who was notified and when each setting changed.
3. Preserve content and metadata in place: IT stores the data securely and locks it so nothing is edited, moved, or overwritten, including details like who sent a file and when. Record where the data lives and who can access it.
4. Collect copies the right way: IT gathers copies so the originals stay intact and the metadata carries over, with forensic help for larger matters. Record who made each copy, how, and when, because careless copying can invite questions about your evidence.
5. Document everything: Counsel and IT pull the records from the earlier steps into one dated file, including hold notices, scope decisions, and change logs. A complete file is what lets you show the process was reasonable if anyone challenges it.

As your trusted technology advisor, we work alongside your attorneys to turn each step into a written IT procedure, so the IT side of a legal hold is documented and repeatable from notice through collection.

What e-discovery is and the data it covers

E-discovery, or electronic discovery, is the process of finding, preserving, collecting, reviewing, and producing electronically stored information (ESI) for a lawsuit or investigation. It covers almost anything digital your firm or your client creates, and getting it right starts long before anyone opens a document for review.

ESI covers more than email. Common examples include:

• Email and attachments: threads, calendar invites, and forwarded files.
• Documents and files: word processing files, spreadsheets, PDFs, and presentations stored on servers or in the cloud.
• Messages and chat: texts, Microsoft Teams, Slack, and other app conversations that can hold key facts.
• Other sources: voicemail, audio and video files, databases, social media, and websites.
• Metadata: the record of when a file was created, sent, or changed, which can show timing and authorship.

The Electronic Discovery Reference Model (EDRM) is a widely used framework for managing electronic discovery, and EDRM 2.0, released in September 2026, covers identification, preservation, collection, processing, review, production, presentation, and disposition. Information governance now underpins the whole lifecycle, and analysis runs throughout it.

We help firms put information governance into practice, with retention rules and organized storage that make later stages simpler.

Why your IT setup makes or breaks defensible preservation

Your firm’s IT quietly decides whether preservation succeeds, long before a judge weighs in. Routine settings built for convenience, like auto-deleting old email, can erase the records you are required to keep. A managed IT partner finds those gaps early, so you are not guessing whether your setup is ready.

Several everyday IT choices can support or undermine a defensible hold:

• Email retention and auto-delete: purge rules that clear mail after a set number of days keep running during a hold unless someone turns them off.
• Backups and archiving: backups can sometimes recover deleted data, but they often rotate on a schedule, so they are a fallback and not a substitute for a legal hold.
• User accounts and offboarding: when a staff member leaves, their mailbox and files should be preserved, not wiped with their account.
• Shadow IT and personal devices: work data in personal email, texts, or unapproved apps is easy to miss and hard to preserve.

Left unmanaged, these gaps grow as your firm adds tools and staff. With security-first managed IT, we close them early and keep your systems, users, and data protected, continuously monitored, and ready for a hold.

Get a security evaluation tailored to your firm with our custom cybersecurity score.

 

When your duty to preserve begins

Your duty to preserve begins when litigation is reasonably anticipated, which can be well before a complaint is filed or any discovery requests arrive. A demand letter, a written complaint from a client, or a clear threat to sue may be enough to trigger it.

Rule 37(e) of the Federal Rules of Civil Procedure applies when electronically stored information that should have been preserved for litigation is lost because a party did not take reasonable steps to keep it, and it cannot be restored or replaced. The court’s options then depend on which part of the rule applies:

• Rule 37(e)(1): if the court finds the loss prejudiced the other side, it may order measures no greater than necessary to cure that harm.
• Rule 37(e)(2): harsher penalties, such as an adverse presumption, an adverse jury instruction, or dismissal or default judgment, require a finding that the party meant to deprive the other side of the information.

While your attorneys decide when a duty attaches, we give cybersecurity-informed recommendations on the IT controls that should be ready to act the moment it does.

A preservation checklist for your firm

A short checklist turns the duty to preserve into IT actions your team can take once counsel authorizes a hold, even when email, chat, cloud storage, and phones come from different vendors. Counsel decides the scope, and the table shows who typically carries out each technical step.

IT control	What to confirm	Why it matters	Who carries it out
Auto-delete and retention	Scheduled email and file purges are paused for the affected people	Helps stop automatic loss of held data	IT partner
Mailbox and account holds	A hold is applied to each custodian’s mailbox and files	Helps keep records even if a user deletes them	IT partner
Departing employees	Accounts, mailboxes, and devices are preserved before offboarding	Helps prevent loss when staff leave mid-matter	Office manager and IT partner
Backups	Recent backups exist, are tamper-resistant, and can be restored	Provides a fallback copy, though not a substitute for a legal hold	IT partner
Cloud and chat apps	Teams, Slack, and cloud storage are included in the hold	Captures sources that live outside email	Attorney and IT partner
Mobile and personal devices	Work texts and app data on phones are identified and preserved	Covers records that are easy to overlook	Attorney and custodian
Access and audit logs	Logging is on and shows who viewed or changed data	Helps show the data stayed intact	IT partner
Documentation	Each action above is dated and recorded	Shows a reasonable, repeatable process	Attorney or office manager

We advise your firm on each control and can set up, monitor, and maintain the technical ones so they work when it counts, with on-site help from our local teams when a device needs in-person attention.

If your firm handles sensitive data for defense contractors, explore our CMMC compliance services to prepare for DoD requirements.

 

What can go wrong: an illustrative spoliation scenario

The fastest way to see why IT matters is to watch a routine setting erase evidence. This hypothetical shows how one overlooked setting can turn a manageable matter into a spoliation problem.

Hypothetical scenario: A small firm receives a demand letter from a former client threatening a lawsuit, but no one tells IT, and the email system keeps deleting messages older than 90 days. Weeks later the suit is filed, and by the time the firm issues a legal hold, key email threads from the disputed period are already gone.

Because the messages were lost after the letter arrived and cannot be restored, the firm now faces a spoliation claim and possible court-ordered penalties. If the letter made litigation reasonably foreseeable, the firm should have promptly assessed its preservation duty and told IT to protect relevant records, and we help firms build that alert path between attorneys and IT so a convenience setting is less likely to undercut a defense.

Where e-discovery costs add up, and how clean IT lowers them

E-discovery costs depend on data volume, processing, hosting, review arrangements, and technology, and a larger data set often means more to review. One practical way to control that cost is to reduce and organize data upstream, inside your IT.

Review tools have improved for years, from technology-assisted review, also called predictive coding, to newer AI that reads and summarizes large document sets. Before review, processing tools can remove duplicates and filter by date or keyword, but they still work only with the data your firm collected.

Clear retention rules and tidy file storage mean less duplicate and irrelevant data to collect, which fits the federal rules’ focus on proportionality. We advise firms on the retention and storage setups that keep that volume down, and we work alongside the specialist platforms or forensic experts a larger matter may require.

Estimate what IT interruptions could cost your firm with our IT downtime calculator.

 

How a managed IT partner supports defensible preservation

Small law firms often lack in-house IT resources, so a managed IT partner provides a reliable foundation for legal holds, and many routine preservation needs can be met without enterprise tools. IT services don’t have to be complicated, and that foundation is the gap we fill at CMIT Solutions.

Here is how that support shows up in practice:

• Hold-ready setup: we configure retention, backups, and account controls ahead of time, then help pause auto-delete and preserve custodian data quickly when a matter starts.
• Security built in: layered protection, 24/7 monitoring and threat response, and secure, offsite backups help keep preserved data safe and your firm running.
• Local help with national backing: responsive local support, on-site when needed, backed by a nationwide network of IT and cybersecurity professionals and shared tools and best practices, keeps firms with several offices or remote staff consistent.
• Strategic guidance: as your trusted technology advisor, we plan ahead and share modern technology insights, including AI, so your technology supports your firm’s goals and preservation keeps pace as you grow.

We’ve worked with thousands of businesses since 1996 and are part of a network of over 900 IT experts. We also offer compliance services for industries including legal, so your technology protects your evidence and your reputation at the same time.

Additional reading: outsourced IT for law firms

Keep your firm’s evidence defensible with a partner in your corner

Preserving electronic data defensibly does not have to fall on your attorneys and office staff, so you can stay focused on your cases and grow with confidence. At CMIT Solutions, we act as your security-first IT partner, advising on the controls each hold needs and keeping them monitored, with responsive local support backed by a nationwide network of IT and cybersecurity experts.

Protecting sensitive data across many locations is something we know well, as our Optyx case study shows: we support a 13-store optical retail chain that must keep patient data secure at every site. We optimized internet service across all of its locations, including backup connections that keep critical systems available, and we continue to act as its trusted technology advisor, planning infrastructure around its growth.

Call us at (800) 399-2648 or visit our contact us page to get stronger protection, reliable support, and strategic guidance for how your firm preserves and stores electronic data.

FAQs

What format should a law firm use to produce electronically stored information in federal discovery?

In federal court, the requesting party can specify a form for producing electronically stored information. If none is named, the producing party must use the form it normally keeps the data in or a reasonably usable form. Native files generally retain more metadata, depending on how the data was collected.

What should a law firm check before sending client data to an e-discovery vendor?

A law firm should ask where a vendor stores data, who can access it, and whether it is encrypted. The firm should also ask about independent security certifications and negotiate written commitments not to train AI models on client data and to delete or return it afterward.

What happens to data under a legal hold when a law firm changes email systems or IT providers?

A legal hold stays in force during an email or IT provider change, so plan the move first. Preserve a full copy of the held data, confirm the migrated data keeps its metadata, and tell the new provider in writing who and what is on hold.

Who is responsible when electronic data is lost under a legal hold, the law firm or its IT provider?

Responsibility for preserving electronic data generally stays with the party in the case and its attorneys, so a law firm cannot fully hand that duty to an IT provider. A strong IT provider lowers the risk by following a written hold procedure. Written roles agreed in advance keep everyone accountable.

How long should a law firm keep preserved electronic data after a case ends?

A law firm should keep preserved electronic data until counsel confirms the matter is resolved, including appeals and related proceedings, and then release the legal hold, ideally in writing. Other retention duties may still apply, and releasing early risks sanctions. A written retention schedule, applied consistently, keeps disposition defensible.