Client Intake Checklist for Text Message Evidence Cases

By Matt Cretzman

The intake call is ending. Your new client—a father fighting for custody—just mentioned "thousands of threatening texts from my ex." Your stomach tightens. You've been here before. The client has goldmine evidence on their phone, but by the time you get organized, opposing counsel has already sent a preservation letter, cloud backups have auto-deleted, and that smoking gun message? Gone.

Mother Father, founder of TextEvidence.ai, has watched this scenario play out hundreds of times. The difference between winning and losing text evidence cases often comes down to what happens in the first 48 hours after intake. Miss a critical step early, and you'll spend the entire case playing catch-up—or worse, explaining to your client why key evidence disappeared.

This checklist gives you a systematic framework for intake in text message evidence cases. Print it. Use it. Build your practice around it.

Phase 1: Immediate Preservation (Hour 1)

The moment you accept a case involving text evidence, the preservation clock starts ticking. Opposing parties delete messages. Cloud services auto-purge old backups. Devices get factory-reset "by accident." Your first priority is stopping the bleeding.

☐ Send Litigation Hold Letter to Your Client

Before you hang up the intake call, your client needs to understand their preservation obligations. Explain—clearly and in writing—that they must:

• Preserve all devices containing relevant messages (phones, tablets, old phones in drawers)
• Disable auto-delete features in messaging apps and cloud services
• Stop routine cleanup of messages, photos, and call logs
• Document any prior deletions they may have already made
• Notify you immediately if any device is lost, damaged, or reset

⚠️ Critical: Many clients don't realize that deleting "just the bad stuff" is spoliation. Explain that selective preservation can be worse than deleting everything.

☐ Send Preservation Letter to Opposing Party

If litigation is imminent or pending, send a preservation letter to opposing counsel (or the opposing party if unrepresented). This puts them on notice and creates consequences for later destruction. Your letter should demand preservation of:

• All mobile devices used during the relevant period
• Cloud backup accounts (iCloud, Google, Samsung, etc.)
• Messaging app accounts (WhatsApp, Telegram, Signal, Facebook Messenger)
• Social media direct messages
• Any other platform where communications occurred

☐ Document the Preservation Request

Create a file note recording:

• When you advised your client about preservation
• What specific instructions you gave
• When you sent the opposing party preservation letter
• Any acknowledgments received

This documentation protects you if spoliation issues arise later.

Phase 2: Device Inventory (Hours 1-24)

Most clients have more devices than they initially remember. Your job is to map the entire digital ecosystem before evidence disappears.

☐ Primary Device Documentation

Identify the client's main communication device:

| Information Needed | Why It Matters | |-------------------|----------------| | Device type and model | Determines export options and compatibility | | Current iOS/Android version | Affects available extraction methods | | Phone number(s) used | Identifies which messages are relevant | | Approximate message volume | Helps estimate workload and strategy | | Date range of relevant messages | Focuses preservation efforts | | Are messages still on device? | Determines urgency of extraction |

☐ Secondary Device Audit

Ask about—and document—every device the client has used:

• Previous phones: Many clients upgrade annually. Old phones often contain the oldest, most valuable evidence.
• Tablets: iPads and Android tablets frequently have iMessage or SMS sync enabled.
• Work phones: If work communications are relevant, BYOD policies may complicate extraction.
• Children's devices: In custody cases, tablets issued to children may contain communications.
• Shared family devices: Home iPads or "house phones" sometimes have message threads.

☐ Device Access Status

Determine current access levels:

• Physical possession: Does your client have the device in hand?
• Password/PIN known: Can they unlock it? (Essential for forensic extraction)
• Apple ID/Google account access: Needed for cloud backup recovery
• Remote wipe risk: Could the opposing party wipe it via Find My iPhone?

Pro Tip: If the opposing party has physical access to shared devices, prioritize extraction immediately. Spouses routinely wipe each other's devices during divorce proceedings.

Phase 3: Cloud Account Mapping (Hours 24-48)

Cloud backups are often the best—and sometimes only—source of complete message history. Most clients don't understand their own backup situation.

☐ iCloud (iPhone Users)

Document these critical details:

• iCloud account email: Needed to access backups
• Backup status: Is iCloud Backup enabled for Messages?
• Backup frequency: When did the most recent backup occur?
• Storage tier: Free 5GB plans often don't include Messages backup
• Two-factor authentication: Is 2FA enabled? (Affects recovery options)

Key question: "If you got a new iPhone today and restored from iCloud, would your text messages appear?"

☐ Google Account (Android Users)

For Android devices, verify:

• Google account email: Primary account for device backup
• Google One subscription: Paid plans include more backup options
• Backup & Restore status: Is backup enabled in settings?
• SMS Backup & Restore apps: Many Android users use third-party backup apps
• Carrier backup: Some carriers (Samsung, Verizon) have separate cloud services

☐ Third-Party Messaging Apps

Modern cases rarely involve SMS alone. Document:

| App | Account Info | Backup Status | Cloud/Local | |-----|-------------|---------------|-------------| | WhatsApp | Phone number | iCloud/Google Drive backup enabled? | Cross-platform | | Facebook Messenger | Facebook account | Message history archived? | Cloud-based | | Instagram DMs | Instagram account | Data download available | Cloud-based | | Telegram | Phone number | Cloud sync enabled? | Cloud-based | | Signal | Phone number | Disappearing messages enabled? | Primarily local |

☐ Shared Cloud Storage

Families often share cloud accounts that contain communications:

• Shared iCloud Photos: Screenshots of messages may be auto-synced
• Shared Google Drive/Dropbox: Message exports or screenshots may be stored
• Family iCloud: Shared storage plans may include other members' data

Phase 4: Evidence Collection Strategy (Days 2-7)

Once you've mapped the digital landscape, develop a collection strategy. The right approach depends on case value, message volume, and opposing party behavior.

☐ Choose Collection Method

| Method | Best For | Cost | Quality | |--------|----------|------|---------| | Client screenshots | Low-volume, urgent preservation | Free | Low—authentication challenges likely | | Native export tools | Medium-volume, cooperative clients | Free-$100 | Medium—better than screenshots | | Legal software (TextEvidence) | Regular text evidence practice | $49-149/mo | High—court-ready with authentication | | Forensic extraction | Deleted messages, hostile opposing party | $2,000-5,000 | Expert-level—survives any challenge |

For iPhone cases specifically, review our guide on how to authenticate iPhone text messages for court before choosing your collection method.

☐ Prioritize Collection Order

Collect evidence in this priority sequence:

1. Highest-risk devices first: Devices the opposing party could access or wipe
2. Oldest backups: Cloud backups auto-delete; oldest = most vulnerable
3. Most volatile apps: Signal, Snapchat, and apps with auto-delete features
4. Complete message threads: Partial collection creates admissibility risks

☐ Establish Collection Timeline

Set specific deadlines:

• Immediate (24 hours): Preserve and document all devices
• 72 hours: Complete initial screenshots or exports for safekeeping
• 1 week: Full native export using appropriate tools
• 2 weeks: Organize and tag evidence; identify gaps

Phase 5: Opposing Party Discovery (Week 1)

Your client's evidence is only half the story. Plan discovery for opposing party communications early.

☐ Identify Opposing Party Devices

Document what you know about opposing party devices:

• Device type(s) they use
• Phone number(s) and account information
• Cloud accounts (if known from marriage/shared accounts)
• Work devices that may contain relevant communications

☐ Plan Discovery Requests

Prepare targeted discovery for:

• Device forensic images: Full extraction of opposing party phones
• Cloud backup records: iCloud, Google, and carrier backups
• Messaging app data: WhatsApp, Facebook, Instagram exports
• Carrier records: SMS/MMS logs (limited content but shows volume)
• Social media archives: Facebook, Instagram data downloads

☐ Consider Third-Party Preservation

For critical evidence at risk of deletion, consider:

• Subpoenas to carriers: For SMS logs (limited time window)
• Subpoenas to cloud providers: Apple, Google for backup records
• Subpoenas to messaging apps: WhatsApp, Facebook for account data

⚠️ Timing matters: Most carriers only retain SMS logs for 3-12 months. Act quickly.

Phase 6: Documentation and Organization (Ongoing)

As evidence arrives, establish organization systems that scale.

☐ Create Evidence Inventory

Maintain a master spreadsheet tracking:

| Exhibit ID | Source | Date Range | Export Date | Hash/Verification | Status | |-----------|--------|------------|-------------|-------------------|--------| | TE-001 | Client iPhone | 2024-01 to 2024-06 | 2024-07-15 | SHA256: a1b2... | Organized | | TE-002 | iCloud Backup | 2023-06 to 2024-01 | 2024-07-16 | SHA256: c3d4... | Under Review |

☐ Establish File Naming Convention

Use consistent naming for all files:

[Case]-[Source]-[DateRange]-[Type]-[Version]
Smith-v-Jones-iPhone-2024-01-06-PDF-v1.pdf
Smith-v-Jones-iPhone-2024-01-06-CSV-v1.csv

☐ Tag and Categorize

As you review evidence, tag messages by:

• Relevance: Directly relevant / Context / Not relevant
• Issue: Custody / Support / Property / Harassment / Violation
• Admissibility: Ready for trial / Needs foundation / Potential objection
• Exhibit status: Will cite / Responsive production / Privileged

Phase 7: Client Communication and Expectations

Text evidence cases require ongoing client education. Set expectations clearly.

☐ Explain the Process

Clients need to understand:

• Collection takes time: Rush jobs lead to mistakes and missed evidence
• Not everything is admissible: Irrelevant or prejudicial messages may be excluded
• Organization matters: Judges hate disorganized evidence dumps
• Authentication is critical: Opposing counsel will challenge evidence—be prepared

☐ Establish Communication Protocols

Set rules for ongoing communications:

• Document new messages: Screenshot and send relevant new communications immediately
• No retaliation: Instruct client not to respond to hostile messages
• Preserve context: Never delete messages, even embarrassing ones
• Check before posting: Social media activity can undermine text evidence cases

☐ Regular Updates

Schedule check-ins to:

• Review newly discovered evidence
• Update preservation status
• Address client questions about the process
• Prepare for depositions and testimony

Common Intake Mistakes to Avoid

After hundreds of text evidence cases, these patterns predict trouble:

❌ Waiting to Extract

The mistake: Telling the client "we'll get organized later" while devices sit unprotected.

The consequence: Factory reset, water damage, or "lost phone" destroys critical evidence.

The fix: Extract immediately—even imperfect screenshots are better than nothing.

❌ Trusting Client Organization

The mistake: Assuming the client has preserved messages properly.

The consequence: Client "organized" messages by deleting "the boring stuff"—including context that proves authenticity.

The fix: Direct the preservation process yourself; don't delegate to clients.

❌ Ignoring Cloud Backups

The mistake: Focusing only on current devices while old iCloud backups auto-delete.

The consequence: Oldest, most valuable evidence disappears while you're collecting from active devices.

The fix: Cloud backup recovery happens in parallel with device extraction.

❌ Failing to Document

The mistake: Collecting evidence without chain of custody documentation.

The consequence: Authentication challenges succeed because you can't prove evidence integrity.

The fix: Document every extraction with timestamps, methods, and verification.

Tools to Streamline Intake

Modern text evidence practice requires modern tools:

TextEvidence.ai

Purpose-built for legal text evidence:

• Intake templates: Pre-built workflows for new cases
• Multi-source import: Combines screenshots, exports, and cloud backups
• Automatic organization: Chronological sorting with smart tagging
• Authentication documentation: Built-in chain of custody logs
• Court-ready exports: Bates stamping, line numbering, professional formatting

Forensic Consultants

For high-stakes cases, partner with certified forensic examiners:

• Cellebrite extraction: Deleted message recovery, locked device access
• Expert testimony: Qualified witnesses for authentication challenges
• Advanced analysis: Pattern recognition across thousands of messages

Practice Management Integration

Link text evidence workflows to your case management:

• Matter-specific intake forms: Standardized text evidence questionnaires
• Deadline tracking: Preservation, discovery, and production deadlines
• Client portal: Secure evidence sharing and communication

Downloadable Intake Checklist

Use this abbreviated checklist for quick reference:

Hour 1: Preservation

• [ ] Send litigation hold letter to client
• [ ] Send preservation letter to opposing party
• [ ] Document preservation requests

Day 1: Device Inventory

• [ ] Document primary device details
• [ ] Audit all secondary devices
• [ ] Verify device access and passwords

Days 1-2: Cloud Mapping

• [ ] iCloud/Google account status
• [ ] Third-party messaging apps
• [ ] Shared cloud storage

Week 1: Collection

• [ ] Choose collection method
• [ ] Prioritize high-risk sources
• [ ] Begin extraction process

Week 1: Discovery

• [ ] Identify opposing party devices
• [ ] Draft discovery requests
• [ ] Consider third-party subpoenas

Ongoing: Organization

• [ ] Create evidence inventory
• [ ] Establish file naming convention
• [ ] Tag and categorize evidence
• [ ] Maintain client communication

Conclusion: Intake Sets the Trajectory

Text evidence cases are won or lost in the first week. A systematic intake process—preservation, inventory, collection, and organization—gives you the foundation for successful litigation. Skip steps, and you'll spend the case chasing evidence that no longer exists. Do it right, and you'll have organized, admissible evidence that tells your client's story.

The intake checklist isn't bureaucracy—it's the difference between practicing law reactively and building cases proactively. Use it every time.

---

Ready to streamline your text evidence intake? Start a free trial of TextEvidence and import your next case in minutes, not hours.

---

About the Author

Matt Cretzman is the founder of TextEvidence.ai, building AI-powered tools that help family law attorneys manage text message evidence from intake through trial. He also founded Stormbreaker Digital and advises law firms nationwide on digital evidence workflows. Learn more at mattcretzman.com.