Building the Evidentiary Record

The failure that requires no bad faith at all

In most evidence disputes the argument is about conduct. Someone deleted something, or told someone else to. Search cases are different: the default outcome, with nobody doing anything wrong, is that the most probative record is gone by the time anyone asks for it.

Google Search Console — the reporting property a site owner verifies with Google, recording the queries, impressions, clicks, and average positions Google logged for that site — retains roughly sixteen months of performance data on a rolling basis. The window moves forward every day and the far end of it falls off. Raw server access logs — the line-per-request record of which client requested which URL, when, and what status code the server returned — are commonly rotated on thirty to ninety day cycles. Logs from a content delivery network — the intermediary serving cached copies of your pages from edge locations — are usually kept for less. Rank-tracking and link-monitoring histories end when the subscription does.

Set that against an ordinary pre-suit timeline. A demand letter goes out in March. Counsel exchange positions through the spring. A complaint is filed in the autumn, the Rule 26(f) conference happens weeks after that, and a preservation dispute is briefed the following winter. By then the log window covering the conduct closed months ago, and the performance data for the month before the change has rolled off the far end. Nobody destroyed anything. The record aged out while the parties were being reasonable with each other.

One disclosure before any of the analysis. No reported decision has applied Rule 37(e) to analytics data, Search Console data, or log rotation. Nothing here describes a holding on that point, because there is not one. It describes what the systems do, and what the rule text asks of a party who knows what they do. The rule itself is on Cornell's copy of Rule 37.

Four steps, in one order

Search evidence has to be handled in a sequence, and the sequence is not a matter of taste. Each step is the precondition for the one after it.

1. Preserve. Identify every system holding relevant data, establish what each retains and for how long, and stop the clock or export before it runs out.
2. Capture. Record what currently exists on the public web, in a form that documents the process that produced it rather than only the result.
3. Authenticate. Choose the foundation route in advance — a witness, a comparison, a process, or a certification — and build the record that route needs.
4. Summarize. Turn the volume into an exhibit that qualifies as substantive evidence, rather than one that is shown once and taken away.

Run them out of order and the work compounds badly. A chart is only as good as the admissibility of what sits under it; that material is only authenticable on the strength of what was recorded when it was collected; and nothing can be collected from a system that purged it in July.

Step one: preserve, before anything else

An ordinary litigation hold reaches almost none of this. A standard hold instructs custodians to stop deleting documents and suspends automatic mailbox purging. Nobody's mailbox holds Search Console performance data, an analytics retention setting, a CDN edge log, or a rank-tracking history. Those live in four or five separate platforms, under four or five separate administrators, and in a meaningful number of matters the administrator is the agency the client is suing.

Preservation in a search dispute is therefore affirmative work, not a suspension of routine deletion. It means exporting performance data out of a rolling window before the window moves. It means writing to the hosting and CDN administrators to halt log rotation, in writing, with a date. It means establishing what an analytics property's retention setting is currently set to — a question of fact in each matter, answered from the property's own configuration rather than assumed — and exporting event-level detail immediately. It means paying to keep a third-party subscription alive so its history does not vanish with the account.

It also runs in both directions. The party that sends a precise letter puts the other side on notice of exactly which systems it will be asked about. The party that sends a generic one has preserved nothing and warned nobody.

Step two: capture what exists now, and capture it properly

Everything on the public web at the moment a dispute starts is available and free, and most of it is collected badly. A screenshot answers one question: what did this look like to whoever pressed the key. It does not record the URL actually served, the status code the server returned, the chain of redirects the browser followed to arrive there, the response headers, the time in any stated timezone, the tool that produced the image, or the user agent — the identifying string a client sends with each request, which changes what many servers return.

A capture that can be defended records all of those together, and computes a cryptographic hash of each stored file at the moment of capture. The hash is what converts a later argument about tampering into arithmetic. It also has to be done to the site as a whole, not to the two pages someone thought were important, because a redesign six weeks later destroys the ability to examine any question nobody thought to ask.

The same discipline applies to exports from systems a party still controls. Every export has parameters — date range, filters, timezone, segment definitions, sampling — and an export without them is a number without a source.

Step three: authenticate, by a route chosen in advance

Rule 901(a) requires the proponent to produce evidence sufficient to support a finding that the item is what the proponent claims it is. That is a low bar, and it is a bar that web evidence still falls under regularly, because the proponent arrives at the hearing without having decided which route it is taking. There are four in ordinary use, and they demand different preparation.

• A witness with knowledge under Rule 901(b)(1) — the person who made the capture, or an administrator of the system that produced the record.
• Distinctive characteristics under Rule 901(b)(4), and comparison against an independently authenticated specimen — the route the Federal Circuit endorsed in Valve Corp. v. Ironburg Inventions Ltd., 8 F.4th 1364 (Fed. Cir. 2021), holding that expert testimony was not required for it.
• A process or system under Rule 901(b)(9) — evidence describing a process and showing that it produces an accurate result. This is the hook for crawlers, capture tools, logging systems, and analytics platforms, and it is why what you record about the process matters as much as what you record about the page.
• Certification under Rules 902(13) and 902(14), which make a system record and a hash-verified copy self-authenticating on a qualified person's certification, subject to Rule 902(11)'s requirement of reasonable written notice and an opportunity to inspect.

One route is closed in one circuit and worth knowing before you rely on it. In Weinhoffer v. Davie Shoring, Inc., 23 F.4th 579 (5th Cir. 2022), the Fifth Circuit held that a court may not take judicial notice of a Wayback Machine capture, because a private internet archive is not a source whose accuracy cannot reasonably be questioned under Rule 201(b)(2). The material still comes in — but through Rule 901, ordinarily with a witness who has personal knowledge of the archive's process. The full text of Rule 901 is at Cornell.

Step four: summarize into something that reaches the jury

Since 1 December 2024 two rules govern the charts this discipline produces, and they end in different places. Rule 1006, as amended, admits a summary, chart, or calculation of voluminous admissible material as substantive evidence, whether or not the underlying material has been introduced. New Rule 107 governs the illustrative aid, which is not evidence and must not go to the jury during deliberations unless all parties consent or the court orders otherwise for good cause. Both were adopted by the Supreme Court on 2 April 2024 and took effect on 1 December 2024.

Read backwards, Rule 1006 is a preservation rule wearing an exhibit number. It requires that the underlying material be admissible, and that the originals or duplicates be made available to the other parties for examination or copying at a reasonable time and place. A chart drawn from an export nobody can lay a foundation for is a summary of inadmissible material; a chart drawn from data that expired is a summary of nothing. Neither defect is visible on the face of the chart, and both are settled long before an exhibit list is due. The rule is at Cornell.

Where the sequence breaks, and what the break costs

In my experience the collapse is almost always at step one, and it presents at step four. The expert is retained after the pleadings close. The analytics were reconfigured during a redesign, the logs for the relevant quarter are gone, the agency's rank-tracking account lapsed at termination, and the site has been rebuilt twice. What is left is partial substitutes: archive snapshots for page content, third-party indexes for links and rankings, a different engine's tools for query data.

Every one is partial, and the partiality is technical rather than legal. Whether a substitute answers the question the case asks, at the granularity it needs, is an assessment somebody has to perform — and it is the assessment that decides whether lost data cannot be restored or replaced, a threshold under Rule 37(e) before any sanction is available at all.

The cost of the break is not that the case fails. It is that every remaining question gets answered with an estimate, and estimates are what motions to exclude are made of.

What a complete record looks like

At the end of a properly built record, the following exist and are dated:

• Native exports from every platform, with the export parameters recorded and the account and property identifiers stated.
• Forensic captures of the disputed pages and results, each with its raw response, headers, response chain, timestamps, tool version, and a hash computed at capture.
• Full crawls of the site at intervals, retained with the raw response bodies rather than as a summary table.
• The change record — deployment logs, content management revision history, robots.txt and redirect history, and the dated versions of the disavow file.
• Derivation artifacts — the script or stated query that turns each raw export into each exhibit.
• A custody log recording who collected what, from which account, at what time, and where it has been stored since.

None of that is exotic, and it is cheap relative to the motion practice it prevents. It is, however, the product of decisions taken in the first weeks of a dispute, usually before anyone is retained. Where a matter is heading toward litigation and these systems are still running on their defaults, counsel and a technical examiner are both needed, and the sequence above is the order they work in.

Frequently Asked Questions

Published 2026-08-11