# A Legal Hold Without Prompt Device Imaging Is Not Preservation A litigation-hold notice covering ephemeral-messaging platforms (Signal, WhatsApp, Telegram) accomplishes nothing on its own — the custodian's device has to be forensically imaged before any auto-delete window or counterparty-side deletion can run, and the imaging has to happen close to the hold, not whenever forensic tooling catches up. A memo tells people what they must not delete; only imaging actually stops the deletion from mattering. ## Evidence **Source**: [[3. Resources/Literature Notes/WPE v Automattic Dkt 357 — Motion for Sanctions for Spoliation - Literature Note]] §H4 > [!quote] > By definition, deleted ephemeral messages cannot be recovered. WP Engine's spoliation motion against Automattic and Mullenweg turns on exactly this gap: a hold notice went out, but Mullenweg's iPhone was not successfully imaged until many months later, during which ephemeral platforms could have auto-deleted or been deleted by counterparties. Defendants' opposition ([[3. Resources/Literature Notes/WPE v Automattic Dkt 369 — Defendants Opposition to Sanctions Motion - Literature Note]]) contests the *conclusion* (they say a March 2026 Full File System image recovered everything back to 2012–2019, so nothing was actually lost) but not the *mechanism* — both sides agree that the gap between hold notice and successful imaging is the exposure window that matters. ## Scope & conditions - Holds when: the platform in question offers user- or counterparty-controlled disappearing/ephemeral messaging, and the custodian keeps using it after the hold issues. - Breaks when: the platform retains server-side copies the custodian can't delete, or imaging succeeds within the same window the hold notice goes out (same-day or near-same-day imaging closes the gap this claim is about). - A "we sent a hold notice" record, without a contemporaneous device-imaging date, cannot by itself demonstrate reasonable preservation steps for ephemeral platforms. ## Links - [[3. Resources/Literature Notes/WPE v Automattic Dkt 357 — Motion for Sanctions for Spoliation - Literature Note]] — because evidence-for: the motion's central factual theory is built on this exact hold-to-imaging gap. - [[3. Resources/Literature Notes/WPE v Automattic Dkt 369 — Defendants Opposition to Sanctions Motion - Literature Note]] — because contrasts: Defendants argue the gap was a cured forensic-tooling limitation (Cellebrite vs. a just-released iOS version), not a preservation failure — same mechanism, disputed outcome. - [[3. Resources/Permanent Notes/BDFL Litigation Necessarily Implicates Personal Corporate and Foundation Roles Because the BDFL Has Concentrated Them]] — because extends: this is the records-management-layer instance of the concentrated-authority risk that note tracks — one executive's personal device becomes the whole company's discovery exposure. - [[3. Resources/MOCs/Open Source Governance MOC]] — applies-in: the MOC lists this note under Synthesis additions (2026-08-13, spoliation-sanctions batch). ## Implications - Any open-source company or foundation with executives on personal ephemeral-messaging apps should pair a hold notice with a same-week (not same-quarter) imaging commitment, and should test forensic-tool compatibility against the custodian's actual OS version before relying on it. ## Maintenance - Last tended: 2026-08-13 - Next review: 2026-11-11