The problem hiding in plain sight
The retention setting was routine. The timing was not. Collaboration tools can erase material quietly while the lawyers are still debating the wording of the preservation notice.
Where to look first
Build a chronology: when preservation was triggered, what systems held the data, who controlled settings, when deletion occurred, and whether exports or other custodians can restore it. Avoid assumptions about what missing messages contained.
The rehearsal that matters
Rule 37(e) has specific conditions for lost ESI and different requirements for available measures; the harshest remedies require intent to deprive. Ask IT about configuration logs, hold propagation, and backups. A notice sent is not a hold implemented.
The rule and the practical limit
Rehearse the administrator’s testimony with precise dates. “That is our standard policy” answers a different question from “Was it operating that way on Tuesday?”
A practical exercise for the next prep session
Before ending the meeting, have a second examiner ask five questions the witness has not seen. Include one inaccurate premise, one inconvenient document, one legitimate uncertainty, one follow-up that changes a fact, and one long silence. Record which answers require additional investigation. Correct the underlying preparation, not merely the wording of the answer.
What to take into the room
The goal is not to manufacture a perfect witness. It is to uncover uncertainty early, clarify what the evidence actually supports, and help a truthful witness remain accurate when questioning gets uncomfortable. Third Degree can support simulated questioning; attorney judgment and factual investigation remain essential.
A hold is not a ceremonial email
When litigation is reasonably anticipated, preservation duties may extend to relevant electronically stored information. A generic instruction to “save everything” does not explain ephemeral messaging, auto-deletion, retention settings, exports, or employee device practices. Under Rule 37(e), consequences for lost ESI depend on several specific findings; not every missing message produces the same remedy. Preserve evidence of what the organization actually did.
A preparation drill you can actually run
Map custodians, channels, retention settings, administrators, device policies, and the date each step occurred. Ask the IT witness to explain the difference between deleting a message in the interface and removing recoverable records from the system. Rehearse the difficult chronology: when did the duty arise, who changed the setting, and what was lost? Avoid claiming preservation occurred merely because a legal hold notice was sent.
What the opposing examiner will ask next
A prepared examiner rarely stops at the first answer. They ask how the witness knows, which record supports it, what contrary material exists, and whether the answer would change if a key premise proves false. Practice that sequence with the real file, not a hypothetical universe where every document supports your side. Identify the questions the team cannot yet answer and assign investigation before the testimony.
The distinction matters: rehearsal is a method for discovering weaknesses and helping a witness testify accurately. It is not an invitation to invent facts, conceal documents, or polish an unsupported story. Counsel should evaluate local rules, case orders, privilege, and the actual evidentiary record before applying any technique.
A 20-minute partner-level review
Give a lawyer who did not draft the outline twenty minutes with the file. Ask for the three most uncomfortable questions, the most damaging exhibit, and the one answer that would trigger follow-up discovery. Have that lawyer question the witness without warning. Then discuss where the witness relied on firsthand knowledge, reviewed records, or assumptions. Repeat after genuine factual gaps are addressed.
The final check is simple: can the witness explain what they know, how they know it, and what they do not know without pretending? That is a far more valuable outcome than an impressive practice score.
Field guide: The retention setting nobody checked
A litigation hold reaches every employee. Six months later, the team discovers that a project channel deleted messages after 30 days and the administrator was never asked to suspend the setting. Rule 37(e) addresses lost electronically stored information that should have been preserved, where reasonable steps were not taken and the information cannot be restored or replaced. Remedies turn on additional findings; deletion does not automatically mean sanctions.
Put it to work
Map the actual lifecycle of Slack or Teams content: channel messages, direct messages, edits, exports, retention policies, third-party integrations, departing users, and possible replacement sources. Ask IT what survives when an employee account is disabled tomorrow. Record the dates of the hold, system changes, recovery attempts, and technical findings. Do not let a policy memo stand in for a systems inventory. A hold that never reaches the relevant retention control is mostly a beautifully formatted email.
Legal source: Federal Rule of Civil Procedure 37 (Cornell LII)
Federal-law discussion is general; jurisdiction, local rules, and case orders may alter the analysis.
Prepare for Scrutiny on ESI, Spoliation, and Corporate Holds.
When opposing counsel drills down on disappearing messages, custodial gaps, and retention schedules, vague answers open the door to devastating sanctions hearings. Practice under rigorous cross-examination before taking the stand.
Privilege-safe AI rehearsal · Zero transcripts retained · Zero model training