Digital Evidence Discovery Requests: What to Ask For and How
Most discovery requests for digital evidence are too broad to be enforceable and too vague to be useful.
“All electronic communications” gets you a fight. A targeted request for specific device data from a defined time period gets you results.
Here’s how to approach digital evidence discovery in a way that actually surfaces what you need.
Start With a Forensic Consultation Before Drafting Requests
Before you write a single discovery request, talk to a forensic examiner.
An examiner can tell you:
Ten minutes with an examiner before drafting can save weeks of fighting about production format and scope.
Categories of Digital Evidence to Request
Smartphone Data
Request production of:
Specify the time period and insist on forensically extracted data, not screenshots or self-collected exports.
Cloud Account Data
Request:
Subpoena directly to the cloud provider if the opposing party is unlikely to produce completely.
Request:
Computer Data
If computers are at issue:
How to Phrase Discovery Requests That Work
Avoid:
“Produce all electronic communications from any device.”
This is overbroad, will draw objections, and doesn’t tell opposing counsel (or their IT department) what format to produce in.
Use instead:
“Produce all SMS, iMessage, WhatsApp, and Facebook Messenger communications from [Party’s] primary smartphone(s) between [start date] and [end date], produced as a forensic extraction in UFDR format or as a PDF export with timestamps and sender/recipient metadata intact, with hash values documented.”
The more specific the request, the harder it is to claim they don’t know what you’re asking for.
Requesting Forensic Examination of the Opposing Party’s Device
When self-collection isn’t enough — and it usually isn’t for smartphones — you can request court-ordered forensic examination of the opposing party’s device.
Your motion should include:
Courts routinely grant these motions in civil litigation when there’s good cause. The key is specificity — vague motions asking to “examine the phone” get denied; motions with a defined protocol and justification get granted.
Handling ESI Protocols in Digital Forensics Cases
If the case involves significant digital evidence, negotiate an ESI (Electronically Stored Information) protocol early.
The protocol should address:
An agreed ESI protocol cuts motion practice significantly. Courts love them. Get a forensic examiner involved in drafting.
Preservation Letters and Litigation Holds
Before any formal discovery request, send a litigation hold letter demanding the opposing party preserve all potentially relevant digital evidence.
Be specific: “You are directed to preserve all electronic communications, including but not limited to SMS, iMessage, WhatsApp, and email, stored on any personal or business device used to communicate with [party/topic], for the period [date range].”
Then send one to any cloud providers who may have relevant data. Most providers have legal process portals for these requests.
Document when the hold letter was sent and received. If evidence is destroyed after that date, you have a spoliation argument.
FAQ
Can I subpoena iMessage content directly from Apple?
No. Apple’s iMessage uses end-to-end encryption. Apple cannot produce iMessage content because they don’t have it. You must obtain messages from the device itself or from an iCloud backup (which stores some iMessage data depending on backup settings).
What if the opposing party claims they don’t have the phone anymore?
“I lost it” or “I traded it in” after litigation was foreseeable is a spoliation issue, not a dead end. Subpoena the carrier for metadata. Request iCloud backup records from Apple. Get cell tower records. The conversation exists in multiple places.
How long do courts give parties to produce forensic data?
Standard discovery deadlines (30 days) are usually unrealistic for forensic productions. Courts regularly allow 60-90 days for device examinations. Build this into your scheduling order from the start.
Work With a Forensic Examiner Who Handles Discovery
Octo Digital Forensics consults with attorneys on discovery strategy and performs court-ordered device examinations in San Diego.
We also draft examination protocols and prepare expert declarations in support of forensic discovery motions.
Visit octodf.com or call 858-692-3306.
See also: Community Property Digital Evidence | Divorce Digital Evidence | Spoliation Preservation Letters Digital Evidence
Need Professional Digital Forensics?
Octo Digital Forensics provides expert mobile forensics, data recovery, and digital investigation services for attorneys, insurance companies, and private investigators. Court-admissible reports. Certified examiners.
Contact: octodf.com | info@derickdowns.com | (858) 692-3306
