The Legal Preservation Letter for Truck Accident Lawyers: The Digital Evidence That Disappears First
- Lance Sloves
- 5 days ago
- 21 min read
A modern tractor-trailer generates more data in a single shift than the entire paper file of a trucking case from twenty years ago. The driver carries a phone. The cab holds a tablet. Cameras run continuously. The ELD records duty status second by second. Telematics pings location, speed, and harsh-braking events to a vendor's cloud platform, where a web dashboard logs every login and export.
Almost none of it is preserved by a letter that tells a carrier to hold "all relevant documents and electronically stored information."
That language is fine for a contract dispute. In a trucking case it produces a response that preserves email and a paper file while the footage overwrites, the telematics account purges on a vendor schedule nobody thought to ask about, and the driver's carrier drops the cell-site records that would have shown where the phone was and what it was doing.
The digital evidence is the case. Here is how to write a preservation letter that actually reaches it.
Why a generic spoliation letter fails in trucking cases
Standard ESI letters are organized by document type — emails here, text messages there, cloud storage at the end. That structure assumes everything decays at the same rate and lives in the same place.
Neither assumption holds. Trucking data lives across at least six independent systems, most of them operated by third-party vendors the carrier does not control, each with its own retention schedule. A letter that does not name the systems does not reach them, because the carrier's obligation extends to data held on its behalf — and the carrier will not think to notify a vendor it was never asked about.
The fix is to organize the letter by system, not by document type, and to order those systems by how fast the data disappears.
The systems that hold the evidence
Mobile devices
The driver's phone is the first thing to name, and it should be named as a device to be preserved rather than a category of documents to be collected.
Ask for the handset itself in its current state, plus SIM cards, and specify what you expect it to contain: call logs, SMS and MMS, iMessage and RCS, voicemail, photos and video with EXIF data, notes, calendars, browsing history, app data, screen-time and device-usage records, and third-party messaging content — WhatsApp, Signal, Telegram, Messenger, Snapchat, Instagram DMs, Zello, Slack, Teams. Include messages configured to auto-delete.
Do not stop at the driver. Dispatchers, fleet managers, safety directors, and terminal managers all have phones, and their communications with the driver during the trip are frequently more probative than the driver's own. Personal devices used for company business are within scope.
Wireless carrier records
This is a separate ask from the phone, and it is the one most often skipped.
Call-detail records, message content, data-session and IP logs, voicemail, subscriber and billing information, and historical cell-site, sector, and precision-location data are held by the wireless carrier, not the driver. The carrier has no notice of your case, no stake in it, and retention schedules ranging from days to months.
Specificity matters here. A request that says "cell phone records" gets billing statements. A request that names LOCDBOR, NELOS, RTT, PCMD, TDOA and timing-advance data, mediation records, time-on-tower and sector information, STIR/SHAKEN authentication records, and the carrier key needed to decode the column headers gets something you can build a distracted-driving analysis on.
Onboard cameras and video
Forward-facing, driver-facing, side, rear, and cargo-area cameras. Most record on a continuous loop and overwrite within hours or days. Cloud-retained event clips typically purge on 30-, 60-, or 90-day vendor schedules.
Ask for more than the triggered clip:
The full continuous footage for the trip, not just the event
The physical media — SD card, DVR, or hard drive — preserved and not returned to service
Upload logs showing what was transmitted to the cloud and when
Review and coaching records
Access logs showing who viewed, downloaded, exported, tagged, or deleted any clip, and when
That last item is often the most useful thing in the category. If a safety manager watched a clip three days after the collision and the clip later became unavailable, that sequence is worth more than the footage would have been.
Electronic logging devices
Certified logs are the least interesting output of an ELD. Ask for the layer underneath:
Native ELD output files, not just a human-readable PDF export
All original, unedited records
The complete edit history with the identity of each editing user
Carrier-proposed edits and whether the driver accepted or rejected them
All annotations
Unassigned drive time and its disposition
Personal conveyance and yard-move designations with supporting annotations
Malfunction and data-diagnostic event records, plus any paper logs kept during a malfunction period
Telematics and fleet management platforms
Name the vendors: Omnitracs, PeopleNet, Samsara, Motive, Lytx, SmartDrive, Zonar, Geotab, Verizon Connect, Platform Science, Trimble, EROAD, Isaac. A letter that says "telematics data" invites a narrow reading; a letter that names platforms does not.
Request GPS breadcrumb data at the finest available interval with speed, heading, and timestamp; driver-performance and safety scoring events including harsh braking, harsh acceleration, harsh cornering, speeding, and following distance; all coaching workflows generated from those events; and all macro, form, and free-text messages between the driver and dispatch in native format with metadata.
Route plans, appointment windows, detention records, and any communication about delivery deadlines belong here too. Schedule pressure is usually documented in the telematics messaging, not in anyone's email.
The web dashboard
This is the category that separates a sophisticated preservation letter from a competent one.
The data does not live on the truck. It lives in a vendor's web portal, under an account the carrier administers. Preserving "the dashcam" does not preserve the account, and the account is where the interesting records are:
Retention settings, including the account tier — a subscription downgrade can purge historical data as a billing consequence, with no one intending to destroy anything
User lists and permission levels — who could see what
Access and audit logs — who logged in, what they viewed, what they exported
Export and download history — what left the platform, when, and to whom
Deletion logs — what was removed from the account and by which user
Alert and notification configuration — which events the carrier had chosen to be told about
Report generation history — what the carrier ran and looked at after the collision
Ask the carrier to identify the vendor, the account administrator, and the retention period applicable to its specific subscription. Then ask it to notify the vendor in writing and instruct it to suspend any purge schedule — and to provide you a copy of that notice. A vendor that never receives a hold will follow its default schedule regardless of what the carrier promised you.
In-cab tablets and driver terminals
Fleet tablets, driver terminals, navigation units, and any device mounted in or issued for the cab. These hold dispatch messaging, document scanning and imaging, navigation history, workflow and stop data, and often personal use — browsing and streaming — that bears directly on attention.
They are also the device most likely to be wiped and reissued to another driver when the truck goes back into service. Name them separately from phones, or they get treated as company equipment rather than evidence.
Wearables
Smartwatches and fitness trackers hold sleep and activity data directly relevant to fatigue. If the driver wore one, the underlying cloud account decays like any other consumer service.
The decay hierarchy
Order the letter this way, and say why in the letter itself. Recipients comply faster when they understand the mechanism of loss.
| Evidence | Window | Mechanism | |---|---|---| | Continuous camera footage | Hours to days | Loop recording | | Cloud event clips | 30–90 days | Vendor retention schedule | | Telematics detail data | Varies by tier | Vendor schedule; purged on downgrade | | Carrier CDR and cell-site | Days to months | Carrier retention policy | | ELD records and HOS support | 6 months | 49 C.F.R. §§ 395.8(k)(1), 395.11(f) |
State plainly in the letter that compliance with a regulatory retention minimum is not a defense to spoliation. Once litigation is reasonably anticipated, the preservation duty supersedes every retention schedule and every internal destruction policy.
The clause that matters most
If the letter does one thing well, make it a download and inspection protocol.
Require advance written notice — seven days is reasonable — before any download, imaging, export, device reset, or software update affecting any device, account, or platform identified above. Require an opportunity for your expert to be present and to obtain a simultaneous independent copy of the native output file with a hash value for verification.
And if a download has already happened, require production of the native file, the imaging report, the hardware and software versions used, the operator's identity and credentials, and the chain of custody.
Without this clause, the defense downloads alone, produces a summary report, and you spend a deposition arguing about what the underlying data said. With it, you get a joint download or a very clean spoliation record.
Make them identify their own systems
Attach a short form and ask the carrier to answer, in writing:
ELD manufacturer, model, software version, and account retention period
Telematics vendor, platform, and account retention period
Camera vendor and model; local and cloud retention periods; whether an event clip triggered and uploaded
Web portal administrator for each platform, and the current user list
Wireless carrier and account holder for every relevant line, including personal lines used for business
Make, model, and current status of every in-cab tablet or terminal
Whether any download, export, or deletion has already occurred, and by whom
The person responsible for issuing and monitoring the litigation hold
This front-loads vendor identification you would otherwise spend a discovery cycle chasing — while the purge windows are still open. A carrier that will not answer basic identification questions has told you something useful, early.
Preservation is not collection
Telling a carrier to preserve data is not the same as ensuring it survives in usable, admissible form.
Screenshots, photographs of screens, and printed summary reports strip metadata, cannot be authenticated to the same standard, and can alter the source in the act of creating them. A PDF export of an ELD log is not the ELD record. A screen recording of a telematics dashboard is not the telematics data.
The letter should state that collection from mobile devices, tablets, ELDs, telematics platforms, and camera systems be performed by a qualified forensic examiner using forensically sound methods, preserving native format and metadata with a documented chain of custody.
A preservation letter buys time. What happens during that time determines whether the evidence survives Daubert.
The full preservation letter
What follows is a complete preservation letter built on the principles above, in two parts: the letter to the motor carrier, and the carrier-records request that goes to the wireless provider as Attachment A.
It is drafted for a Texas civil matter and rests on the common-law duty to preserve evidence material to reasonably anticipated litigation. Counsel practicing elsewhere should substitute the equivalent authority and process in the governing jurisdiction. Bracketed fields are completed for the specific matter.
Part one — letter to the motor carrier
[LAW FIRM NAME] [Street Address] • [City, State ZIP] • Tel: [Phone] • [Email / Website]
[Date]
VIA CERTIFIED MAIL, RETURN RECEIPT REQUESTED, AND ELECTRONIC MAIL
[Recipient Name] [Title / Position] [Motor Carrier / Company Name] [Street Address] [City, State ZIP]
RE: NOTICE TO PRESERVE EVIDENCE — MOBILE DEVICES, ONBOARD VIDEO, ELECTRONIC LOGGING AND TELEMATICS SYSTEMS, WEB PLATFORM RECORDS, CARRIER RECORDS, AND ELECTRONICALLY STORED INFORMATION
Our Client: [Client Name]
Matter / Incident: Commercial motor vehicle collision
Date of Incident: [Date]
Location: [Highway, Milepost, County, State]
Motor Carrier: [Carrier Legal Name and d/b/a]
USDOT No. / MC No.: [USDOT #] / [MC #]
Driver: [Driver Name]
Relevant Number(s): [Driver mobile number(s); dispatch number(s)]
Claim / File No.: [Claim or File Number, if any]
Dear [Recipient Name]:
This firm represents [Client Name] in connection with the above-referenced matter arising out of the incident that occurred on or about [Date of Incident] at or near [Location of Incident]. We anticipate that litigation will result from this matter. The purpose of this letter is to place you on formal notice of your legal obligation to preserve certain evidence, and to demand that you take immediate steps to identify, locate, and preserve all such evidence within your possession, custody, or control.
You are hereby directed to preserve all physical and electronically stored information ("ESI") that may be relevant to this matter. Under Texas law, a duty to preserve arises when a party knows or reasonably should know that there is a substantial chance that a claim will be filed and that evidence in its possession or control will be material and relevant to that claim. See Brookshire Bros., Ltd. v. Aldridge, 438 S.W.3d 9 (Tex. 2014). The failure to preserve such evidence may constitute spoliation of evidence and may subject you to remedies imposed by the trial court in its discretion — including, in appropriate circumstances, a spoliation (adverse-inference) instruction, exclusion of evidence, monetary sanctions, or other relief bearing a direct relationship to, and proportionate to, the culpability and resulting prejudice — pursuant to the court's inherent power and the Texas Rules of Civil Procedure.
Compliance with the minimum retention periods prescribed by the Federal Motor Carrier Safety Regulations is not a defense to spoliation. Once litigation is reasonably anticipated, your duty to preserve supersedes any regulatory retention floor and any internal document-destruction policy.
Immediate Suspension of Routine Destruction
Effective immediately, you must suspend all routine or automated practices that could result in the alteration, deletion, overwriting, or destruction of potentially relevant information. This includes, without limitation: automatic deletion of text messages, emails, voicemails, and call logs; loop recording and overwriting of onboard video; software or operating-system updates that overwrite data; "auto-delete" or "disappearing message" settings; device resets, wipes, trade-ins, or recycling; reformatting or reimaging of devices or storage media; and the cancellation, downgrade, or non-renewal of cloud, telematics, ELD, dashcam, or carrier accounts that would result in loss of data. Do not sell, discard, destroy, repair, reset, or relinquish possession of any device or account identified below without first preserving a complete forensic image or copy of its contents.
Devices, Accounts, and Systems to Be Preserved
You must preserve, in their current condition and without alteration, all of the following that were used by, accessible to, or associated with [the driver and any dispatcher, fleet manager, safety director, or terminal manager who communicated with the driver] during the period [beginning date] through the present (the "Relevant Period"):
Mobile Telephones and Smartphones. All cellular telephones, smartphones, and SIM cards — whether personal, business, or company-issued — including all call logs, text messages (SMS/MMS), iMessages, RCS messages, voicemails, contacts, photographs, videos, notes, calendars, browsing history, geolocation and GPS data, application data, screen-time and device-usage data, and any third-party messaging content.
In-Cab Tablets and Driver Terminals. All fleet tablets, driver terminals, navigation units, laptops, and similar devices mounted in or issued for the cab, including all dispatch messaging, document imaging, navigation history, workflow and stop data, stored files, application data, and internet activity. Do not wipe or reissue any such device to another driver.
Wearable and Connected Devices. All smartwatches, fitness trackers, and other wearable devices that may contain location, activity, sleep, health, or usage data. Sleep and activity data is directly relevant to fatigue analysis.
Third-Party and Encrypted Messaging Applications. All data within messaging and communication applications, including WhatsApp, Signal, Telegram, Facebook Messenger, Snapchat, Instagram direct messages, Slack, Microsoft Teams, WeChat, Zello, and any similar platform, including messages set to auto-delete or "disappear."
Social Media Accounts. All content associated with any social media account used by or attributable to the relevant individuals — including posts, comments, direct messages, photographs, videos, "stories," check-ins, tagged content, and associated metadata. Do not delete, deactivate, edit, or restrict access to any such account or content.
Email Accounts. All email accounts — personal, business, and web-based — including sent, received, draft, archived, and deleted items, together with all attachments and metadata.
Cloud Accounts and Online Storage. All cloud-based storage and backup accounts, including iCloud, Google Drive/Google One, Samsung Cloud, Microsoft OneDrive, and Dropbox, and any device or application backups stored in the cloud or on local media. Preserve all credentials sufficient to access and export this data.
Dashcams and Onboard Video Systems. All forward-facing, driver-facing, side, rear, and cargo-area cameras, including the triggering event clip and all continuously recorded footage for [the entire trip / the 72 hours preceding the collision], together with all audio, still images, telemetry overlays, and metadata. This includes footage stored on the device, on removable media, on any DVR or NVR unit, and on any associated cloud platform. Preserve the physical media; do not reuse, reformat, or return it to service. Preserve all upload logs, review and coaching records, and all records reflecting who viewed, downloaded, exported, tagged, or deleted any footage, and when.
Electronic Logging Devices (ELDs). All ELD data for the driver and vehicle, in native output format as well as any human-readable export, including all duty-status events, automatic drive-time recording, engine power-on and power-off events, intermediate logs, and associated GPS coordinates and timestamps. Preserve all original unedited records, all edit histories with the identity of each editing user, all annotations, all carrier-proposed edits and the driver's acceptance or rejection of each, all unassigned drive time and its disposition, all personal-conveyance and yard-move designations with supporting annotations, and all malfunction and data-diagnostic records together with any paper logs kept during a malfunction period.
Telematics and Fleet Management Systems. All data from any onboard telematics or fleet-management platform, whether hosted by you or by a third-party vendor — including Omnitracs, PeopleNet, Samsara, Motive, Lytx, SmartDrive, Zonar, Geotab, Verizon Connect, Platform Science, Trimble, EROAD, Isaac, or any comparable system — including all GPS breadcrumb and location-ping data at the finest available interval with speed, heading, and timestamp; all driver-performance and safety scoring events and the coaching workflows generated from them; all macro, form, free-text, and dispatch messages between the driver and any dispatcher or other person, in native format with metadata; and all route plans, appointment windows, detention records, and communications regarding schedule or delivery deadlines.
Web Platform and Account Records. For each ELD, telematics, and camera platform, all account-level records, including retention settings and subscription tier, user lists and permission levels, access and audit logs, export and download history, deletion logs, alert and notification configuration, and report generation history. Do not downgrade, cancel, or allow the lapse of any such account, as a change in subscription tier may purge historical data as a billing consequence.
Carrier and Wireless Account Records. All records maintained by any wireless, telephone, or internet service provider relating to the relevant number(s) and account(s), including subscriber and billing information, call-detail records, text/SMS/MMS records and content, data-session and IP logs, voicemail, and historical cell-site, sector, and precision-location data. Because these records are held by third-party carriers and are typically subject to short retention periods, they require immediate preservation. A detailed, exemplar specification of the carrier records to be preserved is set forth in Attachment A to this letter.
Related Records and Metadata. All account records, subscriber information, usage and billing records, backups, log files, and metadata associated with any of the foregoing devices, accounts, or systems.
Carrier and Call-Detail Records
Certain records relevant to this matter are maintained not on the devices themselves but by wireless carriers and telecommunications providers, and are subject to routine deletion on short retention schedules. Accordingly, you must take immediate steps to preserve — and, where you are the subscriber or account holder, to request that your carrier preserve — all call-detail records, text and multimedia messaging records and content, data-connection and IP logs, voicemail, subscriber and billing information, and historical cell-site, sector, and precision-location data associated with the relevant number(s) and account(s). This obligation extends to any company-provided line, any personal line used for company business, and any dispatch or terminal line. Attachment A sets forth an exemplar preservation request identifying, in detail, the specific categories of carrier records that should be preserved.
Download and Inspection Protocol
No download, imaging, export, device reset, diagnostic session, or software update affecting any device, account, or platform described above may be performed without at least [seven (7)] days' advance written notice to this firm and an opportunity for our retained expert to be present and to obtain a simultaneous, independent copy of the data with a hash value for verification. If any download or export has already occurred, produce the native output file, the imaging report, the hardware and software versions used, the operator's identity and credentials, the chain of custody, and the date and time of the session.
Manner of Preservation
Preservation must be undertaken in a manner that maintains the integrity of the original data and its associated metadata. We strongly recommend that any collection of ESI from mobile devices, tablets, dashcams, ELDs, telematics platforms, and similar systems be performed by a qualified forensic professional using forensically sound methods, so that the original data is not altered and a defensible chain of custody is maintained. Merely taking screenshots, photographing screens, printing summary reports, or manually copying data is often insufficient and may itself alter or destroy relevant metadata. Do not attempt to "clean up," reorganize, or delete anything in a good-faith belief that it is irrelevant — that determination is not yours to make unilaterally.
Third Parties and Vendors
Your preservation obligation extends to relevant information within your possession, custody, or control, including information held on your behalf by third parties such as wireless carriers, cloud-service providers, telematics and ELD vendors, dashcam platforms, insurers, and IT service providers. You must promptly notify any such third party in writing of the obligation to preserve, instruct it to suspend any routine retention or deletion schedule, and provide this firm with a copy of that notice and the vendor's contact information.
Identification of Systems Requested
So that preservation notices may be directed to the correct vendors before any purge window closes, please identify in writing: the ELD manufacturer, model, and account retention period; the telematics vendor, platform, and account retention period; the camera vendor and model, with local and cloud retention periods and whether an event clip triggered and uploaded; the web portal administrator and current user list for each platform; the wireless carrier and account holder for each relevant line; the make, model, and current status of each in-cab tablet or terminal; whether any download, export, or deletion has already occurred and by whom; and the person responsible for issuing and monitoring the litigation hold.
Scope
The categories above are illustrative and not exhaustive. If you are uncertain whether particular information falls within the scope of this notice, you should preserve it and, if you wish, confer with us regarding its relevance. This notice is a continuing one; it applies to information presently in existence and to information created after the date of this letter that relates to this matter.
Confirmation Requested
Please confirm in writing within [ten (10)] days of the date of this letter that you have received this notice, issued a written litigation hold, and taken the steps necessary to preserve the evidence described above. If you are represented by counsel or an insurer in connection with this matter, please forward this letter to them immediately and provide us with their contact information so that we may direct future correspondence accordingly.
Nothing in this letter is intended to waive, and we expressly reserve, all rights and remedies available to our client. If you have any questions regarding the scope of your preservation obligations, please contact the undersigned.
Thank you for your prompt attention to this important matter.
Very truly yours,
[LAW FIRM NAME]
[Attorney Name], Esq. Direct: [Phone] | Email: [Email]
Enclosure: Attachment A — Sample Carrier Records Preservation Request
Part two — Attachment A: carrier records preservation request
This is the request directed to the custodian of records of the wireless carrier. The specificity is the point. A request for "cell phone records" produces billing statements. This one produces the network data an analyst can actually work with.
[Date]
[Carrier Legal Process / Custodian of Records Address]
Re: Preservation Request — [Phone Number]
Dear Custodian of Records,
This firm represents [Client Name] in connection with a civil matter, and this letter is a formal request that you preserve the records and other evidence described below. This request is made pursuant to your common-law duty to preserve evidence that is material and relevant to reasonably anticipated civil litigation. See Brookshire Bros., Ltd. v. Aldridge, 438 S.W.3d 9 (Tex. 2014). The records concern the following number: [Phone Number]
You are hereby requested to preserve, for a period of not less than ninety (90) days — and to continue to preserve such records pending service of a subpoena or other legal process — the records described below currently in your possession, including records stored on back-up media, in a form that includes the complete record. We intend to seek formal production through civil process under the Texas Rules of Civil Procedure, including by subpoena and non-party discovery under Rules 176 and 205, or by petition under Rule 202. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, please contact the undersigned before taking such action.
If the number is not associated with a subscriber on your network, you are requested to still process it as a call-and-text-to-destination search, to include all text message content, voicemails, and cell-site and sector information related to each call or text.
This request applies only retrospectively. It does not obligate you to capture and preserve new information arising after the date of this request.
This preservation request applies to the following records and evidence associated with [Phone Number] for the period [START DATE] through [END DATE, followed by time zone]:
1. Specialized location records. All call, voice, text (SMS and MMS), and data connection location information and transactions (registration of network events) related to all specialized carrier records that may be referred to as LOCDBOR (Location Database of Record), Historical Precision Location Information, Historical Mobile Locate (HML), vMLC (Virtual Mobile Locate — vMLC3, vMLC4, vMLC5), NELOS (Network Event Location System), RTT (Round Trip Time / Return Trip Time / Real Time Tool), PCMD (Per Call Measurement Data), TDOA (Time Difference of Arrival) or Timing Advance Information, Mediation Records, E9-1-1, and/or Historical GPS / Mobile Locate Information showing GPS location (longitude and latitude) and the cell-site and sector of the device in relationship to the network when connected to the network for the above-referenced number.
2. Call, message, and data detail. All records associated with the identified mobile number relating to all delivered and undelivered inbound and outbound calls, text messages and text message content, all voicemail, and all data connections from [START DATE] through [END DATE] — to include date, time, direction, duration, number called or texted to and/or received from, bytes up, bytes down, and cell-site and sector information related to each call, text, website and/or application activity (name of website or application visited or accessed) or data connection, all text message content, and voicemails.
3. FCC TRACED Act STIR/SHAKEN authentication standard. All records associated with the identified mobile number related to the FCC TRACED (Telephone Robocall Abuse Criminal Enforcement and Deterrence) Act, STIR/SHAKEN caller identification framework, identifying all incoming Voice, Text Message Service (SMS) and Multi-Media Service (MMS) traffic, whether or not the caller ID passed or failed authentication. The report shall include the date, time (with time zone), originating and terminating numbers in their original state prior to STIR/SHAKEN authentication, the status whether it passed or failed authentication, the attestation type, and the originating and terminating verified number used to validate STIR/SHAKEN caller ID authentication. The report shall provide all usage events, even if the incoming usage event was blocked and flagged by the service provider (or other third-party entities) prior to delivery to the identified target mobile number.
4. Time on tower and/or sector. All cell-site and sector information related to each number called to and/or received from, and data connections, specific to the "time on tower" and/or sector — to include the start and end date and time for each time the connection was involved in a "hand-off" to another cell-site and/or sector, including the elapsed time (in seconds) for each hand-off used during and throughout each voice call (whether completed or not) and/or during and throughout each data session.
5. Stored communications and files. All stored communications or files, including voicemail, text messages (including numbers texted to and received from and all related content), email, digital images, contact lists, video calling, web activity (name of website or application visited or accessed), domains accessed, and data connections — to include Internet Service Providers (ISPs), Internet Protocol (IP) addresses, IP session data, IP destination data, bookmarks, data sessions, names of websites and/or applications accessed, and the date and time of each access — together with all cell-site and sector information associated with each such connection or record.
6. Carrier analytics and custom experience programs. All records associated with any carrier analytics, advertising, or location-services program — including but not limited to Verizon Selects and Verizon Custom Experience and Custom Experience Plus — including all specialized carrier records that may be referred to as RTT and/or Historical GPS / Mobile Locate Information showing GPS location (longitude and latitude) and cell-site and sector of the device in relationship to the network. The responsive data shall also include all numbers collected from carrier applications and/or URLs and all numbers communicating with the target number related to Customer Proprietary Network Information (CPNI), to include all delivered and undelivered inbound and outbound calls and text messages, and the quantity, type, destination, location, and amount of use of telecommunications and interconnected voice over internet protocol (VoIP) services and related billing information. Include all responsive records associated with websites, URLs, and domains visited (top-level domain and subdomain), to include a list of all carrier applications used on the mobile device. If no records are located, provide detailed information associated with the subscriber opting out of said services, to include opt-out date, time, and associated opt-out IP address.
7. Carrier key. The legend related to call detail, text messages, data connections, IP logs, IP sessions, website and/or application connections, and cell-site information. The "carrier key" contains the record column header labels and the definitions of what each cell value represents in the spreadsheet. Carrier keys are required to decipher what the values represent, as many are presented in codes known only to the service provider.
8. Cloud and remote storage content. Content stored in remote storage or cloud accounts associated with the target device, including but not limited to contacts, call logs, SMS and MMS messages with associated content including audio, video, and image files, digital images and videos, and files or documents.
9. Cell-site list. A list of all cell-sites as of [MONTH/YEAR CLOSEST TO THE EVENT] for all states in which the above records used cell locations. Cell-site lists to include switch, cell-site number, name, physical address, longitude and latitude, all sectors associated with each cell-site, sector beam width, tower height, and the azimuth of each sector associated with each cell-site. If multiple technologies (CDMA, UMTS, GSM, LTE, etc.) are referenced in the records, all corresponding cell-site lists shall also be preserved.
10. Subscriber information for [Phone Number], including:
a. All subscriber information to include name and tax identification number (social security number or employer identification number)
b. Physical address, mailing addresses, residential addresses, business addresses, email addresses, and any other address information
c. Credit information obtained or used by the company to grant account status
d. All numbers associated with the account
e. Billing records
f. All payments, to include method, date and time of payment, and location (store name, address, and phone number of the location where payments were made)
g. All authorized users on the associated account
h. Activation date and termination date of each device associated with the account and the above-listed number
i. Types of service the subscriber utilized
j. Make, model, serial number, IMEI, ESN, MEID, and MAC address associated with the above-listed number, including any and all equipment or SIM card changes for the life of the account
k. All customer service and account notes
l. Any and all number and/or account number changes prior to and after the number was activated
m. Any other records and other evidence relating to phone number [Phone Number]
n. If any outgoing calls were made to 9-1-1, the call details to include date and time, duration, and cell-site and sector information, by querying any other tools (e.g. Sable, ANI/ALI) necessary to identify the outgoing calls — whether or not the call used the specific carrier network equipment associated with this request, and whether or not the 9-1-1 call was carried by a different service provider based on the best signal available at the time
Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced accounts, and the content and connection logs associated with or relating to postings, communications, and any other activities to or through the above-referenced phone number, whether such records or other evidence are in electronic or other form.
Please contact me at [Phone] or by email at [Email] should you have any questions regarding this request.
Thank you for your attention to preserving the requested documents.
Regards,
[Name] [Title / Firm]
Computer Forensic Services, Inc. provides forensic collection, analysis, and expert testimony on digital evidence in commercial motor vehicle litigation across Texas, Louisiana, Florida, Oklahoma, and New Mexico — mobile device forensics, CDR and cell-site analysis, ELD and telematics data, onboard video, web platform records, and in-cab tablets.
If you have a trucking matter with a preservation deadline running, call 214-306-6470. The earlier the call, the more there is left to preserve.
AI-assisted blog post. Drafted with AI assistance and reviewed for accuracy by Lance Sloves, CCE, Computer Forensic Services, Inc.
Wow, you are giving away the secret sauce!