LAW OFFICES OF xxx

xxxx x Street, Suite xxx

xxxxxxxx
PH:xx FAX:xxx
Re: Notice to Preserve Electronic Evidence
DEFENDANT:
CASE :
DOI :

ATTN:
This letter requests your immediate action to preserve electronically stored inf
ormation that may contain evidence important to the legal matter referenced abov
e. Our law firm represents Defendant xxxxx in a case currently pending at the xx
x Superior Court. _______________________are pursuing criminal charges stemming
from an incident on_____________________________ at _________________________. T
his evidence is tantamount to our client receiving a fair trial, as provided by
the constitution.
This notice applies to on- and off-site computer systems as well as any third-pa
rty data storage and management services. Removable ` electronic media plus all c
omputer systems, services, and devices (including all remote access and wireless
devices) as they would pertain to our client; This includes, but is not limite
d to, e-mail and other electronic communications; electronically stored document
s, records, images, graphics, recordings, spreadsheets, databases; calendars, sy
stem usage logs, contact manager information, telephone logs, internet usage fil
es, deleted files, cache files, user information, and other data. Further, this
notice applies to archives, backup and disaster recovery tapes, discs, drives, c
artridges, voicemail and other data. All operating systems, software, applicatio
ns, hardware, operating manuals, codes, keys and other support information neede
d to fully search, use, and access the electronically stored information must al
so be preserved.
The importance of immediate action cannot be overstated. Electronically stored i
nformation is easily corrupted, altered, and deleted in normal daily operations.
Even booting a drive, running an application, or reviewing a document can perma
nently alter evidence. An important method for preserving data in its original s
tate is to have a forensic image (mirror image or clone image) made of pertinent
hard drives of both office and home computers used for business and of network
servers. This image captures all current data, including the background or metad
ata about each document. Simply copying data to a CD-ROM or other common back- u
p medium is not adequate. For each captured image file, record and identify the
person creating the image and the date of creation. Secure the file to prevent s
ubsequent alteration or corruption and create a chain of custody log. Once the f
orensic data image file is created, the pertinent computer or other device can b
e placed back into operation. Most importantly all data input under the control
of PMK.
This preservation notice covers the above items and information gathered on DATE
SPECIFIC and referenced in report________ We ask that the above procedures are
followed to preserve electronic information created after this notice.
Current law and rules of civil procedure clearly apply to the discovery of elect
ronically stored information just as they apply to other evidence, and confirm t
he duty to preserve such information for discovery. the _________________departm
ent along with, their officers, employees, agents, and affiliated organizations
must take all reasonable steps to preserve this information until this legal mat
ter is finally resolved. Failure to take the necessary steps to preserve the inf
ormation addressed in this letter or other pertinent information in their posses
sion or control may result in serious sanctions or penalties.
Further, to properly fulfill the preservation obligation, stop all scheduled dat
a destruction, electronic shredding, rotation of backup tapes, and the sale, gif
t or destruction of hardware. Notify all individuals and affiliated organization
s of the need and duty to take the necessary affirmative steps to comply with th
e duty to preserve evidence.
Sincerely,