When a dispute, workplace incident, family matter, injury claim, or suspected misconduct first comes to light, people often focus on what happened. The more immediate investigative question is frequently more basic:
What evidence might disappear before anyone has a chance to preserve it?
Phones update. Messages are deleted. Cloud accounts synchronize across devices. Email retention policies run automatically. Security footage may overwrite itself. A device may be reset, damaged, traded in, or accessed by multiple people. Even well-intentioned handling can change timestamps, alter account activity, or make it difficult to explain how a file was obtained.
For legal professionals, businesses, and private clients in the Dallas-Fort Worth Metroplex, the first 24 hours can determine whether digital evidence remains reliable and usable: or becomes incomplete, disputed, or unavailable.
This article focuses on lawful digital evidence preservation, not unauthorized access, surveillance of private accounts, or analysis of someone else’s device without proper authority. Preservation is about preventing loss, documenting the original condition, and maintaining a defensible record of what happened to the evidence from the moment it was identified.
Why the First 24 Hours Matter
Digital evidence is often temporary by design. Many systems are configured to delete or overwrite information on a schedule. Examples include:
- Text messages deleted by a user or removed through an automatic setting
- Cloud files replaced by newer versions
- Email accounts subject to retention or archiving rules
- Workplace chat messages removed after a set period
- Doorbell, building, vehicle, or security-camera footage overwritten
- Device backups replaced during the next synchronization
- Location, access, or login records retained for only a limited time
- Social media content changed, restricted, or removed
Texas preservation obligations can become important when a party knows or reasonably should know that litigation is a substantial possibility and that evidence may be relevant. That does not mean every disagreement automatically requires a formal litigation hold. It does mean that once a serious claim, investigation, or proceeding is reasonably foreseeable, ignoring known sources of potentially relevant evidence can create avoidable problems.
A practical first step is to identify the likely evidence sources and stop routine deletion while the matter is evaluated by appropriate legal professionals.
The National Institute of Standards and Technology’s guidance on digital evidence preservation emphasizes the importance of preserving digital information in a way that protects its integrity and documents how it was handled. The same principle applies whether the matter involves a Dallas business, a Fort Worth workplace, a family dispute in Collin County, or a civil claim elsewhere in Texas.
Step One: Identify Every Potential Source
The first mistake in many investigations is looking only at the most obvious device. A relevant message may exist in several places, while the information needed to establish timing or authenticity may be stored somewhere else.
Potential sources may include:
Personal and company devices
- Smartphones
- Tablets
- Desktop computers
- Company-issued laptops
- External hard drives
- USB storage
- Smartwatches
- Vehicle infotainment or telematics systems
- Building access devices
Accounts and services
- Email accounts
- Cloud storage
- Collaboration platforms
- Text-messaging backups
- Social media accounts
- Workplace messaging applications
- Customer relationship systems
- Payroll or scheduling platforms
- Security-camera systems
- Online file-sharing services
Supporting records
- Device photographs
- Call logs
- Account access records
- Login history
- File-creation and modification information
- Message delivery and read-status information
- Calendar entries
- Location records
- Backup records
- System-generated audit logs
The goal at this stage is not to read everything or decide what the evidence means. The goal is to create a preservation map: what exists, where it exists, who controls it, and how quickly it could be lost.
For a business, that map may require coordination with information-technology personnel, a managed-service provider, a cloud administrator, human resources, and the employees or contractors who possess relevant devices.
For a private client, it may involve identifying a phone, computer, email account, cloud backup, shared tablet, or messaging account that contains relevant information. Do not assume that a screenshot on one device is the complete record.
Step Two: Stop Routine Deletion Lawfully
Once potentially relevant sources are identified, the next priority is to prevent routine deletion or alteration.
A business may need to issue a written preservation notice or litigation hold to relevant custodians. The notice should identify the general subject matter, the time period, the people involved, and the types of information that must be retained. It should also explain that employees must not delete, edit, overwrite, or dispose of potentially relevant information.
Depending on the circumstances, a hold may need to address:
- Email and attachments
- Text messages
- Workplace chats
- Shared documents
- Personal devices used for company business
- Cloud folders
- Social media communications
- Project-management records
- Security footage
- Computer and network logs
- Voicemail and call records
The notice should be tailored. An overly broad request may be difficult to follow, while an overly narrow request may fail to preserve important evidence.
Businesses should also ask their technology personnel whether automated deletion, account deactivation, backup rotation, or device-replacement procedures need to be suspended. A departing employee’s account, for example, may be scheduled for deletion shortly after separation. A workplace chat platform may retain messages for only a limited time. A surveillance system may automatically record over older footage.
For service-provider records in a criminal investigation, Texas law provides specific preservation mechanisms. Texas Code of Criminal Procedure Article 24A.051 addresses preservation requests to online service providers. The correct process depends on the type of matter and the authority of the requesting party, so legal counsel should determine what notices, subpoenas, orders, or warrants are appropriate.
Private clients should not attempt to access another person’s cloud account, phone, messages, or social media account by guessing passwords, using stored credentials without permission, installing monitoring software, or bypassing security protections. Lawful preservation is fundamentally different from unauthorized access.
Step Three: Handle Phones Carefully
Phones contain some of the most valuable and fragile evidence in a modern investigation. They may hold messages, call records, photographs, videos, location information, application data, and account connections. They may also be configured to synchronize, delete, or change information automatically.
If you have lawful possession of a potentially relevant phone, document its condition before making changes. Record:
- Whether the phone is powered on or off
- Whether it is locked or unlocked
- What is visible on the screen
- The date and time displayed
- Battery level
- Wi-Fi, cellular, Bluetooth, or other connection status
- Notifications that are visible
- Whether accessories or storage cards are attached
- The location where the device was found or received
- The person who delivered or secured it
Photographs of the device and screen can help establish its initial condition. Notes should be factual and contemporaneous rather than based on memory several days later.
Avoid opening applications, scrolling through conversations, sending messages, changing settings, deleting content, or updating the operating system. Even ordinary actions can change access times, synchronize content, trigger deletions, or affect the device’s state.
Network isolation may be appropriate in some situations to reduce the possibility of remote wiping or synchronization. However, the correct method depends on the device, the legal authority involved, and the preservation objective. Airplane mode, powering down, or placing a device in a signal-blocking container can have different consequences. A qualified digital-evidence professional should make that decision when the stakes are significant.
In law-enforcement matters, phone searches generally require appropriate legal authority, such as a warrant or valid consent. The Texas Department of Public Safety Crime Laboratory’s digital and multimedia evidence information provides useful context regarding the handling and submission of digital evidence. Civil investigations have different procedures, and private investigators should work within consent, discovery, subpoena, court-order, and other applicable legal boundaries.
Step Four: Preserve Complete Messages and Metadata
A screenshot can be useful, but it is rarely the entire evidentiary record.
A screenshot may not show:
- The complete conversation
- The account identifier
- The sender and recipient information
- The original date and time
- The device or application involved
- Whether content was edited or deleted
- Attached files or embedded media
- Delivery or read-status information
- The surrounding messages that provide context
Whenever possible, preserve the complete conversation and retain the original or native data format. For email, preserve full messages with headers and attachments rather than copying only the visible text. For text messages and application-based chats, preserve the full thread and relevant account or device context.
Metadata can be just as important as the visible content. Depending on the evidence source, metadata may help show:
- When a file was created or modified
- When a message was sent or received
- Which account or device was involved
- Whether a file was moved or renamed
- Whether a photograph contains original capture information
- When a user logged in or accessed a system
- Whether a document was replaced by a later version
Metadata is not automatically conclusive. Device clocks may be inaccurate, systems may use different time zones, and cloud services may record several different timestamps for the same event. That is why preservation should capture the surrounding context rather than relying on a single displayed time.
The objective is not to make the evidence look perfect. It is to preserve the record honestly and document its limitations.
Step Five: Document Chain of Custody From the Beginning
Chain of custody is not merely a form completed at the end of an investigation. It begins when someone first identifies, receives, photographs, copies, moves, or secures the evidence.
A useful chain-of-custody record should identify:
- What the item or data source is
- Where it was found or obtained
- Who possessed it initially
- The date and time it was secured
- Its condition when received
- Who handled it afterward
- Why each transfer or access occurred
- Where it was stored
- What preservation or acquisition process was used
- What copy, image, export, or hash was created
For physical devices, record serial numbers, identifying marks, model information, storage media, and visible damage. For electronic collections, document the account, system, date range, collection method, software or tool used, and storage location.
When a forensic image or export is created, the original should be protected and subsequent review should generally occur on a working copy. Hash values can help verify that a file or image has not changed after acquisition. Access logs and controlled storage provide additional support.
A chain-of-custody record does not guarantee that evidence will be admitted. It does, however, give legal professionals and decision-makers a clear explanation of how the evidence was preserved and whether it remained consistent over time.
What Businesses Should Do During the First Day
When a business learns of a suspected data theft, employee misconduct, workplace incident, contract dispute, or threatened claim, management should avoid an informal approach that depends on employees “saving what looks important.”
A more reliable first-day response includes:
- Designating a responsible preservation coordinator
- Identifying relevant custodians and systems
- Notifying legal and technology personnel
- Suspending relevant automated deletion
- Preserving company-owned devices
- Addressing personal devices used for business communications
- Securing surveillance video and access records
- Documenting the date and reason for the preservation effort
- Restricting unnecessary access to the evidence
- Separating preservation from later analysis
Businesses in Dallas, Fort Worth, Plano, Frisco, Arlington, Irving, Richardson, and throughout the DFW region may have evidence distributed across multiple offices, remote workers, vendors, and cloud platforms. A preservation plan should account for those locations and relationships.
What Private Clients Should Do
Private clients facing a family dispute, injury claim, suspected fraud, property conflict, or other serious matter should preserve their own information without manipulating it.
Practical steps include:
- Keep the original phone, computer, or storage device
- Do not factory-reset or trade in a potentially relevant device
- Preserve complete conversations instead of isolated screenshots
- Save original emails and attachments
- Avoid editing photographs, recordings, or documents
- Write down when and how evidence was received
- Preserve relevant cloud backups
- Do not access another person’s account without permission or proper legal authority
- Contact appropriate legal and investigative professionals promptly
If a device may contain evidence belonging to someone else, do not explore it casually. Secure it, document its condition, and obtain guidance before accessing its contents.
How Armstrong Investigations, PLLC Can Help
Digital evidence preservation often benefits from coordinated investigative support before the facts become more difficult to reconstruct. Armstrong Investigations, PLLC works with legal professionals, businesses, and private clients across the DFW Metroplex and North Texas to organize investigative assignments around clear objectives, lawful methods, and documented results.
Our work may include identifying potential evidence sources, documenting devices and records, coordinating preservation steps, supporting lawful collection, organizing timelines, and maintaining clear investigative documentation. Preservation is not the same as interpreting every piece of data, and it should not be confused with unauthorized account access. The purpose is to protect potentially relevant information so that qualified decision-makers can evaluate it later.
Our strategic intelligence services for legal professionals reflect the importance of building investigative files that can withstand scrutiny. Our technology-focused investigative approach also recognizes that modern cases may involve both physical and digital evidence.
Jasen A. Armstrong, J.D., brings a legal background from Oklahoma City University School of Law to the firm’s investigative planning and documentation standards. Armstrong Investigations, PLLC provides private investigation services and does not provide legal advice or legal representation. Legal professionals should determine the appropriate preservation obligations, legal process, and discovery strategy for a specific matter.
Whether the matter arises in Dallas County, Tarrant County, Collin County, Denton County, Rockwall County, Ellis County, Kaufman County, or Johnson County, prompt preservation can protect the integrity of the investigation.
The first 24 hours are not about rushing to conclusions. They are about preventing avoidable loss, documenting what exists, and preserving the evidence in a way that can be explained later.
Jasen A. Armstrong, J.D.
Armstrong Investigations, PLLC
P: 214-851-3800 | W: armstronginvestigations.com
Texas DPS Lic. #: 166353101 | Affiliated with TCS Consulting (TX DPS Lic. #: C20493) & Howard Law, PLLC