AC468 Unit 9 Electronic Discovery Memo Example

Thirty Days of Sign-In Records: A Unit 9 Electronic Discovery Memo on What to Preserve and How Far to Collect

[Student Name]

Purdue University Global

AC468: Digital Forensics and Investigative Techniques

Unit 9 Electronic Discovery Memo

[Instructor Name]

[Date]

Belmonte Fine Foods, its staff and systems are composite; the rules, statute and case cited are real; this is coursework analysis, not legal advice.

Memorandum

To: General Counsel, Belmonte Fine Foods From: Forensic Accounting Examiner Date: April 8, 2026 Re: Preservation and collection scope, diverted supplier payment of $186,450

Deadlines That Cannot Wait

1. Tenant sign-in log: retained thirty days. Entries for March 17 are lost after April 16. Action: export the full log for March 1 to the present today and repeat weekly.

2. Departing employee's mailbox: the standard offboarding process deletes a mailbox thirty days after an account is disabled, which for the accounts payable lead would be May 3. Action: place a litigation hold on the mailbox now.

3. Unified audit log: retained ninety days under the current license, so January entries are already near expiry. Action: export January 1 to the present.

4. ERP change log: retained one year. No urgent action, but include it in the hold notice.

When the Duty to Preserve Began

The duty arose on April 2, when the genuine supplier wrote asking why its March invoice remained unpaid. From that moment litigation, against the employee, the bank or the supplier, was reasonably foreseeable. Courts have long held that a party must preserve relevant information once it reasonably anticipates litigation, and must suspend routine deletion to do so (Zubulake v. UBS Warburg LLC, 2003). The offboarding deletion and the log retention periods are exactly the kind of routine process that must be paused.

Custodians

Six people hold unique data, listed by how much: the accounts payable lead, whose laptop, flash drive and mailbox are already preserved; the accounts payable manager, who approved the vendor change; the controller, who released the wire; the IT manager, who collected the laptop and holds the tenant's administrative logs; the treasury clerk who received the bank's callback; and the receptionist who logs couriers, because the supplier's letter claims to have arrived by courier. Each receives a written hold notice and a short interview about where they keep work data.

Collection Scope

The laptop and flash drive images are complete. Still needed are the exports listed above, the ERP change log, the bank portal's user activity report and the phone system's call records for March 18, when the vendor change was supposedly confirmed by phone.

The Personal Phone

The accounts payable lead used a personal phone for work email and messaging. Belmonte does not own or control it, so it can be reached only by agreement or, in litigation, by a request the court finds proportional. Federal Rule of Civil Procedure 26(b)(1) weighs the importance of the issues, the amount in controversy, the parties' access to information, their resources, and whether the burden outweighs the likely benefit (Federal Rules of Civil Procedure, 2024). Here the phone's likely relevance is high, because a webmail session or a messaging conversation may sit only there. Against that, a full image reaches years of unrelated personal data.

The proportional answer is a targeted collection by a neutral examiner, limited to the webmail and messaging applications and to February 15 through April 3, rather than a full image the court is unlikely to order and the employee will resist.

Third Parties

The webmail provider, the domain registrar and the receiving bank hold records Belmonte cannot reach directly. The provider can disclose subscriber and connection records in response to a subpoena, but federal law generally bars it from disclosing message content to a civil litigant (Stored Communications Act, 2018). The registrar can disclose the account and payment method behind the lookalike domain. The receiving bank can disclose where the funds went next. Counsel should send preservation letters to all three now, before any subpoena issues.

Sanctions Exposure and Protocol

Rule 37(e) lets a court respond when electronically stored information is lost because a party did not act reasonably to keep it, and reserves the harshest responses for loss that was intended. Exporting the logs and holding the mailbox now keeps Belmonte well clear of that rule. Once a case is filed, the Rule 26(f) conference should set a written protocol for search terms, formats and the phone collection, and the parties should seek an order under Federal Rule of Evidence 502(d) so that inadvertently produced privileged documents can be clawed back.

This memo is coursework analysis prepared for AC468 and is not legal advice.

References

Federal Rules of Civil Procedure. (2024). Rule 26: Duty to disclose; general provisions governing discovery; and Rule 37: Failure to make disclosures or to cooperate in discovery; sanctions. U.S. Government Publishing Office.

Stored Communications Act, 18 U.S.C. §§ 2701-2713 (2018).

Zubulake v. UBS Warburg LLC, 220 F.R.D. 212 (S.D.N.Y. 2003).