All parties to a lawsuit are supposed to preserve documents and data once they reasonably anticipate litigation. We all know that does not always happen. Hackers and data thieves try to cover their tracks, intentionally destroying relevant data. But sometimes it’s a crime of negligence, allowing valuable data to be written over in the ordinary course of business operations.

When evidence is in genuine danger of being lost, you cannot wait until a Rule 26 conference to discuss how data was—or more likely was not—preserved.

Unfortunately discovery often begins months, or even years, after a complaint is filed. There is a better way. Steps can be taken to preserve data, prior to the start of discovery, and even prior to the commencement of litigation. Rule 26 may begin with a general prohibition against expedited discovery, but it in fact allows exceptions “authorized … by court order.” Because Rule 26(d)(1) does not outline the standard to allow these exceptions, more than 20 different standards have been developed over the years.

At one time, the most common test was derived from Notaro v. Koch, 95 F.R.D. 403 (S.D.N.Y. 1982). These courts held that expedited discovery was permitted in the event of: 1) irreparable injury, 2) some probability of success on the merits, 3) some connection between the expedited discovery and the avoidance of the irreparable injury, and 4) some evidence that the injury that will result without expedited discovery looms greater than the injury that the [party] will suffer if the expedited relief is granted.

The courts that used this test conceived of expedited discovery as a form of extraordinary relief, and applied the same standard that would be used to grant a preliminary injunction. More recently, courts have moved away from this standard, because it is too high and has no foundation in the text of the rule. In Ayyash v. Bank Al-Madina, 233 F.R.D. 325, 326-27 (S.D.N.Y. 2005), the court noted that the intention of the rules was to give the courts discretion, not to impose a specific, stringent test.

The Ayyash court applied a “flexible standard of reasonableness and good cause,” requiring a showing of only some specific reason why expedited discovery is sought. Ayyash, 233 F.R.D. at 327. Good cause has been found to exist where the passage of time may consume, alter or destroy the evidence sought. For example in Physicians Interactive v. Lathian Systems, 2003 U.S. Dist. LEXIS 22868 (E.D. Va. Dec. 5, 2003), the court noted the electronic data—which evidenced the defendant’s hacking of plaintiff’s websites and theft of confidential customer lists and computer software codes—could be manipulated and erased. As a result, the court granted expedited discovery.

While not explicitly discussed by the court, it is worth noting that an individual who has the technical savvy to gain unauthorized access to someone else’s computer systems likely has the ability to destroy or muddle the evidence of that access. Also, hackers and other data thieves cannot plausibly argue that they are trustworthy enough to be allowed to preserve their own data without supervision. The determination whether to grant expedited discovery is highly fact-specific, and the more sophisticated and unsavory your adversary, the more reasonable it will be to grant the relief.

Courts also have found good cause to grant expedited discovery when a fraud may be committed on the court. In Ceglia v. Zuckerberg, 2012 WL 503810 (W.D.N.Y. 2012), the court confronted purportedly forged documents evidencing partial ownership of the social networking site Facebook. Ceglia purported to have emails and a 2003 contract entitling him to 50 percent of Facebook (in return for a $1,000 investment; Zuckerberg responded calling it a cut-and-paste job). The court granted expedited discovery to determine whether the documents were in fact forgeries and to prevent evidence tampering.

Preservation and imaging orders

There is a developing trend of using preservation orders to quickly safeguard electronically stored information. Some courts considering such orders have applied an onerous Notaro-like standard. But in Treppel v. Biovail, 233.F.R.D. 363 (S.D.N.Y. 2006), the court adopted a more pragmatic balancing standard, requiring the moving party to demonstrate that the preservation order is necessary, but not unduly burdensome. There are elements that differentiate the Treppel test from the “good cause” test for expedited discovery.

As the first part of the test requires a showing of necessity, there is a requirement that the movant demonstrate that the evidence is actually relevant. Even without evidence of intentional deletion, it may be sufficient to show that the opposing party has lost or destroyed evidence in the past or has inadequate retention procedures, especially if the moving party shows that the evidence is significant and harm would result from its loss. Finally, a court may enter a mirror imaging order, either in conjunction with or in place of other motions.

Imaging can be an attractive option because it may be less expensive and disruptive than expedited discovery or a preservation order. Imaging effectively freezes all ESI in place. Typically an imaging order requires the party to preserve all of its ESI by engaging a vendor to make mirror images of all of the custodians’ hard drives—and potentially its servers and other loose media—and then designate a custodian to hold the images. If you later suspect foul play involving deleted or lost information, the images are available as a data source.

Note, however, that typically the images are not automatically handed over to the other side, and the imaging order does not displace the traditional back and forth of document discovery. In any of these circumstances, parties are more likely to prevail in their motions if their requested relief is narrowly tailored. Blanket requests for all electronic data are more likely to be denied.

Before the complaint

Evidence is most at risk for destruction before a complaint is filed, in part because of uncertainty over when the duty to preserve attaches and the lack of a clear indication about what evidence must be preserved. Although temporary restraining orders and preliminary injunctions can be considered, one option that does not require court intervention is a preservation letter. This serves the dual purpose of putting the potential adversary on notice of the relevance of their data and alerts them that litigation should reasonably be anticipated. When a party has been served with a preservation letter, courts may recognize that the duty to preserve has been triggered and impose sanctions for intentional, and even inadvertent, data destruction.

A potential pitfall in outlining specific preservation concerns, however, is that it could be interpreted as implied consent to destroy other evidence. Your preservation letter must be carefully drafted so it does not impose undue burdens on the other side, but also is broad enough to cover all potentially discoverable data.

Agreement with counsel

Despite all these options, the best approach may be to talk to your adversary about agreeing to preserve the data. Negotiated agreements give the parties opportunity for creative accords that both sides can live with. For example, the parties can agree that a third-party vendor can make a mirror image of the data in question and hold it in escrow until discovery begins. Even when dealing with cutting-edge ESI, old-fashioned communication with your adversary can be the quickest, easiest, cheapest and most effective course of action.

At Baker Hostetler, Judy Selby ( is a partner; Brian Esser ( is an associate; and Joshua Rog ( is a staff attorney. They are based in New York City.