Spoliation

Spoliation is the destruction, alteration, concealment or failure to preserve evidence relevant to litigation or an investigation that is under way or reasonably anticipated. It can be deliberate, but it can equally result from routine processes: a retention schedule that keeps deleting email after a legal hold should have suspended it, or backup tapes overwritten after the duty to preserve arose. Courts can respond with sanctions, up to an instruction that the missing material be presumed unfavourable to the party that lost it. In the United States, Federal Rule of Civil Procedure 37(e) governs the failure to preserve electronically stored information.

The duty to preserve is what connects spoliation to data retention. A retention schedule and defensible disposal are legitimate practice, but once litigation is reasonably anticipated, a legal hold is expected to override them for the relevant records. Destruction that would have been routine the day before can become spoliation the day after. Sound chain of custody records then show that preserved evidence was not altered.

Exam relevance: a scenario is likely to describe records deleted on schedule while a lawsuit or investigation was pending, and ask what went wrong. Candidates are expected to identify the missing legal hold, and to see that following the normal retention policy does not by itself excuse the loss.