How to Preserve Email Evidence: A Practical Guide for Attorneys and HR Professionals

Why Preservation Is the Most Important Step You Will Take

Before a single deposition is scheduled, before the first interrogatory is drafted, before you even know whether a case will settle or go to trial, one decision shapes everything that follows: how well you preserved the email evidence.

Knowing how to preserve email evidence is not optional knowledge for attorneys handling employment disputes, contract claims, or workplace investigations. It is a threshold competency. Get it right and you protect your client, control the narrative, and build credibility with the court. Get it wrong and you face sanctions, adverse inference instructions, or a case that collapses before it starts.

This guide walks through what preservation actually means in practice, the steps involved, the pitfalls that sink even experienced practitioners, and the tools that make the whole process manageable for smaller firms that do not have a dedicated eDiscovery department.

What "Preservation" Actually Means

Preservation is not just saving a copy of an email. It means suspending the normal processes that would otherwise cause that email to disappear: auto-delete schedules, email archiving purges, routine IT maintenance, and the simple human act of cleaning out an inbox.

Under Federal Rule of Civil Procedure 37(e), a party has a duty to preserve electronically stored information (ESI) once litigation is "reasonably anticipated." That phrase matters. The duty does not begin when a lawsuit is filed. It begins the moment a reasonable person in your client's position should have recognized that litigation was on the horizon, whether that is a termination letter, a cease-and-desist demand, a formal complaint, or even a heated internal email chain that signals a dispute is brewing.

For HR professionals, the same standard applies to internal investigations. If an employee files a complaint, the organization has an obligation to preserve relevant communications before those communications have a chance to age off the system.

Step 1: Issue a Legal Hold Notice Immediately

The first concrete action in any preservation effort is the legal hold notice, sometimes called a litigation hold or preservation notice. This is a written directive, typically from counsel, instructing specific custodians (the people who own or control relevant data) to stop deleting, modifying, or moving emails related to the matter at hand.

A good legal hold notice should:

• Identify the matter clearly
• Describe the categories of information that must be preserved (date ranges, subject matter, parties involved)
• Name the specific custodians who must comply
• Instruct recipients to suspend any auto-delete or archiving rules
• Explain how to flag or store preserved materials
• Provide a contact person for questions

Send the notice by email (ironic, but appropriate) and request a read receipt or confirmation reply. Document when it was sent, who received it, and when they acknowledged it. That documentation is your shield if a spoliation argument arises later.

For small firms without formal legal hold software, a well-drafted email with a clear subject line and logged confirmations is entirely sufficient at the outset.

Step 2: Identify the Right Custodians

One of the most common preservation mistakes is thinking too narrowly about who matters. Obvious custodians are easy: the plaintiff's direct supervisor, the HR director, the contract signatory. But email evidence in real disputes rarely stays in obvious places.

Think about who was CC'd on the key threads. Think about IT administrators who may have handled server-side processing. Think about assistants who scheduled meetings or forwarded messages. Think about outside parties, vendors, or clients who were looped into internal discussions.

For every major custodian, ask yourself: who else would have received or forwarded these emails? Expanding your custodian list early is far cheaper than discovering a gap during discovery.

Step 3: Protect the Metadata

Email content is only part of what courts care about. Metadata, the underlying technical information attached to every email, is often just as critical. Metadata includes:

• Exact timestamps (sent time, received time, read time)
• The originating IP address or device
• Message ID strings that allow threading across platforms
• Server routing headers that establish delivery path
• Modification timestamps that reveal whether content was altered

Forwarding an email does not preserve the original metadata. Printing an email to PDF often strips it entirely. Copying and pasting content into a new document destroys it.

To preserve metadata properly, emails must be exported in formats that retain it. The gold standards are .eml (single-message format) and .mst or .pst (for Microsoft Outlook archives). Many email platforms also support MBOX exports. Whatever format you use, the key rule is: do not alter the source data.

If you need to share, review, or annotate the emails, work from copies. The original preserved set should remain untouched from the moment it is collected.

Step 4: Suspend Auto-Delete and Archiving Rules

This is where well-intentioned IT teams can inadvertently destroy evidence. Most enterprise email systems run automated routines that purge messages after a set retention period, move emails to cold storage, or compress attachments.

Once a hold is in place, those routines must be suspended for the relevant custodians and date ranges. This requires coordination between legal or HR and the IT team, and that coordination needs to be documented.

If you are working with a client whose IT infrastructure is managed by a third-party vendor, get written confirmation from that vendor that preservation is in effect. A verbal agreement is not enough.

Cloud-based email systems like Google Workspace and Microsoft 365 have built-in legal hold and eDiscovery tools (Google Vault, Microsoft Compliance Center) that can freeze retention policies at the account level. If your client uses either platform, activating these tools should be one of your first calls.

Step 5: Create a Chronological Record

Preserving raw emails is necessary but not sufficient. Raw email exports are often thousands of disjointed messages that are nearly impossible to work with during preparation or trial. Converting that preserved data into a clear chronological record early in the process pays dividends at every later stage.

A proper email timeline:

• Sorts messages by actual sent/received timestamps (not import order)
• Groups related threads so context is visible
• Flags key messages for quick reference
• Preserves the metadata alongside the readable content
• Can be exported as a PDF for sharing with clients, co-counsel, or courts

This is exactly what ThreadLine was built to do. You import your preserved email thread (exported from Gmail, Outlook, or any IMAP-compatible system) and ThreadLine produces a clean, chronological record that surfaces the key messages, preserves the metadata, and gives you a shareable, court-ready document in minutes instead of hours.

Common Mistakes That Destroy Cases

Waiting until the complaint is filed. By the time a lawsuit lands on your desk, emails may already be gone. The duty to preserve begins when litigation is reasonably anticipated, not when it becomes certain.

Relying on the client to self-collect. Asking a client to "pull together the relevant emails" invites selection bias, accidental destruction, and chain-of-custody problems. Whenever possible, collections should be supervised or conducted by qualified professionals.

Forgetting mobile devices. Many employees conduct significant business communication from personal phones. If a custodian used a personal device or personal email account for work communications, those communications are potentially relevant and must be addressed in the hold notice.

Ignoring deleted mail. Deleted emails are frequently recoverable from server backups, mail archives, or mobile device caches. Failing to account for this in your preservation scope is a gap opposing counsel will exploit.

Not documenting the preservation effort. Courts evaluating spoliation claims want to see evidence that you took the duty seriously: when you issued the hold, who was notified, what systems were covered, and how compliance was verified. Build that record from day one.

A Quick-Reference Preservation Checklist

• Litigation trigger identified and dated
• Legal hold notice drafted and issued to all custodians
• Custodian acknowledgments received and logged
• Auto-delete and archiving rules suspended
• IT or cloud platform holds activated
• Metadata-preserving export initiated
• Mobile device and personal account scope addressed
• Preserved files stored in read-only, access-controlled location
• Chronological record created from preserved exports

Get Ahead of Discovery With the Right Tools

Preservation is the foundation. Everything that comes later, discovery requests, depositions, trial exhibits, depends on what you secure in these early hours and days.

The attorneys and HR professionals who handle this well share a common trait: they have a repeatable process. They are not improvising under pressure. They have a checklist, they know their tools, and they act fast.

If you are managing an active matter and need to turn preserved email exports into a clear, chronological record quickly, ThreadLine is built for exactly that workflow. Upload your export, and within minutes you have a clean timeline that you can share, annotate, and export to PDF.

Start your first timeline free at threadline.app. No credit card required.