Client Intake Checklist for Text Message Evidence Cases

By Matt C.

The intake call is ending. Your new client—a father fighting for custody—just mentioned "thousands of threatening texts from my ex." Your stomach tightens. You've been here before. The client has goldmine evidence on their phone, but by the time you get organized, opposing counsel has already sent a preservation letter, cloud backups have auto-deleted, and that smoking gun message? Gone.

It is a common story. In text evidence cases, much of what you will be able to prove is shaped in the first 48 hours after intake. Miss a critical step early, and you'll spend the entire case playing catch-up—or worse, explaining to your client why key evidence disappeared.

This checklist gives you a systematic framework for intake in text message evidence cases. Print it. Use it. Build your practice around it.

Phase 1: Immediate Preservation (Hour 1)

The moment you accept a case involving text evidence, the preservation clock starts ticking. Opposing parties delete messages. Cloud services auto-purge old backups. Devices get factory-reset "by accident." Your first priority is stopping the bleeding.

☐ Send Litigation Hold Letter to Your Client

Before you hang up the intake call, your client needs to understand their preservation obligations. Explain—clearly and in writing—that they must:

• Preserve all devices containing relevant messages (phones, tablets, old phones in drawers)
• Disable auto-delete features in messaging apps and cloud services
• Stop routine cleanup of messages, photos, and call logs
• Document any prior deletions they may have already made
• Notify you immediately if any device is lost, damaged, or reset

⚠️ Critical: Many clients don't realize that deleting "just the bad stuff" can be treated as spoliation. Explain that selective deletion tends to look intentional and can hurt them more than the messages themselves.

☐ Send Preservation Letter to Opposing Party

If litigation is imminent or pending, send a preservation letter to opposing counsel (or the opposing party if unrepresented). This puts them on notice and makes later destruction easier to raise with the court. Your letter can demand preservation of:

• All mobile devices used during the relevant period
• Cloud backup accounts (iCloud, Google, Samsung, etc.)
• Messaging app accounts (WhatsApp, Telegram, Signal, Facebook Messenger)
• Social media direct messages
• Any other platform where communications occurred

☐ Document the Preservation Request

Create a file note recording:

• When you advised your client about preservation
• What specific instructions you gave
• When you sent the opposing party preservation letter
• Any acknowledgments received

This documentation protects you if spoliation issues arise later.

Phase 2: Device Inventory (Hours 1-24)

Most clients have more devices than they initially remember. Your job is to map the entire digital ecosystem before evidence disappears.

☐ Primary Device Documentation

Identify the client's main communication device:

☐ Secondary Device Audit

Ask about—and document—every device the client has used:

• Previous phones: Many clients upgrade annually. Old phones often contain the oldest, most valuable evidence.
• Tablets: iPads and Android tablets frequently have iMessage or SMS sync enabled.
• Work phones: If work communications are relevant, BYOD policies may complicate extraction.
• Children's devices: In custody cases, tablets issued to children may contain communications.
• Shared family devices: Home iPads or "house phones" sometimes have message threads.

☐ Device Access Status

Determine current access levels:

• Physical possession: Does your client have the device in hand?
• Password/PIN known: Can they unlock it? (Usually needed for export or forensic extraction)
• Apple ID/Google account access: Needed for cloud backup recovery
• Remote wipe risk: Could the opposing party wipe it via Find My iPhone?

Pro Tip: If the opposing party has physical access to shared devices, or the Apple ID or Google account behind them, prioritize extraction immediately. Remote-erase features such as Find My can wipe a device from anywhere.

Phase 3: Cloud Account Mapping (Hours 24-48)

Cloud backups are often the best—and sometimes only—source of complete message history. Most clients don't understand their own backup situation.

☐ iCloud (iPhone Users)

Document these critical details:

• iCloud account email: Needed to access backups
• Messages in iCloud vs. iCloud Backup: If Messages in iCloud is on, messages sync to iCloud and are not included in the iCloud Backup; a deletion on one device can remove the message everywhere. If it is off, messages are part of the backup.
• Backup frequency: When did the most recent backup occur?
• Storage: Is there enough iCloud storage for backups to complete? Full storage on the free 5GB tier is a common reason backups stop.
• Old devices: Apple may delete the iCloud backups of a device that has not backed up for 180 days, so check old phones' backups early.
• Two-factor authentication: Is 2FA enabled? (Affects recovery options)

Key question: "If you got a new iPhone today and restored from iCloud, would your text messages appear?"

☐ Google Account (Android Users)

For Android devices, verify:

• Google account email: Primary account for device backup
• Google storage: Is there enough Google account storage for backups to complete?
• Backup status: Is device backup enabled in settings?
• SMS Backup & Restore apps: Many Android users use third-party backup apps, which create files you can collect directly
• Manufacturer and carrier services: Some phone makers and carriers (for example, Samsung Cloud) run their own backup services

☐ Third-Party Messaging Apps

Modern cases rarely involve SMS alone. Document:

☐ Shared Cloud Storage

Families often share cloud accounts that contain communications:

• Shared iCloud Photos: Screenshots of messages may be auto-synced
• Shared Google Drive/Dropbox: Message exports or screenshots may be stored
• Family iCloud: Shared storage plans may include other members' data

Phase 4: Evidence Collection Strategy (Days 2-7)

Once you've mapped the digital landscape, develop a collection strategy. The right approach depends on case value, message volume, and opposing party behavior.

☐ Choose Collection Method

For iPhone cases specifically, review our guide on how to authenticate iPhone text messages for court before choosing your collection method.

☐ Prioritize Collection Order

Collect evidence in this priority sequence:

1. Highest-risk devices first: Devices the opposing party could access or wipe
2. Oldest backups: Cloud backups auto-delete; oldest = most vulnerable
3. Most volatile apps: Signal, Snapchat, and apps with auto-delete features
4. Complete message threads: Partial collection invites completeness objections and questions about context

☐ Establish Collection Timeline

Set specific deadlines:

• Immediate (24 hours): Preserve and document all devices
• 72 hours: Complete initial screenshots or exports for safekeeping
• 1 week: Full native export using appropriate tools
• 2 weeks: Organize and tag evidence; identify gaps

Phase 5: Opposing Party Discovery (Week 1)

Your client's evidence is only half the story. Plan discovery for opposing party communications early.

☐ Identify Opposing Party Devices

Document what you know about opposing party devices:

• Device type(s) they use
• Phone number(s) and account information
• Cloud accounts (if known from marriage/shared accounts)
• Work devices that may contain relevant communications

☐ Plan Discovery Requests

Prepare targeted discovery for:

• Device forensic images: Full extraction of opposing party phones
• Cloud backup records: iCloud, Google, and carrier backups
• Messaging app data: WhatsApp, Facebook, Instagram exports
• Carrier records: SMS/MMS logs (usually no message content, but they show who texted whom and when)
• Social media archives: Facebook, Instagram data downloads

☐ Consider Third-Party Preservation

For critical evidence at risk of deletion, consider:

• Subpoenas to carriers: For records of who texted whom and when
• Cloud providers and messaging apps: Under the federal Stored Communications Act, providers such as Apple, Google, WhatsApp and Facebook generally cannot disclose message content in response to a civil subpoena. Expect non-content records at most, and seek content from the account holder through party discovery or consent.

⚠️ Timing matters: Carrier retention varies widely. A Justice Department chart obtained by the ACLU showed most major carriers kept no text message content at all (Verizon kept it for only a few days), while records of who texted whom were kept for anywhere from months to years. That chart dates from 2010, so confirm each carrier's current policy and act quickly.

Phase 6: Documentation and Organization (Ongoing)

As evidence arrives, establish organization systems that scale.

☐ Create Evidence Inventory

Maintain a master spreadsheet tracking:

☐ Establish File Naming Convention

Use consistent naming for all files:

[Case]-[Source]-[DateRange]-[Type]-[Version]
Smith-v-Jones-iPhone-2024-01-06-PDF-v1.pdf
Smith-v-Jones-iPhone-2024-01-06-CSV-v1.csv

☐ Tag and Categorize

As you review evidence, tag messages by:

• Relevance: Directly relevant / Context / Not relevant
• Issue: Custody / Support / Property / Harassment / Violation
• Admissibility: Ready for trial / Needs foundation / Potential objection
• Exhibit status: Will cite / Responsive production / Privileged

Phase 7: Client Communication and Expectations

Text evidence cases require ongoing client education. Set expectations clearly.

☐ Explain the Process

Clients need to understand:

• Collection takes time: Rush jobs lead to mistakes and missed evidence
• Not everything is admissible: Irrelevant or prejudicial messages may be excluded
• Organization matters: Judges hate disorganized evidence dumps
• Authentication is critical: Opposing counsel may challenge evidence—be prepared

☐ Establish Communication Protocols

Set rules for ongoing communications:

• Document new messages: Screenshot and send relevant new communications immediately
• No retaliation: Instruct client not to respond to hostile messages
• Preserve context: Never delete messages, even embarrassing ones
• Check before posting: Social media activity can undermine text evidence cases

☐ Regular Updates

Schedule check-ins to:

• Review newly discovered evidence
• Update preservation status
• Address client questions about the process
• Prepare for depositions and testimony

Common Intake Mistakes to Avoid

These patterns tend to cause trouble:

❌ Waiting to Extract

The mistake: Telling the client "we'll get organized later" while devices sit unprotected.

The consequence: Factory reset, water damage, or "lost phone" destroys critical evidence.

The fix: Extract immediately—even imperfect screenshots are better than nothing.

❌ Trusting Client Organization

The mistake: Assuming the client has preserved messages properly.

The consequence: Client "organized" messages by deleting "the boring stuff"—including context that proves authenticity.

The fix: Direct the preservation process yourself; don't delegate to clients.

❌ Ignoring Cloud Backups

The mistake: Focusing only on current devices while old iCloud backups auto-delete.

The consequence: Oldest, most valuable evidence disappears while you're collecting from active devices.

The fix: Cloud backup recovery happens in parallel with device extraction.

❌ Failing to Document

The mistake: Collecting evidence without chain of custody documentation.

The consequence: Authentication challenges become harder to answer because you can't show how the evidence was handled.

The fix: Document every extraction with timestamps, methods, and verification.

Tools to Streamline Intake

Modern text evidence practice requires modern tools:

TextEvidence.ai

Built for organizing and analyzing text message evidence:

• Multi-source import: iPhone backups, Android (SMS Backup & Restore XML), Mac Messages, CSV/JSON/.txt chat exports, screenshots and screen recordings, plus documents and audio recordings
• Search and AI assistant: Search every conversation, and ask questions that are answered with citations to the messages
• Reports: Timeline, topic search, one person in depth, communication patterns, response times, a one-page overview and a case brief
• Preservation certificates: A SHA-256 fingerprint for each upload that shows whether the stored file has changed since it was stored
• Exports and sharing: Line-numbered, dated PDF exports, and read-only "Share with my attorney" links (7, 30 or 90 days, revocable, no account needed)

TextEvidence is software, not a law firm, and does not guarantee admissibility; you decide how to authenticate and present what it exports.

Forensic Consultants

For high-stakes cases, partner with certified forensic examiners:

• Forensic extraction (for example, Cellebrite): Deleted message recovery and locked device access, where technically possible
• Expert testimony: Qualified witnesses for authentication challenges
• Advanced analysis: Pattern recognition across thousands of messages

Practice Management Integration

Link text evidence workflows to your case management:

• Matter-specific intake forms: Standardized text evidence questionnaires
• Deadline tracking: Preservation, discovery, and production deadlines
• Client portal: Secure evidence sharing and communication

Downloadable Intake Checklist

Use this abbreviated checklist for quick reference:

Hour 1: Preservation

• Send litigation hold letter to client
• Send preservation letter to opposing party
• Document preservation requests

Day 1: Device Inventory

• Document primary device details
• Audit all secondary devices
• Verify device access and passwords

Days 1-2: Cloud Mapping

• iCloud/Google account status
• Third-party messaging apps
• Shared cloud storage

Week 1: Collection

• Choose collection method
• Prioritize high-risk sources
• Begin extraction process

Week 1: Discovery

• Identify opposing party devices
• Draft discovery requests
• Consider third-party subpoenas

Ongoing: Organization

• Create evidence inventory
• Establish file naming convention
• Tag and categorize evidence
• Maintain client communication

Conclusion: Intake Sets the Trajectory

Text evidence cases are often shaped in the first week. A systematic intake process—preservation, inventory, collection, and organization—gives you the foundation for successful litigation. Skip steps, and you'll spend the case chasing evidence that no longer exists. Do it right, and you'll have complete, organized evidence that tells your client's story, with a clear record of how it was collected.

The intake checklist isn't bureaucracy—it's the difference between practicing law reactively and building cases proactively. Use it every time.

---

Ready to streamline your text evidence intake? Start a 14-day free trial of TextEvidence and import your next case's messages.

---

About the Author

Matt C. is the founder of TextEvidence.ai, which builds software that helps attorneys and their clients organize and analyze text message evidence.