Spoliation in Family Law: Sanctions When the Other Side Deletes Digital Evidence

The other side wiped the phone two days after your preservation letter. Now what?

That is the scenario this article is about: you sent a preservation letter, and the device that mattered got factory-reset, “lost,” or quietly cleaned right after.

The good news is that deletion usually leaves a trail of reset timestamps, account-activity logs, SQLite gaps, and server-side artifacts that survive the wipe, and that trail is what turns a suspicion into a sanctions motion.

Spoliation is the destruction or material alteration of evidence (or the failure to preserve it) when there is a duty to preserve; in family law that duty attaches when litigation is reasonably anticipated, not when the petition is filed.

Most jurisdictions require the moving party to show three elements:

1. The other party had control of the evidence
2. The evidence was relevant to the claim
3. The party had a duty to preserve at the time of destruction

Sanctions range from adverse-inference jury instructions, to monetary sanctions, to striking pleadings, to default judgment.

The strength of your forensic showing usually determines which end of that range you get.

Forensic indicators of phone wiping

• Recent factory reset. iOS records the most recent erase event in system logs. Android leaves indicators in the recovery partition and Google account activity. A reset that occurred shortly after the preservation letter is a strong inference.
• iOS "Erase All Content and Settings" timestamp, pulled from device system logs and iCloud account activity logs.
• Application reinstall pattern. When an app appears in App Store or Play Store install history but its data is empty, that is uninstall-then-reinstall, a common evidence-destruction tactic.
• Anti-forensic tool installation. "Secure Eraser," "iShredder," "File Shredder" apps. Forensically detectable from iCloud backups even after removal.
• Selective deletion. SMS database missing message rows in a specific date range while preserving rows immediately before and after. The SQLite gap is forensically identifiable.

iCloud / Google account activity that is hard to wipe

Even when the device itself has been wiped, server-side artifacts often remain:

• Apple Privacy Report at privacy.apple.com, a discoverable export listing logins, device additions, recovery method changes, and password resets
• Google "My Activity", a comprehensive log of search, Maps, YouTube, and app activity, retained until the user changes auto-delete (which itself logs)
• iCloud backup history, since even if the user deleted the most recent backup, older backups can be subpoenaed from Apple
• Find My / Find My Device location history, discoverable and often uncontested by the user

Building the spoliation motion

The strongest motions we have supported include:

1. Timeline exhibit. Preservation letter date → device-reset date → first interaction with replacement device. When these three dates are within the same week, intent becomes hard to dispute.
2. Comparison forensic image. If you forensically imaged the device before the preservation period (rare but powerful), comparing pre/post images shows exactly what is gone.
3. Cross-source corroboration. Carrier records show texts that no longer exist on the device. Cloud backups show photos that were on the device but are now missing. Each absent artifact reinforces the inference.
4. Expert affidavit. A qualified forensic examiner declares, under oath, that the observed pattern is consistent with intentional destruction and not with ordinary device behavior or routine maintenance.

What the other side will argue, and how to counter

• "Phone was lost / damaged." Counter with carrier records showing the same device IMEI active during the period, or with a forensic image that shows it functioned normally.
• "The reset was for a separate reason, selling the phone or gifting it to a child." Counter with the timing argument and with proof that no transfer actually occurred.
• "I didn't know I had a duty to preserve." Counter with the preservation letter, prior counsel correspondence, or any communication that put them on notice.

What we provide for these motions

The cheapest spoliation case is the one you prevent: engage an examiner early to preserve ESI before it can be destroyed, so you argue from a clean forensic image rather than from its absence.

FRCP 37(e) is the leading federal articulation of the duty to preserve electronically stored information and the sanctions for failing to. But family law is mostly state court, and the standard and the available sanctions vary by jurisdiction, so treat 37(e) as the framework, not the controlling rule in every case.

Forensic-led litigation support covers device imaging, anti-forensic activity analysis, court-ready written expert opinions, and expert-witness testimony at hearing or trial.

We work directly with counsel and produce findings under attorney-work-product privilege.

For the underlying recovery mechanics, see how deleted text messages get recovered and admitted; for family-law matters, digital forensics for divorce and family law.

This article is general information for counsel, not legal advice. Consult your attorney about your specific matter.

Related services

• Spoliation Forensic Analysis
• Digital Forensics and Litigation Support for Attorneys
• Cybersecurity Expert Witness
• Digital Forensics for Divorce and Family Law