All parties to a lawsuit are supposed to preserve documents and data once they reasonably anticipate litigation. We all know that does not always happen. Hackers and data thieves try to cover their tracks, intentionally destroying relevant data. But sometimes it’s a crime of negligence, allowing valuable data to be written over in the ordinary course of business operations. When evidence is in genuine danger of being lost, one cannot wait until a Rule 26 conference to discuss how data were — or more likely were not — preserved.

Unfortunately, discovery often begins months, or even years, after a complaint is filed. There is a better way. Steps can be taken to preserve data, before the start of discovery and even before the commencement of litigation. Rule 26 may begin with a general prohibition against expedited discovery, but it in fact allows exceptions “authorized…by court order.” Because Rule 26(d)(1) does not outline the standard to allow these exceptions, more than 20 different standards have been developed over the years.

At one time, the most common test was derived from Notaro v. Koch, 95 F.R.D. 403 (S.D.N.Y. 1982). These courts held that expedited discovery was permitted in the event of irreparable injury; some probability of success on the merits; some connection between the expedited discovery and the avoidance of the irreparable injury; and some evidence that the injury that will result without expedited discovery looms greater than the injury that the party will suffer if the expedited relief is granted.

The courts that used this test conceived of expedited discovery as a form of extraordinary relief, and applied the same standard that would be used to grant a preliminary injunction. More recently, courts have moved away from this standard because it is too high and has no foundation in the text of the rule. In Ayyash v. Bank Al-Madina, 233 F.R.D. 325, 326-27 (S.D.N.Y. 2005), the court noted that the intention of the rules was to give the courts discretion, not to impose a specific, stringent test.


The Ayyash court applied a “flexible standard of reasonableness and good cause,” requiring a showing only of some specific reason why expedited discovery is sought. 233 F.R.D. at 327. Good cause has been found to exist when the passage of time may consume, alter or destroy the evidence sought. For example, in Physicians Interactive v. Lathian Systems, 2003 U.S. Dist. Lexis 22868 (E.D. Va. Dec. 5, 2003), the court noted that the electronic data — which evidenced the defendant’s hacking of plaintiff’s websites and theft of confidential customer lists and computer software codes — could be manipulated and erased. As a result, the court granted expedited discovery.

While not explicitly discussed by the court, it is worth noting that an individual who has the technical savvy to gain unauthorized access to someone else’s computer systems likely has the ability to destroy or muddle the evidence of that access. Also, hackers and other data thieves cannot plausibly argue that they are trustworthy enough to be allowed to preserve their own data without supervision. The determination whether to grant expedited discovery is highly fact-specific, and the more sophisticated and unsavory the adversary, the more reasonable it will be to grant the relief.

Courts also have found good cause to grant expedited discovery when a fraud may be committed on the court. In Ceglia v. Zuckerberg, 2012 WL 503810 (W.D.N.Y. 2012), the court confronted documents evidencing partial ownership of the social-networking site Facebook. Paul Ceglia purported to have emails and a 2003 contract entitling him to 50 percent of Facebook Inc. (in return for a $1,000 investment; Facebook chief executive officer Mark Zuckerberg called it a cut-and-paste forgery). The court granted expedited discovery to determine whether the documents were in fact forgeries and to prevent evidence tampering.

There is a developing trend of using preservation orders to quickly safeguard electronically stored information. Some courts considering such orders have applied an onerous Notaro-like standard. But in Treppel v. Biovail, 233 F.R.D. 363 (S.D.N.Y. 2006), the court adopted a more pragmatic balancing standard, requiring the moving party to demonstrate that the preservation order is necessary but not unduly burdensome. There are elements that differentiate the Treppel test from the “good cause” test for expedited discovery.

As the first part of the test requires a showing of necessity, the movant must demonstrate that the evidence is actually relevant. Even without evidence of intentional deletion, it may be sufficient to show that the opposing party has lost or destroyed evidence in the past or has inadequate retention procedures, especially if the moving party shows that the evidence is significant and harm would result from its loss. Finally, a court may enter a mirror-imaging order, either in conjunction with, or in place of, other motions.

Imaging can be an attractive option because it may be less expensive and disruptive than expedited discovery or a preservation order. Imaging effectively freezes all electronically stored information in place. Typically, an imaging order requires the party to preserve all of its data by engaging a vendor to make mirror images of all of the custodians’ hard drives — and potentially its servers and other loose media — and then designate a custodian to hold the images. If a party later suspects foul play involving deleted or lost information, the images are available as a data source.

Note, however, that typically the images are not automatically handed over to the other side, and the imaging order does not displace the traditional back-and-forth of document discovery. In any of these circumstances, parties are more likely to prevail in their motions if they narrowly tailor their requested relief. Blanket requests for all electronic data are more likely to be denied.


Evidence is most at risk for destruction before a complaint is filed, in part because of uncertainty over when the duty to preserve attaches and the lack of a clear indication about what evidence must be preserved. Although temporary restraining orders and preliminary injunctions can be considered, one option that does not require court intervention is a preservation letter. This serves the dual purpose of putting the potential adversary on notice of the relevance of its data and alerts it that litigation should reasonably be anticipated. When a party has been served with a preservation letter, courts may recognize that the duty to preserve has been triggered and impose sanctions for intentional, and even inadvertent, data destruction.

A potential pitfall in outlining specific preservation concerns, however, is that it could be interpreted as implied consent to destroy other evidence. The preservation letter must be carefully drafted so it does not impose undue burdens on the other side, but is broad enough to cover all potentially discoverable data.

Despite all these options, the best approach may be to talk to the adversary about agreeing to preserve the data. Negotiated agreements give the parties opportunity for creative accords that both sides can live with. For example, the parties can agree that a third-party vendor can make a mirror image of the data in question and hold it in escrow until discovery begins. Even when dealing with cutting-edge electronically stored information, old-fashioned communication with the adversary can be the quickest, easiest, cheapest and most effective course of action.

Judy Selby ( is a partner; Brian Esser ( is an associate; and Joshua Rog ( is a staff attorney in Baker & Hostetler’s New York office. They wrote this article for NLJ affiliate Law Technology News.