01 / TWO DUTIESDestroy on schedule, preserve on notice
Two obligations govern what an organization does with information it no longer uses, and they point in opposite directions.
The first is retention and disposal. A records retention schedule says how long each category of information is kept and when it is destroyed. Behind it sit legal and practical pressures that favor disposing of data once its purpose has ended: state data-disposal statutes that require records containing personal information to be destroyed when no longer needed, the storage limitation principle in the GDPR, regulators who treat over-retention as a security weakness, and the plain fact that data which no longer exists cannot be stolen. The IDScan brief is a recent illustration of what retention costs when it goes wrong.
The second is preservation. When litigation is pending or reasonably anticipated, or a government investigation is under way, an organization has a duty to preserve information that may be relevant to it. A legal hold is how that duty is put into practice: counsel identifies the matter, the people whose information is involved (the custodians), and the data sources, and instructs that routine destruction stop for that information until further notice.
These duties are not in conflict so long as each knows its limits. A hold suspends destruction only for what it covers, and only while it is in place; everything else continues on schedule. The problems arise in execution, and IT asset disposition is where execution happens.
02 / WHAT THE RULES SAYThe consequences of losing what should have been kept
In federal civil litigation, the governing provision for lost electronic information is Rule 37(e) of the Federal Rules of Civil Procedure, as amended in 2015. It applies when electronically stored information “that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery.” The rule then sets two tiers:
- Prejudice. On finding prejudice to another party from the loss, the court may order measures no greater than necessary to cure it.
- Intent to deprive. Only on finding that the party acted with intent to deprive another party of the information’s use may the court presume the information was unfavorable, instruct the jury that it may or must presume so, or dismiss the action or enter a default judgment.
Three features of the rule matter for disposal. The duty is triggered by anticipation, not only by a filed lawsuit, so a hold can be required before any complaint exists. The standard is reasonable steps, which puts the organization’s preservation process itself under examination. And the remedies scale with intent, which means an honest mistake is treated very differently from a deliberate one, but both begin with a loss that a process could have prevented.
State courts apply their own rules, which vary. Separately, a federal criminal statute, 18 U.S.C. § 1519, reaches the knowing destruction of records with intent to impede a federal investigation. Regulators and agencies may also issue preservation requests of their own. The specifics are counsel’s to apply; the operational point is that a hold, once issued, has to reach the hardware.
03 / WHERE IT GOES WRONGSix places holds and disposal collide
Most lost-data problems in this area are not deliberate. They happen because a routine process ran exactly as designed on a device nobody told it to skip.
- Offboarding. An employee leaves, the laptop is collected, and IT reimages it for the next hire within the week. If the employee was a custodian, the most relevant device in the matter has just been overwritten. The offboarding diagnostic covers how devices move at departure.
- Refresh waves. A fleet replacement retires hundreds of devices on a schedule set months earlier. Custodians’ machines are swept into the same destruction run as everyone else’s.
- Office moves and closures. Storerooms are emptied, and retired devices that were quietly being kept for a matter leave with the rest (the office move playbook and the closure checklist cover the sequencing).
- Data center decommissioning. Servers, storage arrays, and backup tapes holding older data are retired together, and backup media in particular often holds exactly what a hold covers (decommissioning checklist).
- Mergers and consolidations. An acquired company’s holds may not transfer cleanly into the acquirer’s systems before its equipment is consolidated or retired (M&A brief).
- Mobile devices. Phones are traded in through carrier programs, reset at upgrade, or never collected from departing staff, and text messages and chat apps are often the data a matter turns on.
One more boundary to keep in view: a hold on a device does not preserve the same custodian’s cloud mailbox, file storage, or collaboration data, which have their own hold mechanisms in those platforms. Device holds and cloud holds should be issued and released together.
04 / THE HOLD GATEA checkpoint every disposition passes through
The fix is not a new system so much as a translation layer and a checkpoint. In order:
- Legal maintains the active holds by matter, custodian, and data source, and issues hold and release notices in writing.
- IT or asset management translates custodians into devices. Using the asset register and device management records, each custodian’s laptops, phones, removable media, and relevant servers or backup sets are flagged by serial number. The hardware asset management guide covers keeping that register accurate.
- Every disposition passes the gate. Before any device is scheduled for sanitization, destruction, redeployment, resale, or trade-in, it is checked against the flags. The check is a required step in the workflow, not a reminder.
- Held devices are set aside, not processed. At counsel’s direction, a held device is either sealed, labeled, and stored under chain of custody until release, or forensically collected by a qualified professional so the data is preserved and the device can be released. An informal copy made by IT is not a substitute.
- Releases are documented. When counsel releases a hold, the flags are cleared in writing, and the devices re-enter normal disposition on the retention schedule, so the hold does not become indefinite retention by default.
- The check is recorded. The disposition record for each device notes that it was checked against active holds and cleared. That single field is often the most useful evidence the process produces.
05 / RECORDS THAT SHOW THE ROUTINEWhy the paperwork matters on both sides
Because Rule 37(e) turns on whether reasonable steps were taken, the records of a disposal program do double duty. Certificates of destruction tied to serial numbers, a retention schedule applied consistently, and a documented hold check on each disposition together show that destruction followed policy rather than a dispute. None of that guarantees any particular outcome, and none of it substitutes for preserving what should have been preserved. But an organization that can show what it destroyed, when, under which schedule, and after checking which holds, is in a far better position to explain any loss than one that can show only that equipment left the building.
06 / THE ITAD VENDOR’S ROLEWhat to ask of the provider
An ITAD provider should not make legal determinations, and should not be asked to. It should be able to:
- accept written hold and release instructions tied to specific serial numbers;
- quarantine flagged devices in sealed, access-controlled storage under chain of custody, and never destroy them on its own judgment;
- coordinate access for a forensic collection at counsel’s direction, on-site or at its facility;
- record the hold status on each device’s disposition record; and
- produce per-serial certificates for everything it does destroy, so the routine is documented.
CyberCrunch works this way with legal, records, and IT teams: held devices are segregated and stored under chain of custody until written release, and everything else is sanitized or destroyed under NIST SP 800-88 with a certificate per serial.
CyberCrunch Short · 0:30
ITAD for law firms, accounting and insurance
Old devices can still hold privileged client information. CyberCrunch picks up from every office on your schedule, tracks each device by serial number, destroys the data on site or at its facility, and issues a certificate of destruction.
Read the 30-second script
Client files don't retire with the laptop. Old devices can still hold privileged information. Meet CyberCrunch, for professional services. We pick up from every office, on your schedule. Every device is tracked by serial number. Data is destroyed on site or at our facility. With a certificate of destruction for your records. Backed by $10 million in cyber insurance. Retire the devices. Protect your clients.
07 / FAQLegal holds and disposal FAQ
Can we wipe a departing employee's laptop if they are a custodian in a legal hold?
Not until counsel says so. If the employee is named as a custodian, or their data falls within a hold's scope, the device should be pulled from the normal offboarding path before it is reimaged, redeployed, or sent for destruction. Counsel may direct a forensic collection by a qualified professional, after which the device can be released, or may direct that the device itself be preserved in sealed storage. Reimaging first and asking afterward is the most common way held data is lost in practice. This is not legal advice; preservation decisions belong with counsel.
Does a legal hold override our data retention schedule?
For the information the hold covers, yes, for as long as the hold is in place. A retention schedule sets the routine; a hold is an exception to it that suspends destruction of specific information relevant to a specific matter. Information outside the hold's scope continues on the normal schedule, which matters because keeping everything indefinitely creates its own security and legal exposure. When the hold is released, the held information returns to the schedule and should be disposed of on time like everything else.
What does Federal Rule of Civil Procedure 37(e) say about lost electronic data?
It applies when electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and the information cannot be restored or replaced through additional discovery. On a finding of prejudice to another party, the court may order measures no greater than necessary to cure the prejudice. Only on a finding that the party acted with intent to deprive another party of the information may the court presume it was unfavorable, instruct the jury that it may or must so presume, or dismiss the action or enter a default judgment. State courts apply their own rules.
Should a held device be imaged before it is destroyed?
Sometimes, and only at counsel's direction. A forensic collection performed by a qualified professional, with documented chain of custody and verification, can preserve the relevant data so the device itself can be released for disposal. An informal copy made by IT is usually not a substitute, because it may not capture everything the matter requires and may not be defensible. Where counsel prefers to preserve the device itself, it should be sealed, labeled, and stored under chain of custody until the hold is released.
Who should own the hold check before IT asset disposition?
Legal owns the holds; IT or asset management owns the translation from custodians to devices; and the check itself belongs in the disposition workflow, so no device can be scheduled for sanitization, destruction, redeployment, or resale without passing it. The ITAD vendor's role is to honor the flags: quarantine anything marked held, never destroy it on its own judgment, and accept written hold and release instructions. Vendors should not be asked to make legal determinations about what is covered.
PRESERVE WHAT’S HELD, DESTROY WHAT’S NOT
A disposition process that honors every hold
Serial-level hold flags, sealed chain-of-custody storage for held devices, documented releases, and NIST SP 800-88 certificates for everything else — from a provider certified to NAID AAA, R2v3, RIOS, and PA DEP, serving organizations across all 50 states.
This brief is general information reflecting public sources as of October 5, 2026, including Federal Rule of Civil Procedure 37(e) as amended effective December 1, 2015, and 18 U.S.C. § 1519. It describes preservation and retention practices at the pattern level and is not legal advice. CyberCrunch is not a law firm and does not make determinations about the scope or existence of a preservation duty; those decisions belong with your counsel. Preservation obligations vary by jurisdiction, forum, and matter, and state courts apply their own rules. CyberCrunch credential statements reflect certificates held at the time of publication.