What is spoliation in a family-law context?

Spoliation is the destruction or material alteration of evidence, or the failure to preserve it, when the party had a duty to preserve. The duty to preserve typically attaches when litigation is reasonably anticipated, not when the petition is filed. In family-law matters, that often means well before service. Most jurisdictions require the moving party to show three elements: control of the evidence, relevance to the claim, and a duty to preserve at the time of destruction. The supporting forensic record is what determines whether a court finds those elements met.

What sanctions are available when a party deletes evidence?

Sanctions range across a wide spectrum depending on jurisdiction and the strength of the showing. Adverse-inference jury instructions tell the trier of fact to assume the destroyed evidence was unfavorable to the destroying party. Monetary sanctions can include fees and costs of the forensic work needed to prove the destruction. Pleading-strikes remove specific defenses or claims from the case. Default judgment is the most extreme outcome and is reserved for egregious or repeated conduct. Stronger forensic showings usually push the court toward the more severe end of the range.

Can a forensic examiner detect that a phone was wiped?

Often yes. iOS records the most recent erase event in system logs, and iCloud account activity logs preserve sign-in and password-change events even after the device itself is reset. Android leaves indicators in the recovery partition and in Google account activity. Application reinstall patterns where install history exists but app data is empty are forensically identifiable as uninstall-then-reinstall behavior. Anti-forensic tools like Secure Eraser, iShredder, and File Shredder leave detectable artifacts even after removal. Selective deletion of SMS rows in a specific date range leaves a SQLite gap that is identifiable.

What evidence is hard to wipe even after a factory reset?

Server-side artifacts often persist. The Apple Privacy Report at privacy.apple.com is a discoverable export listing logins, device additions, recovery method changes, and password resets. Google's My Activity is a comprehensive log of search, Maps, YouTube, and app activity, retained until the user changes auto-delete settings, and changing those settings itself logs. iCloud backup history can be subpoenaed from Apple even when the user deleted the most recent backup. Find My and Find My Device location histories are discoverable and frequently uncontested.

How is a spoliation motion built forensically?

The strongest motions combine four elements. A timeline exhibit showing the preservation-letter date, the device-reset date, and the first interaction with a replacement device. A comparison forensic image when one was preserved before the destruction window. Cross-source corroboration where carrier records show texts that no longer exist on the device or cloud backups show photos now missing. And an expert affidavit declaring that the observed pattern is consistent with intentional destruction rather than ordinary device behavior. Each element reinforces the inference of intent.

What does an expert witness do at a spoliation hearing?

The forensic expert is voir dired, qualifies under Rule 702 or the state equivalent, and testifies to the methodology, the artifacts examined, and the conclusions drawn. The expert defends every choice on cross-examination, including tool selection, tool version, configuration, and known limitations. The report has to be written with that scrutiny in mind, which means findings stated factually with citations to specific artifacts, an explicit limitations section, and exhibits including hash records and screenshots. Reports written without trial in mind do not survive cross.

How do attorneys engage forensic litigation support on these matters?

Engagement runs through counsel under attorney-work-product privilege so that findings remain protected through discovery. The typical sequence is a scoping call with counsel, a written engagement letter with hourly rates and a retainer, preservation of any devices already in the attorney's possession, a forensic image taken with documented chain of custody, analysis against the litigation theory, a written report, and expert availability for hearing or trial. The same examiner ideally handles intake through testimony so the witness chair is filled by the person who did the work.

Spoliation in Family Law | Sanctions for Deleted Digital Evidence

All articles·10 min read·April 19, 2026

What spoliation actually requires

Spoliation is the destruction or material alteration of evidence (or the failure to preserve it) when there is a duty to preserve. In family law, that duty kicks in whenlitigation is reasonably anticipated — not when the petition is filed. Most jurisdictions require the moving party to show three elements:

The other party had control of the evidence
The evidence was relevant to the claim
The party had a duty to preserve at the time of destruction

Sanctions range from adverse-inference jury instructions, to monetary sanctions, tostriking pleadings, to default judgment. The strength of your forensic showing usually determines which end of that range you get.

Forensic indicators of phone wiping

Recent factory reset. iOS records the most recent erase event in system logs. Android leaves indicators in the recovery partition and Google account activity. A reset that occurred shortly after the preservation letter is a strong inference.
iOS "Erase All Content and Settings" timestamp — pulled from device system logs and iCloud account activity logs.
Application reinstall pattern. When an app appears in App Store or Play Store install history but its data is empty, that is uninstall-then-reinstall — a common evidence-destruction tactic.
Anti-forensic tool installation. "Secure Eraser," "iShredder," "File Shredder" apps. Forensically detectable from iCloud backups even after removal.
Selective deletion. SMS database missing message rows in a specific date range while preserving rows immediately before and after — the SQLite gap is forensically identifiable.

iCloud / Google account activity that is hard to wipe

Even when the device itself has been wiped, server-side artifacts often remain:

Apple Privacy Report at privacy.apple.com — a discoverable export listing logins, device additions, recovery method changes, and password resets
Google "My Activity" — comprehensive log of search, Maps, YouTube, and app activity, retained until the user changes auto-delete (which itself logs)
iCloud backup history — even if the user deleted the most recent backup, older backups can be subpoenaed from Apple
Find My / Find My Device location history — discoverable, often uncontested by the user

Building the spoliation motion

The strongest motions we have supported include:

Timeline exhibit. Preservation letter date → device-reset date → first interaction with replacement device. When these three dates are within the same week, intent becomes hard to dispute.
Comparison forensic image. If you forensically imaged the device before the preservation period (rare but powerful), comparing pre/post images shows exactly what is gone.
Cross-source corroboration. Carrier records show texts that no longer exist on the device. Cloud backups show photos that were on the device but are now missing. Each absent artifact reinforces the inference.
Expert affidavit. A qualified forensic examiner declares, under oath, that the observed pattern is consistent with intentional destruction and not with ordinary device behavior or routine maintenance.

What the other side will argue, and how to counter

"Phone was lost / damaged." Counter with carrier records showing the same device IMEI active during the period, or with a forensic image that shows it functioned normally.
"The reset was for a separate reason — selling the phone, gifting to a child." Counter with the timing argument and with proof that no transfer actually occurred.
"I didn't know I had a duty to preserve." Counter with the preservation letter, prior counsel correspondence, or any communication that put them on notice.

What we provide for these motions

Forensic-led litigation support —device imaging, anti-forensic activity analysis, written expert opinions, and expert-witness testimony at hearing or trial. We work directly with counsel and produce findings under attorney-work-product privilege.