What to Preserve When You Learn of a Criminal Investigation in Utah

If you learn that law enforcement is investigating you, preserve existing information in its original condition and obtain legal advice before you delete, alter, transfer, annotate, publish, or try to “explain” it. Preservation is not the same as concealment, fabrication, or indiscriminate copying. The immediate objective is to keep relevant material and its context intact while counsel determines what is lawful, necessary, and useful.

Do not use this article to decide whether to give investigators consent, access to a device or account, a password, documents, or a statement. Those are separate legal decisions that should be made after advice about the actual request, warrant, subpoena, order, ownership, and facts.

Preserve first; interpret later

People often react to an investigation by cleaning up a phone, deleting embarrassing messages, editing a calendar entry, rewriting a note, contacting witnesses, or posting an explanation. Those actions can destroy context, create a misleading version history, generate new evidence, or be characterized in a way the person did not anticipate.

Preservation means keeping what already exists. It ordinarily includes the original item and enough surrounding information to understand when it was created, where it was stored, who controlled it, and whether it changed. A screenshot can be useful, but it may omit metadata, surrounding messages, account information, or the original file. Do not replace the original with a screenshot or a rewritten summary.

Potentially relevant digital sources

Depending on the matter, information may reside in:

• text messages, email, messaging applications, and social-media accounts;
• photographs, videos, audio, and cloud libraries;
• call logs, voicemail, contacts, calendars, and notes;
• location history, maps, ride services, travel records, and vehicle systems;
• financial, payment, shopping, or transaction accounts;
• computers, phones, tablets, removable media, and backup systems;
• workplace, school, healthcare, or shared-family systems; and
• home cameras, doorbells, security systems, or connected devices.

This is an issue-spotting list, not an instruction to enter accounts or devices you do not lawfully control. Shared credentials, employer equipment, another person’s account, and third-party systems can create privacy, ownership, authorization, employment, and criminal-law issues. Identify the source for counsel instead of attempting unauthorized access.

Physical records and objects also carry context

Paper documents, receipts, packaging, letters, photographs, clothing, equipment, medication containers, and other objects may matter. Keep them in the condition found. Avoid writing on them, cleaning them, testing them, repairing them, combining them with other items, or passing them among people. Record where the item is and who has lawful custody, but do not invent a retrospective chain-of-custody narrative.

If an item may be illegal to possess, dangerous, contaminated, or subject to a warrant or order, do not move or handle it based on general online guidance. Contact counsel for a safe and lawful protocol.

Stop avoidable deletion without creating a second problem

Automatic systems can delete messages, rotate camera footage, empty trash, overwrite backups, or remove cloud data after a retention period. Tell counsel promptly which systems exist and what they ordinarily do. Counsel can help determine whether and how to suspend relevant deletion while respecting privacy, security, employment, and third-party obligations.

Do not install recovery software, perform forensic imaging, reset a device, restore a backup over current data, or ask an unqualified person to retrieve deleted material. Those steps can alter metadata, overwrite information, expose privileged or private material, and make later forensic work more difficult.

Do not coach witnesses or coordinate accounts

Preserving a witness’s identity is different from contacting the witness to align memories. Do not ask someone to delete messages, change a post, withhold an item, rehearse an account, or communicate with investigators on your behalf. Do not send group messages attempting to settle what “really happened.” Preserve existing communications and give counsel the names and neutral context needed to evaluate lawful investigation.

Warrants, subpoenas, and consent requests require exact review

An officer may ask to speak, request consent to search, serve a subpoena, execute a warrant, or seize property. Each presents different questions. Keep a copy of any paper provided, note the date and time, identify the agency and personnel if known, and preserve any property receipt or inventory. Do not physically interfere with execution of legal process. At the same time, do not assume that a request labeled “routine” must be answered without counsel.

Utah Rule of Criminal Procedure 16 illustrates the breadth of material that may become part of criminal discovery, including statements, reports, scientific results, physical and electronic evidence, warrants, documents, photographs, digital recordings, and witness material. The rule governs disclosure in a filed criminal case; it is not a universal personal preservation rule. Its categories nevertheless show why the original record and its context can matter.

Utah evidence-tampering law reinforces the need for care

Utah Code section 76-8-510.5 addresses tampering with evidence and reaches documents, files, electronic compilations, and other items when the statutory elements are satisfied. Whether conduct violates the statute depends on the facts and the law; the point here is preventive. Do not destroy, conceal, alter, or fabricate material because you believe it will look unfavorable. Seek advice before taking action that changes evidence or its availability.

A useful consultation inventory

Prepare a short source inventory rather than a persuasive narrative. Identify the devices and accounts involved, who owns or controls them, ordinary deletion settings, relevant date ranges, physical items, papers received from investigators, possible witnesses, and known deadlines. Keep facts separate from assumptions. Do not send sensitive material through an unapproved channel; ask counsel how it should be transferred.

Early preservation can protect both sides of the record. It can retain information that challenges an allegation just as surely as it preserves information the government may seek. The value lies in maintaining an authentic record from which informed decisions can be made.

Mountain State Attorneys represents people in Utah criminal investigations and charged cases. Review the firm’s criminal-defense practice, white-collar and financial-offense defense, or confidential contact options.

This article provides general information, not legal advice. Controlling law and available options depend on the facts, date, forum, and jurisdiction of a particular matter.