Should You Preserve First or Collect First?

You're facing a legal hold. Your counsel needs data within days. Your team asks: do we lock everything down or start pulling files right now?

The answer determines whether you'll defend your process in court or scramble to explain why critical evidence changed between the hold notice and production.

The Decision You're Facing

When litigation or a regulatory inquiry becomes reasonably foreseeable, you must choose how to sequence your response. This isn't just semantics. The order in which you preserve and collect affects your defensibility, costs, and exposure to spoliation claims.

Your choice breaks down to three paths:

• Preserve-then-collect: Issue holds, freeze data in place, then systematically gather what you need.
• Collect-then-preserve: Export files immediately and worry about ongoing changes later.
• Simultaneous preserve-and-collect: Lock down systems while pulling data in parallel.

Each path carries distinct compliance implications under Federal Rules of Civil Procedure Rule 37(e) and your industry-specific retention obligations.

Key Factors That Affect Your Choice

Scope clarity: If you know exactly which custodians and date ranges matter, collection can start quickly. If the matter involves broad claims or multiple business units, you need preservation coverage before narrowing your scope.

System volatility: Collaboration platforms, websites, and messaging tools change constantly. Email boxes fill and auto-delete. SharePoint versions overwrite. If your source systems modify data hourly, preservation must come first or you'll collect a snapshot that no longer matches the live environment.

Chain of custody requirements: Regulatory matters and high-stakes litigation demand proof that data remained unchanged from the triggering event through production. If you collect before preserving the source, you can't demonstrate that the exported files reflect the original state.

Data map completeness: Do you know where relevant information lives? Preservation begins when you reasonably expect litigation, and that obligation extends across all systems. If you lack a current data map, jumping to collection means you'll miss sources.

Path A: Preserve-Then-Collect (The Defensible Default)

Choose this path when:

• The matter scope is uncertain or likely to expand.
• You manage dynamic content (websites, collaboration tools, social media).
• You need to demonstrate an unbroken chain of custody.
• Routine deletion policies could eliminate relevant data before you finish scoping.

How it works:

Issue your legal hold and suspend routine deletion across all systems identified in your data map. Preservation applies to email servers, file shares, databases, and any platform where relevant information might exist. Your goal is to freeze data in its current state.

Once preservation is active, define your collection scope based on the claims, defenses, and key issues. Use that scope to identify specific custodians, date ranges, and search terms. Then collect systematically, maintaining metadata and context throughout.

What makes it defensible:

You can show that data remained unchanged from the moment the duty to preserve attached. A good collection process keeps data intact, preserving metadata and maintaining context. When opposing counsel questions whether files were altered, you point to your preservation timeline and documented holds.

Common mistakes to avoid:

Don't issue a hold that covers email but ignores Slack, Teams, or your corporate website. Don't assume that telling custodians "don't delete anything" constitutes technical preservation. Technology-assisted suspension of deletion policies is not optional for dynamic systems.

Path B: Collect-Then-Preserve (The High-Risk Shortcut)

Choose this path when:

• You face an immediate production deadline with a narrow, well-defined scope.
• The relevant data exists in static archives or closed systems.
• Collection itself effectively preserves the data (exported PST files, database snapshots).

How it works:

Export files and data immediately based on your initial understanding of the matter. Store the collected set in a secure repository. Issue preservation holds afterward to prevent future changes.

Why it's risky:

If the source systems continue to operate under normal retention policies, data that wasn't included in your initial collection may be deleted. You'll face questions about why you collected certain items but not others, and whether the collected data reflects the complete picture.

Worse, if your collection process alters files (stripping metadata, changing timestamps, breaking links between documents), you may face challenges about authenticity. You cannot demonstrate that the exported data matches what existed when your duty to preserve attached.

When it might work:

You're responding to a subpoena with a specific document request, and the requested files exist in a closed archive that no longer receives updates. Collection and preservation collapse into a single action because the source is already static.

Path C: Simultaneous Preserve-and-Collect (The Resource-Intensive Option)

Choose this path when:

• You have the technical capability to preserve and collect in parallel.
• The matter requires immediate production but also ongoing preservation.
• You're managing a rolling collection (new custodians added over time).

How it works:

Issue preservation holds across all relevant systems while simultaneously beginning targeted collection. Your preservation ensures that data outside your initial collection scope remains available. Your collection provides the files needed for early review and production.

Resource requirements:

This path demands coordination between legal, IT, and your eDiscovery team. You need technology that can preserve dynamic content (websites, collaboration platforms) while your team exports and processes static files (email, documents). You also need clear documentation showing which systems were preserved when, and which data was collected from each source.

What makes it defensible:

You demonstrate that preservation began immediately and covered all relevant sources, even those you didn't collect from right away. When the matter expands or new custodians are identified, you can show that their data was already under hold.

Summary Matrix

The preserve-then-collect sequence protects you when scope expands, custodians are added, or opposing counsel challenges your process. Collection without preservation leaves you explaining why data changed, disappeared, or wasn't included in the first place.

If you're uncertain which path fits your matter, default to preservation. You can always narrow your collection scope later, but you cannot reconstruct data that was deleted before you locked it down.