Handling Sensitive Client Data in a Forensic Collection Without Risking Spoliation

A forensic collection of a client’s cellphone or other data source often captures potentially responsive communications alongside substantial amounts of personal information unrelated to the litigation. A cellphone may contain years of private messages and photographs, medical and financial information, family discussions, location data, and communications involving third parties with no connection to the case. The scope of information available on cellphones makes forensic collection fundamentally different from the collection of discrete business records.

The Supreme Court recognized this distinction in Riley v. California, 573 U.S. 373, 393–97 (2014), explaining that the immense storage capacity of modern cellphones creates privacy concerns that are both quantitative and qualitative. A cellphone may collect many distinct categories of information, retain years of historical data, and provide a detailed record of nearly every aspect of its user’s life. Although Riley arose in the Fourth Amendment context, the court’s analysis illustrates the significant privacy concerns implicated when a forensic collection captures the contents of a personal device.

This raises an important question: Once a law firm or its vendor collects sensitive but plainly irrelevant information from a client’s device, may the firm delete it? Generally, the information should not be deleted from the preserved forensic image. Collection alone does not make information discoverable, but deleting data from the evidentiary source may create preservation, authentication, and chain-of-custody issues. Law firms must therefore find a way to preserve the evidentiary source without unnecessarily retaining, circulating, or exposing private photographs, text messages, and other personal material that is plainly unrelated to the case. The key is to distinguish between preserving the original forensic image and determining what information should be available for review. The firm may exclude plainly irrelevant personal information from the review population and restrict access to it without altering the original forensic image. This approach protects private information while preserving the integrity of the collected source. Excluding personal information from review, however, is different from deleting it from the preserved forensic image. Whether deletion is ever appropriate requires consideration of the firm’s preservation obligations and the risk of spoliation.

When Does Deletion Become Spoliation?

Intentionally deleting information from a preserved forensic image does not necessarily constitute spoliation. The analysis begins with whether the information was subject to a duty to preserve. Federal Rule of Civil Procedure 37(e) applies when ESI that should have been preserved in anticipation or conduct of litigation is lost because reasonable steps were not taken to preserve it and the information cannot be restored or replaced through additional discovery. The U.S. Court of Appeals for the Third Circuit’s general spoliation framework requires that the evidence be within the party’s control, relevant to the claims or defenses, actually suppressed or withheld, and subject to a reasonably foreseeable duty to preserve. See Bull v. United Parcel Service, 665 F.3d 68, 73 (3d Cir. 2012). Accordingly, deleting plainly irrelevant personal information does not necessarily constitute spoliation.

The practical problem is not whether obviously unrelated private communications or photographs are discoverable. The problem is whether the firm should alter a preserved forensic image based on its unilateral determination that the information will never be relevant. If that decision is later questioned, counsel may need to show what was deleted, the basis for the deletion, who authorized it, and whether the deletion affected associated relevant data. Preserving the original image while restricting access avoids that dispute.

Counsel’s ethical obligations provide an additional reason for caution. Pennsylvania Rule of Professional Conduct 3.4 prohibits a lawyer from unlawfully obstructing access to evidence or unlawfully altering, destroying, or concealing material having potential evidentiary value. Even if sensitive personal information ultimately proves nonresponsive, modifying the forensic image may create the appearance that counsel altered the evidentiary record.

Privacy After Collection

Preserving a complete forensic image does not require unrestricted access to everything it contains. Although the recent decision in Dodd v. Hendrickson USA, 349 F.R.D. 286, 308–13 (W.D. Ky. 2025), addressed whether a forensic collection should be permitted, the decision illustrates why those concerns do not disappear once the collection is completed. The court recognized that some location data on the plaintiff’s cellphone was relevant but nevertheless declined to compel a full forensic image because of the risk of exposing unrelated private information. The court emphasized that relevance alone does not justify such an intrusive collection and that mere skepticism about the completeness of a production is insufficient to require forensic imaging.

Once a forensic collection has occurred, the principal concern shifts to protecting the unrelated private information captured with it. Law firms should determine where the unaltered collection will be maintained, who can access it, whether the vendor can isolate particular applications or categories of data, and whether the material must be loaded into the review platform at all.

The firm should also limit access to the unfiltered collection to those who need it for collection, review, or quality control. The firm should consider disabling unrestricted downloads, limiting exports, and requiring approval before any personal content is copied from the collection. If highly personal material must be examined, that review should be assigned to a small review team rather than the general document-review population.

Law Firm Policy

Law firms that regularly conduct forensic collections should have a policy governing how personal information captured during those collections will be handled. Counsel should advise the client that imaging a personal device may capture unrelated private content and explain who will receive the collection, how it will be filtered, and how long it will be retained. The custodian interview should identify data sources likely to contain highly personal information so that counsel can determine whether a targeted collection is appropriate.

The policy should distinguish the preserved forensic image from the filtered review population. It should prohibit ad hoc deletion from the preserved image while limiting access to that image.It should identify who may authorize promotion of material into the review platform, who may review highly personal content, and how exclusion decisions will be documented. The policy should also prohibit personnel from downloading, forwarding, discussing, or retaining copies of personal material outside the approved environment.

Law firms should also adopt a defined retention process. Unnecessary copies should be deleted when they are no longer needed, provided the original forensic image remains intact. Final destruction of the forensic image should occur only after counsel confirms that the preservation duty has ended. Destruction should be documented and coordinated across the firm, vendor, review platform, experts and any other recipients. Together, these procedures allow the firm to protect sensitive client information without compromising the integrity of the preserved evidence.

Kelly A. Lavelle is senior counsel at Kang Haggerty. She focuses on e-discovery and information management, from preservation and collection to review and production of large volumes of electronically stored information. Contact her at klavelle@kanghaggerty.com.