As soon as a determination has been made to launch an internal investigation, steps should be taken to preserve all potentially relevant documents in order to (i) ensure the best chance to accomplish the investigation’s goals, and (ii) avoid adverse inferences if regulators become involved in the underlying matter.

Effective data preservation requires an understanding of the company’s data storage system and practices and likely involvement from company IT support.  Investigators should suspend document retention/destruction procedures for relevant custodians (a so-called “silent hold”) and should also issue legal hold notices that affirmatively prohibit the destruction of any potentially relevant evidence.  Further steps may also be taken, including obtaining data snapshots or forensic images of computer hard drives.  Forensic imaging can be particularly important if investigators suspect that potentially relevant documents have already been deleted.