[{"data":1,"prerenderedAt":645},["ShallowReactive",2],{"tag-litigation-hold":3},[4],{"_path":5,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9,"description":10,"slug":11,"date":12,"lastUpdated":12,"author":13,"readingTime":14,"category":15,"tags":16,"ogImage":22,"featured":7,"body":23,"_type":639,"_id":640,"_source":641,"_file":642,"_stem":643,"_extension":644},"\u002Farticles\u002F30-preserving-crypto-native-esi","articles",false,"","Preserving crypto-native ESI before it disappears","Preserve crypto-native evidence before it disappears: wallets, devices, exchange records, and browser data, with a defensible hold and Rule 37(e) context.","preserving-crypto-native-esi","2026-07-04","Nick Kampe",12,"Methodology",[17,18,19,20,21],"e-discovery","litigation-hold","spoliation","evidence-preservation","wallet","\u002Fog\u002Fpreserving-crypto-native-esi.png",{"type":24,"children":25,"toc":611},"root",[26,34,56,63,68,106,112,127,141,146,152,165,170,193,214,220,250,255,288,294,301,306,312,317,323,328,334,339,345,359,365,379,393,398,404,410,462,468,496,502,515,521,527,538,544,553,559,568,574,583,589,598],{"type":27,"tag":28,"props":29,"children":30},"element","p",{},[31],{"type":32,"value":33},"text","A wallet's transaction history can outlive the apps that produced it, but the evidence that gives it meaning rarely does: the wallet app, the browser extension, the exchange dashboard, the signed message, the device clock. This is crypto-native ESI: it exists only in software, with no paper equivalent. The public ledger may persist for decades; the context needed to interpret control, intent, and application state can disappear within days of a party learning they are under scrutiny.",{"type":27,"tag":28,"props":35,"children":36},{},[37,39,46,48,54],{"type":32,"value":38},"That ephemerality is the operational question: when the preservation duty attaches, what must be saved, in what order, and how, without mishandling private keys? ",{"type":27,"tag":40,"props":41,"children":43},"a",{"href":42},"\u002Fresources\u002Fcommon-mistakes-crypto-investigations",[44],{"type":32,"value":45},"Common Mistakes in Cryptocurrency Investigations",{"type":32,"value":47}," catalogs errors that compromise a case, and ",{"type":27,"tag":40,"props":49,"children":51},{"href":50},"\u002Fresources\u002Fself-custody-vs-custodial-wallets",[52],{"type":32,"value":53},"Self-Custody vs. Custodial Wallets",{"type":32,"value":55}," maps the evidence profile of each custody model; this article supplies the affirmative workflow both skip. The frame is U.S. federal civil practice; state courts, regulatory proceedings, and criminal matters apply different standards.",{"type":27,"tag":57,"props":58,"children":60},"h2",{"id":59},"what-counts-as-crypto-native-esi",[61],{"type":32,"value":62},"What Counts as Crypto-Native ESI",{"type":27,"tag":28,"props":64,"children":65},{},[66],{"type":32,"value":67},"Inventory all five evidence systems before any collection happens. Analysis can wait; the artifacts cannot.",{"type":27,"tag":69,"props":70,"children":71},"ul",{},[72,78,91,96,101],{"type":27,"tag":73,"props":74,"children":75},"li",{},[76],{"type":32,"value":77},"Public ledger infrastructure: chains, block explorers, archival nodes, indexers. Durable, pseudonymous, reproducible by anyone.",{"type":27,"tag":73,"props":79,"children":80},{},[81,83,89],{"type":32,"value":82},"Custodial platforms: exchanges, custodians, on-ramps and off-ramps. Internal ledgers (many exchanges pool customer funds and track balances off-chain), KYC files, IP logs, and support tickets are institutional records reached through legal process. See ",{"type":27,"tag":40,"props":84,"children":86},{"href":85},"\u002Fresources\u002Fsubpoenaing-cryptocurrency-exchange-records",[87],{"type":32,"value":88},"Subpoenaing Cryptocurrency Exchange Records",{"type":32,"value":90},".",{"type":27,"tag":73,"props":92,"children":93},{},[94],{"type":32,"value":95},"Client devices: phones, laptops, tablets, hardware wallets. Wallet app data, browser extensions, notes, password managers, and transaction files live here; the custody model decides how much exists on device versus platform.",{"type":27,"tag":73,"props":97,"children":98},{},[99],{"type":32,"value":100},"Application-layer records: dApp dashboards, portfolio trackers, tax exports, API responses.",{"type":27,"tag":73,"props":102,"children":103},{},[104],{"type":32,"value":105},"Communications: email, messaging, exchange support threads, where control, knowledge, and intent are expressed in plain language.",{"type":27,"tag":57,"props":107,"children":109},{"id":108},"what-the-chain-keeps-and-what-it-cannot",[110],{"type":32,"value":111},"What the Chain Keeps, and What It Cannot",{"type":27,"tag":28,"props":113,"children":114},{},[115,117,125],{"type":32,"value":116},"Public chain records are effectively permanent and reproducible from archival sources years later. That durability matters under Rule 37(e) of the ",{"type":27,"tag":40,"props":118,"children":122},{"href":119,"rel":120},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fdocument\u002Ffederal-rules-of-civil-procedure.pdf",[121],"nofollow",[123],{"type":32,"value":124},"Federal Rules of Civil Procedure, as amended through December 1, 2025",{"type":32,"value":126},", which governs ESI that \"cannot be restored or replaced through additional discovery.\" Since on-chain data can almost always be restored or replaced, spoliation disputes center on what the ledger never recorded: wallet app state, extension storage, cached balances, API responses, session data, and the local time and timezone settings that place activity in time.",{"type":27,"tag":28,"props":128,"children":129},{},[130,132,139],{"type":32,"value":131},"The collection-order principle is the order of volatility in ",{"type":27,"tag":40,"props":133,"children":136},{"href":134,"rel":135},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc3227.txt",[121],[137],{"type":32,"value":138},"RFC 3227",{"type":32,"value":140},", the IETF guideline on evidence collection: proceed from the most volatile to the least, minimize changes, record the device clock's drift, and keep notes detailed enough to testify from years later. For crypto that runs from live screens and signed outputs, to application databases, to device images, to chain data. Chain analysis can wait a month; a phone that auto-updates, a browser that syncs, or a managed device with remote wipe cannot.",{"type":27,"tag":28,"props":142,"children":143},{},[144],{"type":32,"value":145},"Hypothetical example: A dispute turns on whether a party ever received or controlled an airdropped token that later moved to an exchange. The chain proves the tokens arrived and moved within a week; the dispositive questions are when the party knew and who controlled the wallet. On the day the dispute becomes foreseeable, counsel issues a hold covering the phone, browser profiles, and exchange account; the phone goes to airplane mode; the app database and extension state are hashed; the device clock is recorded; preservation letters go to the exchange. Months later the chain is rebuilt from public indexes and the exchange produces its records; the phone yields the install date and activity logs. A screenshot at filing captures none of that.",{"type":27,"tag":57,"props":147,"children":149},{"id":148},"collecting-secrets-without-compromising-them",[150],{"type":32,"value":151},"Collecting Secrets Without Compromising Them",{"type":27,"tag":28,"props":153,"children":154},{},[155,157,163],{"type":32,"value":156},"A seed phrase is the master credential for a self-custody wallet: a fixed list of words, commonly 12 or 24 under the BIP-39 mnemonic standard, encoding the private keys so a holder can restore the wallet and spend it. The cardinal rule: never collect it by importing it; importing mutates application state and spreads the credential. How control is proven without key material is covered in ",{"type":27,"tag":40,"props":158,"children":160},{"href":159},"\u002Fresources\u002Funderstanding-wallet-ownership-evidence",[161],{"type":32,"value":162},"Understanding Wallet Ownership Evidence",{"type":32,"value":164},". If a phrase or key file is found, preserve the medium in place: photograph where it was found, note who had access, secure it physically, and never transcribe it into case files or email.",{"type":27,"tag":28,"props":166,"children":167},{},[168],{"type":32,"value":169},"What you can collect safely:",{"type":27,"tag":69,"props":171,"children":172},{},[173,178,183,188],{"type":27,"tag":73,"props":174,"children":175},{},[176],{"type":32,"value":177},"Signed messages: a cryptographic signature from an address proves control without revealing the key or moving funds. The most useful non-destructive step.",{"type":27,"tag":73,"props":179,"children":180},{},[181],{"type":32,"value":182},"Secret metadata: file names, modification dates, and which app or vault holds the material, without contents, and when a vault was created or last accessed if determinable without opening it.",{"type":27,"tag":73,"props":184,"children":185},{},[186],{"type":32,"value":187},"Hardware-wallet presence: model, serial, firmware version, connection history. Keys generally cannot be extracted by standard forensic means, and resetting the device destroys the association between it and the addresses it controlled.",{"type":27,"tag":73,"props":189,"children":190},{},[191],{"type":32,"value":192},"Wallet application configuration and logs, excluding key databases.",{"type":27,"tag":28,"props":194,"children":195},{},[196,198,204,206,212],{"type":32,"value":197},"Key material is the one category where production itself is a harm: any handler gains the ability to move the client's entire estate, so extraction should be court-sanctioned, performed by an examiner under a defined protocol, and produced under seal or to a neutral. Designate who may touch it: a forensic examiner in a controlled, documented environment, and no one else. ",{"type":27,"tag":40,"props":199,"children":201},{"href":200},"\u002Fservices#evidence-review",[202],{"type":32,"value":203},"ConsensusIntel's evidence review services",{"type":32,"value":205}," are structured so collection never requires counsel to hold the keys, and our ",{"type":27,"tag":40,"props":207,"children":209},{"href":208},"\u002Fmethodology",[210],{"type":32,"value":211},"methodology",{"type":32,"value":213}," documents acquisitions end to end.",{"type":27,"tag":57,"props":215,"children":217},{"id":216},"documentation-that-survives-cross-examination",[218],{"type":32,"value":219},"Documentation That Survives Cross-Examination",{"type":27,"tag":28,"props":221,"children":222},{},[223,225,230,232,239,241,248],{"type":32,"value":224},"A defensible collection is reproducible and explainable. ",{"type":27,"tag":40,"props":226,"children":228},{"href":134,"rel":227},[121],[229],{"type":32,"value":138},{"type":32,"value":231}," requires transparent, reproducible methods and documented chain of custody, with notes detailed enough to testify from years later. ",{"type":27,"tag":40,"props":233,"children":236},{"href":234,"rel":235},"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F86\u002Ffinal",[121],[237],{"type":32,"value":238},"NIST SP 800-86",{"type":32,"value":240},", the federal incident-response forensics guide (August 2006), applies the same discipline across hosts, applications, and network sources, from volatile to non-volatile data. ",{"type":27,"tag":40,"props":242,"children":245},{"href":243,"rel":244},"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F101\u002Fr1\u002Ffinal",[121],[246],{"type":32,"value":247},"NIST SP 800-101 Rev. 1",{"type":32,"value":249}," (May 2014) defines preservation for mobile devices as maintaining custody without altering data, treats it as the first step in recovery, and warns that tool support varies with the operating system version and device family.",{"type":27,"tag":28,"props":251,"children":252},{},[253],{"type":32,"value":254},"Every acquisition should record:",{"type":27,"tag":69,"props":256,"children":257},{},[258,263,268,273,278,283],{"type":27,"tag":73,"props":259,"children":260},{},[261],{"type":32,"value":262},"Who collected, what, when, where, and by what method.",{"type":27,"tag":73,"props":264,"children":265},{},[266],{"type":32,"value":267},"Device and software identifiers: operating system build, wallet app version, extension versions, firmware.",{"type":27,"tag":73,"props":269,"children":270},{},[271],{"type":32,"value":272},"Chain identifiers: mainnet versus testnet is a routine source of confusion; record the chain ID, block height range, and the source used.",{"type":27,"tag":73,"props":274,"children":275},{},[276],{"type":32,"value":277},"Time source: device clock, timezone, network time, and observed drift at acquisition. Block timestamps are consensus-claimed times, not precise clocks; correlating them with device logs requires both offsets.",{"type":27,"tag":73,"props":279,"children":280},{},[281],{"type":32,"value":282},"Hash digests, for example SHA-256, of every image and export, computed at collection and again at handoff.",{"type":27,"tag":73,"props":284,"children":285},{},[286],{"type":32,"value":287},"Custody history: who held each device or exhibit, when, and how transfers occurred.",{"type":27,"tag":57,"props":289,"children":291},{"id":290},"five-threats-between-the-hold-and-the-expert",[292],{"type":32,"value":293},"Five Threats Between the Hold and the Expert",{"type":27,"tag":295,"props":296,"children":298},"h3",{"id":297},"remote-wipe-and-managed-devices",[299],{"type":32,"value":300},"Remote wipe and managed devices",{"type":27,"tag":28,"props":302,"children":303},{},[304],{"type":32,"value":305},"Managed phones can be remotely wiped on command, and NIST SP 800-101 describes device applications written to trigger exactly that. Isolate devices from networks immediately, suspend remote-wipe commands with IT first, and record network state at seizure.",{"type":27,"tag":295,"props":307,"children":309},{"id":308},"automatic-updates",[310],{"type":32,"value":311},"Automatic updates",{"type":27,"tag":28,"props":313,"children":314},{},[315],{"type":32,"value":316},"Wallet apps and browser extensions update silently, rewriting local databases and changing versions. Where the user cooperates, disable auto-update before collection and snapshot the pre-update state; otherwise, ask about update history in discovery.",{"type":27,"tag":295,"props":318,"children":320},{"id":319},"cloud-sync",[321],{"type":32,"value":322},"Cloud sync",{"type":27,"tag":28,"props":324,"children":325},{},[326],{"type":32,"value":327},"Cloud services synchronize photos, notes, and vaults across devices; deletions propagate automatically, but backups are also a preservation source when a device is gone or reset. Map what syncs before anyone changes a setting, and cover the backup account in the hold.",{"type":27,"tag":295,"props":329,"children":331},{"id":330},"browser-extension-data",[332],{"type":32,"value":333},"Browser-extension data",{"type":27,"tag":28,"props":335,"children":336},{},[337],{"type":32,"value":338},"Wallet browser extensions keep authoritative state in local storage and profiles: connected sites, activity logs, account addresses, settings. That state is often the only surviving record of how a wallet was used. Preserve it in place or by forensic copy and record the extension version; popup screenshots are documentation, not collection.",{"type":27,"tag":295,"props":340,"children":342},{"id":341},"exchange-retention-and-account-closure",[343],{"type":32,"value":344},"Exchange retention and account closure",{"type":27,"tag":28,"props":346,"children":347},{},[348,350,357],{"type":32,"value":349},"Institutional records have their own clocks. Under ",{"type":27,"tag":40,"props":351,"children":354},{"href":352,"rel":353},"https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F31\u002F1010.430",[121],[355],{"type":32,"value":356},"31 C.F.R. § 1010.430(d)",{"type":32,"value":358},", records FinCEN's rules require covered financial institutions to retain must be kept five years, including amounts, execution dates, and payment instructions for transmittals of funds (31 C.F.R. § 1010.410(e)). Many platforms are not covered entities or are foreign, retaining for shorter contractual windows. Send a hold letter and serve process promptly; in federal practice, Rule 26(d)(2) lets a party deliver Rule 34 requests more than 21 days after service, treated as served at the first Rule 26(f) conference. Capture account state read-only with a witness, hash it, and treat it as supplementation, never a replacement: unilateral logins can trigger security holds.",{"type":27,"tag":57,"props":360,"children":362},{"id":361},"rule-26-and-rule-37e-the-legal-frame-around-preservation",[363],{"type":32,"value":364},"Rule 26 and Rule 37(e): The Legal Frame Around Preservation",{"type":27,"tag":28,"props":366,"children":367},{},[368,370,377],{"type":32,"value":369},"The duty to preserve arises when litigation is reasonably anticipated, before a complaint is filed. Rule 26(b)(1) shapes the scope: discovery is limited to nonprivileged matter relevant to a claim or defense and proportional to the needs of the case, weighing the issues at stake, the amount in controversy, the parties' relative access to information, their resources, and burden versus benefit (",{"type":27,"tag":40,"props":371,"children":374},{"href":372,"rel":373},"https:\u002F\u002Fwww.law.cornell.edu\u002Frules\u002Ffrcp\u002Frule_26",[121],[375],{"type":32,"value":376},"Rule 26",{"type":32,"value":378},"). Proportionality is both the tool for resisting over-collection and the justification for a scoped plan in a small matter; document why each step was taken.",{"type":27,"tag":28,"props":380,"children":381},{},[382,384,391],{"type":32,"value":383},"Rule 37(e) governs when preserved ESI is lost anyway. If ESI that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps, and it cannot be restored or replaced through additional discovery, the court may order measures no greater than necessary to cure resulting prejudice; adverse-inference instructions, dismissal, or default judgment are available only on a finding of intent to deprive (",{"type":27,"tag":40,"props":385,"children":388},{"href":386,"rel":387},"https:\u002F\u002Fwww.law.cornell.edu\u002Frules\u002Ffrcp\u002Frule_37",[121],[389],{"type":32,"value":390},"Rule 37(e)",{"type":32,"value":392},"). It is not a hold-issuance checklist; the advisory committee note to the 2015 amendment states that it \"recognizes that 'reasonable steps' to preserve suffice; it does not call for perfection.\"",{"type":27,"tag":28,"props":394,"children":395},{},[396],{"type":32,"value":397},"In practice, Rule 37(e) disputes in crypto matters center on off-chain artifacts: the chain is restorable. A hold naming the specific apps, devices, extensions, accounts, and time settings, plus a log showing it was enforced, converts a technical loss into a defensible position or an indefensible one.",{"type":27,"tag":57,"props":399,"children":401},{"id":400},"the-litigation-hold-and-expert-handoff-checklist",[402],{"type":32,"value":403},"The Litigation-Hold and Expert Handoff Checklist",{"type":27,"tag":295,"props":405,"children":407},{"id":406},"preservation-checklist",[408],{"type":32,"value":409},"Preservation checklist",{"type":27,"tag":411,"props":412,"children":413},"ol",{},[414,419,424,429,434,447,452,457],{"type":27,"tag":73,"props":415,"children":416},{},[417],{"type":32,"value":418},"Issue the written hold the day the matter opens, naming custodians, devices, apps, wallets, exchanges, and communications; prohibit updates, resets, uninstalls, sync changes, and new transactions.",{"type":27,"tag":73,"props":420,"children":421},{},[422],{"type":32,"value":423},"Inventory all five evidence systems.",{"type":27,"tag":73,"props":425,"children":426},{},[427],{"type":32,"value":428},"Stabilize volatile items: suspend remote wipe, disable auto-update, map cloud sync, record the device clock.",{"type":27,"tag":73,"props":430,"children":431},{},[432],{"type":32,"value":433},"Serve process early: hold letters, subpoenas, and early Rule 34 requests where the Federal Rules apply.",{"type":27,"tag":73,"props":435,"children":436},{},[437,439,445],{"type":32,"value":438},"Capture the reproducible chain data once, recording chain identifiers, block heights, and the source. Capture, not analysis; tracing comes later (",{"type":27,"tag":40,"props":440,"children":442},{"href":441},"\u002Fservices#blockchain-tracing",[443],{"type":32,"value":444},"blockchain tracing",{"type":32,"value":446},").",{"type":27,"tag":73,"props":448,"children":449},{},[450],{"type":32,"value":451},"Collect ephemeral artifacts in order of volatility; request a signed message where control is at issue.",{"type":27,"tag":73,"props":453,"children":454},{},[455],{"type":32,"value":456},"Document every acquisition with hashes and custody history.",{"type":27,"tag":73,"props":458,"children":459},{},[460],{"type":32,"value":461},"Hand the expert a manifest: what was collected, from whom, when, under what authority, and what questions remain.",{"type":27,"tag":295,"props":463,"children":465},{"id":464},"questions-to-ask-at-first-contact",[466],{"type":32,"value":467},"Questions to ask at first contact",{"type":27,"tag":69,"props":469,"children":470},{},[471,476,481,486,491],{"type":27,"tag":73,"props":472,"children":473},{},[474],{"type":32,"value":475},"Which exchanges, wallets, addresses, apps, and extensions, on which devices?",{"type":27,"tag":73,"props":477,"children":478},{},[479],{"type":32,"value":480},"Where are recovery phrases stored: notes, password manager, paper, safe deposit box, or memory?",{"type":27,"tag":73,"props":482,"children":483},{},[484],{"type":32,"value":485},"Which devices are employer-managed or subject to remote wipe, auto-update, or cloud backup, and which cloud accounts sync wallet data?",{"type":27,"tag":73,"props":487,"children":488},{},[489],{"type":32,"value":490},"Has any device been updated, reset, replaced, or wiped since the trigger date, and what was the device clock set to?",{"type":27,"tag":73,"props":492,"children":493},{},[494],{"type":32,"value":495},"Who else had access: spouses, employees, business partners, or custodians?",{"type":27,"tag":57,"props":497,"children":499},{"id":498},"what-preservation-cannot-fix",[500],{"type":32,"value":501},"What Preservation Cannot Fix",{"type":27,"tag":28,"props":503,"children":504},{},[505,507,513],{"type":32,"value":506},"Preservation cannot resurrect overwritten data, recover a hardware wallet's secure element, decrypt a locked phone without the passcode, or compel a foreign platform beyond the reach of process. It cannot manufacture context that was never recorded, and it does not make material admissible; authentication and expert reliability are covered in ",{"type":27,"tag":40,"props":508,"children":510},{"href":509},"\u002Fresources\u002Fblockchain-evidence-admissibility",[511],{"type":32,"value":512},"Blockchain Evidence in Litigation",{"type":32,"value":514},". Criminal procedure, warrants, seizure authority, and compelled unlocking are outside this article's scope. Lose as little of the fragile layer as possible, and know exactly what was lost.",{"type":27,"tag":57,"props":516,"children":518},{"id":517},"frequently-asked-questions",[519],{"type":32,"value":520},"Frequently Asked Questions",{"type":27,"tag":295,"props":522,"children":524},{"id":523},"q-when-does-the-duty-to-preserve-crypto-evidence-begin",[525],{"type":32,"value":526},"Q: When does the duty to preserve crypto evidence begin?",{"type":27,"tag":28,"props":528,"children":529},{},[530,536],{"type":27,"tag":531,"props":532,"children":533},"strong",{},[534],{"type":32,"value":535},"A:",{"type":32,"value":537}," When litigation is reasonably anticipated, which can be months before a complaint is filed. The hold must cover the ephemeral artifacts, not just the chain: apps, extensions, devices, accounts, browser profiles, and time settings.",{"type":27,"tag":295,"props":539,"children":541},{"id":540},"q-is-a-screenshot-of-a-wallet-balance-or-a-recorded-seed-phrase-enough-preservation",[542],{"type":32,"value":543},"Q: Is a screenshot of a wallet balance, or a recorded seed phrase, enough preservation?",{"type":27,"tag":28,"props":545,"children":546},{},[547,551],{"type":27,"tag":531,"props":548,"children":549},{},[550],{"type":32,"value":535},{"type":32,"value":552}," No. A screenshot lacks the metadata, version context, and provenance needed to place it in time. A seed phrase should not be collected by counsel at all; preserve the medium in place and verify control through a signed message. Screenshots and phrases are documentation aids, not a collection protocol.",{"type":27,"tag":295,"props":554,"children":556},{"id":555},"q-we-found-a-seed-phrase-during-review-can-we-import-it-to-check-the-wallet",[557],{"type":32,"value":558},"Q: We found a seed phrase during review. Can we import it to check the wallet?",{"type":27,"tag":28,"props":560,"children":561},{},[562,566],{"type":27,"tag":531,"props":563,"children":564},{},[565],{"type":32,"value":535},{"type":32,"value":567}," Do not import it into a live wallet. Importing mutates application state, spreads the credential, and changes the evidentiary picture. If verification is essential, have a forensic examiner work in a controlled, offline, documented environment, or verify control with a signed message.",{"type":27,"tag":295,"props":569,"children":571},{"id":570},"q-the-other-side-wiped-a-phone-or-closed-an-exchange-account-what-now",[572],{"type":32,"value":573},"Q: The other side wiped a phone or closed an exchange account. What now?",{"type":27,"tag":28,"props":575,"children":576},{},[577,581],{"type":27,"tag":531,"props":578,"children":579},{},[580],{"type":32,"value":535},{"type":32,"value":582}," The chain data is still restorable, so the loss analysis turns on what the missing off-chain data could have shown. Document the loss with dates and known contents, check cloud backups, and preserve what does not require the lost device. If the loss followed a failure to take reasonable steps after the duty arose, that supports a spoliation argument; intent to deprive is required for the severe sanctions.",{"type":27,"tag":295,"props":584,"children":586},{"id":585},"q-in-a-small-case-does-preservation-cost-more-than-it-is-worth",[587],{"type":32,"value":588},"Q: In a small case, does preservation cost more than it is worth?",{"type":27,"tag":28,"props":590,"children":591},{},[592,596],{"type":27,"tag":531,"props":593,"children":594},{},[595],{"type":32,"value":535},{"type":32,"value":597}," The highest-value steps are cheap: a written hold, a hold letter to platforms, disabling auto-update and remote wipe, recording the device clock, and capturing a signed message. Rule 26(b)(1) proportionality lets the parties scope the work to the stakes, and documenting those decisions is part of a defensible record.",{"type":27,"tag":28,"props":599,"children":600},{},[601,603,609],{"type":32,"value":602},"Cases vary in facts, jurisdiction, and stakes, and preservation decisions are best made before artifacts vanish. If a matter is headed toward crypto evidence, a short conversation about the specific devices and timeline clarifies what must happen in the first days and what can wait. Nick Kampe is available through the ",{"type":27,"tag":40,"props":604,"children":606},{"href":605},"\u002Fcontact",[607],{"type":32,"value":608},"contact page",{"type":32,"value":610}," to discuss a preservation plan for a specific matter.",{"title":8,"searchDepth":612,"depth":612,"links":613},2,[614,615,616,617,618,626,627,631,632],{"id":59,"depth":612,"text":62},{"id":108,"depth":612,"text":111},{"id":148,"depth":612,"text":151},{"id":216,"depth":612,"text":219},{"id":290,"depth":612,"text":293,"children":619},[620,622,623,624,625],{"id":297,"depth":621,"text":300},3,{"id":308,"depth":621,"text":311},{"id":319,"depth":621,"text":322},{"id":330,"depth":621,"text":333},{"id":341,"depth":621,"text":344},{"id":361,"depth":612,"text":364},{"id":400,"depth":612,"text":403,"children":628},[629,630],{"id":406,"depth":621,"text":409},{"id":464,"depth":621,"text":467},{"id":498,"depth":612,"text":501},{"id":517,"depth":612,"text":520,"children":633},[634,635,636,637,638],{"id":523,"depth":621,"text":526},{"id":540,"depth":621,"text":543},{"id":555,"depth":621,"text":558},{"id":570,"depth":621,"text":573},{"id":585,"depth":621,"text":588},"markdown","content:articles:30-preserving-crypto-native-esi.md","content","articles\u002F30-preserving-crypto-native-esi.md","articles\u002F30-preserving-crypto-native-esi","md",1790145013677]