When litigation is reasonably contemplated, the duty to preserve evidence is immediate. Courts have little patience for 'we did not realize' once key messages, logs, or files disappear.
RKSidhu Law Office recommends a short, written hold protocol: identify custodians, freeze auto-delete, notify IT the same day, and confirm in writing. The cost of that discipline is modest. The cost of an adverse inference is not.
If a hold is already in doubt, involve counsel before informal recovery attempts make the record worse. Early, documented effort remains the most credible answer a court will hear.