How to Preserve Text Messages and Chat Data for Litigation: Step by Step

Most of the evidence in a modern dispute is not on paper and not in email — it is in text messages and workplace chat, on devices and platforms that delete data on their own schedule. Preserving it is not complicated, but it is time-sensitive, and the window closes fast once a dispute is foreseeable. This guide walks through the six steps I use to preserve modern messaging data defensibly. For the reasoning behind why this data disappears, see the companion article on preserving chat data before a Florida lawsuit.

Step 1: Identify custodians and data sources

Start with people, not technology. List everyone whose communications are likely relevant, then map every place those people communicated about the matter: personal and company phones, workplace chat channels and direct messages, messaging apps, and shared cloud files. You cannot preserve a source you have not identified, and the sources people forget — a side WhatsApp thread, a personal phone used for work — are usually the ones that matter most.

Step 2: Recognize the trigger and act on it

The duty to preserve attaches when litigation is reasonably foreseeable, which is often the day a demand letter arrives — not the day a complaint is filed. Fix the date the duty attached and treat everything from that point forward as preservation time. Waiting for the lawsuit to be filed is, in almost every case, waiting until the most fragile evidence is already gone.

Step 3: Suspend every automated deletion

This is the step that saves cases. In writing, with whoever administers each system, suspend message auto-deletion in Slack, Teams, or Google Chat; turn off disappearing-message settings on the apps in scope; pause the offboarding process that wipes phones and deprovisions cloud accounts for departing custodians; and stop any phone setting that deletes older texts. Record what was suspended and when. Courts forgive a routine retention policy; they do not forgive the failure to switch it off once the duty attached.

Step 4: Collect in a way that preserves metadata

Preservation is not screenshots. Image the relevant phones forensically rather than photographing threads, because the metadata — timestamps, sender, message integrity — is what proves a message is authentic and unaltered. Export chat channels and direct messages in a format that keeps that metadata intact, and preserve the version history on shared cloud files, not just the current copy. Image departing-employee devices before they are reissued.

Step 5: Handle personal (BYOD) devices with care

When work communications live on employees' own phones, you cannot simply seize the device, but you still owe reasonable preservation. Send the custodians a clear written instruction not to delete anything relevant, and arrange a targeted collection of the work-related communications with their cooperation. Document the instruction and the cooperation. A bring-your-own-device arrangement that never planned for preservation is a gap best closed before a dispute, in a written policy.

Step 6: Document the chain of custody, then sign off

Every step above has to be provable later. Keep a written record of what was preserved, who preserved it, when, and how — the same record that becomes a sworn declaration if the other side questions your process. A defensible preservation is process, not luck: identify, suspend, collect, and document, in that order, with a paper trail at each stage.

When to get help

A small, contained dispute with one custodian and one phone can sometimes be preserved in-house. Once there are multiple custodians, workplace chat, ephemeral apps, or a departing employee in the mix, the cost of getting it wrong dwarfs the cost of doing it right. The firm's on-premises eDiscovery and preservation service runs this entire sequence — hold notice, suspension of deletion, and collection of texts, chat, and cloud data on firm-owned hardware in Jacksonville, Florida — with no cloud vendor in the chain of custody. Service details are at /ediscovery.