Part 4: Preservation Requests | Module 5

Understanding Preservation Requests

A preservation request is a formal communication to a service provider asking them to preserve (not delete) specific data that may be relevant to a criminal investigation. Unlike a production request (which asks for data to be provided), preservation merely asks the provider to maintain the data until a proper legal request can be made.

📚 Why Preservation Requests Matter

Digital data is routinely deleted by service providers as part of their data retention policies. A social media platform may delete IP logs after 90 days, an email provider might purge deleted emails after 30 days. A preservation request prevents this automatic deletion, buying time for investigators to obtain proper legal process.

🛠 Practical Tool Available

Use the Preservation Request Generator Tool to create platform-specific preservation requests with correct formatting and required information fields.

Preservation vs. Production Requests

Aspect	Preservation Request	Production Request
Purpose	Prevent data deletion	Obtain data for investigation
Legal Basis	Voluntary compliance/Section 79 IT Act	Section 94 BNSS/MLAT/Court Order
Data Provided	No data provided to investigator	Data provided to investigator
Timeline	Immediate - within hours	Days to months depending on platform
Duration	Typically 90 days, renewable	Until data is provided or request rejected
Follow-up Required	Yes - production request must follow	No - data is provided

⚠ Critical Timeline

Send preservation request IMMEDIATELY upon identifying a relevant account or data. Do not wait for the production request to be ready. Data can be deleted at any time, but once preserved, you have 90 days (typically) to follow up with a proper legal request.

Platform-Specific Procedures

Google (Gmail, YouTube, Google Drive, etc.)

Law Enforcement Request System (LERS)

Portal: https://lers.google.com

Data Covered: Gmail, YouTube, Google Drive, Google Photos, Google Account info, Chrome sync data, Android device data

Preservation Duration: 90 days, renewable for additional 90-day periods

Required Information:

Google Account email address OR YouTube channel URL OR Google+ ID
Date range for data preservation
FIR number and brief case description
Official email address of requesting officer

Response Time: Usually within 24-48 hours for preservation confirmation

Emergency Requests: Available for cases involving imminent threat to life

Meta (Facebook, Instagram, WhatsApp)

Law Enforcement Response Team

Portal: https://www.facebook.com/records

Data Covered: Facebook profiles, Instagram accounts, WhatsApp (limited), Messenger

Preservation Duration: 90 days, one extension possible

Required Information:

Facebook User ID (numeric) OR Profile URL OR Instagram username
For WhatsApp: Phone number with country code
FIR reference and applicable legal sections
Brief description of alleged offense

Important Note: WhatsApp messages are end-to-end encrypted and cannot be provided by Meta. Only metadata (account info, connection logs) available.

Response Time: 24-72 hours for preservation; 2-4 weeks for production

X (formerly Twitter)

Legal Requests - Law Enforcement Guidelines

Portal: https://legalrequests.twitter.com

Data Covered: Account information, tweets, DMs (with valid legal process), IP logs

Preservation Duration: 90 days

Required Information:

X/Twitter username (@handle) OR user ID
Specific tweet URLs if applicable
Date range for preservation
Legal reference and investigation description

Note: X may require a court order or MLAT request for content data disclosure to Indian authorities.

Microsoft (Outlook, OneDrive, Xbox, LinkedIn)

Law Enforcement Requests

Portal: Via email to LErequest@microsoft.com or online portal

Data Covered: Outlook/Hotmail, OneDrive, Skype, Xbox, LinkedIn, Microsoft 365

Preservation Duration: 90 days, renewable

Required Information:

Microsoft Account email or Skype ID
Date range for data
FIR details and legal sections

Sample Preservation Request Templates

General Template for International Platforms

PRESERVATION REQUEST To: [Platform Name] Law Enforcement Response Team From: [Officer Name], [Rank] [Police Station/Unit Name] [Department/State Police] [Country: India] Date: [DD/MM/YYYY] Reference: FIR No. [XXX/2026] dated [DD/MM/YYYY] Police Station: [Name] Sections: [66C, 66D IT Act 2000 / 316, 318 BNS 2023] REQUEST FOR PRESERVATION OF RECORDS I am the Investigating Officer in the above-referenced case involving [brief offense description - e.g., "online financial fraud", "cyber stalking", "impersonation"]. I hereby request preservation of all records associated with the following account(s): Account Identifier(s): 1. [Email address / Username / User ID / Profile URL] 2. [Additional accounts if any] Data to be Preserved: - Account registration information - IP addresses and login history - Content posted by the account - Direct/Private messages - Connection data and associated accounts - Any other stored communications Time Period: From [DD/MM/YYYY] to [Present/DD/MM/YYYY] This preservation request is made pending formal legal process which will be submitted through appropriate channels. The data is essential to identify the perpetrator and gather evidence in this criminal investigation. Please preserve the above data for 90 days and confirm receipt of this request. For any clarifications, please contact: Name: [Officer Name] Official Email: [official.email@police.gov.in] Phone: [+91-XXXXXXXXXX] Designation: [Rank, Police Station] Signature: ____________________ (Official Seal/Stamp) Attachments: 1. Copy of FIR 2. Official ID card copy (if required by platform)

Emergency Disclosure Request Template

EMERGENCY DISCLOSURE REQUEST URGENT - THREAT TO LIFE To: [Platform Name] Emergency Response Team This is an emergency request involving imminent threat to life/serious bodily harm. EMERGENCY DETAILS: Nature of Emergency: [e.g., Kidnapping with ransom demand, Suicide threat, Bomb threat] Victim Information: [Name if known] Imminent Risk: [Description of immediate danger] Time Sensitivity: [e.g., Ransom deadline in 24 hours] Account Information: [Account identifier] Data Required Immediately: - [Specific data needed - e.g., IP address of last login, subscriber information] This request is made under emergency circumstances where there is reasonable belief that death or serious physical injury may result if the information is not disclosed immediately. Requesting Officer: Name: [Name] Rank: [Rank] Unit: [Unit/Station] 24x7 Contact: [Mobile Number] Email: [Email] Supervisor: Name: [Supervisor Name] Designation: [Rank] Contact: [Phone] Date/Time: [DD/MM/YYYY HH:MM IST]

Response Timelines and Escalation

Platform	Preservation Response	Production Response	Emergency Response
Google	24-48 hours	2-4 weeks	Within hours
Meta (FB/Instagram)	24-72 hours	2-6 weeks	Within hours
X (Twitter)	48-72 hours	2-6 weeks	24 hours
Microsoft	24-48 hours	2-4 weeks	Within hours
Apple	24-48 hours	2-4 weeks (MLAT may be required)	24 hours
Indian Telecom	Same day	3-7 days	Within hours

Escalation Procedures

First Follow-up: After 72 hours if no acknowledgment received
Second Follow-up: After 7 days, escalate to senior officer level
Involve I4C: Indian Cyber Crime Coordination Centre can assist with escalation to foreign platforms
MHA Route: For critical cases, route through Ministry of Home Affairs for diplomatic channels
MLAT Process: For formal legal process with foreign countries, initiate MLAT request through MHA

Best Practices for Effective Requests

💡 Tips for Success

Use Official Email: Always send from official government email domain (.gov.in, .nic.in)
Be Specific: Provide exact account identifiers, not just "the Facebook account of person X"
Include FIR Copy: Attach a copy of the FIR to establish legal basis
Correct Identifiers: Verify usernames/IDs are correct before sending - typos waste time
Single Account Per Request: Some platforms prefer separate requests for each account
Track Your Requests: Maintain a log of all requests sent with dates and responses
Follow Platform Guidelines: Each platform has specific format requirements - follow them
Renew Before Expiry: Send renewal requests before the 90-day preservation expires

Common Mistakes to Avoid

Sending from personal email instead of official email
Not including FIR reference or legal sections
Vague account descriptions without specific identifiers
Not specifying the date range for preservation
Forgetting to follow up with production request before preservation expires
Using wrong platform portal (e.g., using consumer support instead of law enforcement portal)

📚 Key Takeaways

Send preservation requests IMMEDIATELY - do not wait for production request preparation
Preservation prevents data deletion for 90 days (typically), buying time for legal process
Each platform has its own law enforcement portal - use the correct one
Always use official government email addresses for requests
Include specific account identifiers, FIR reference, and date ranges
Emergency disclosure is available for imminent threat to life situations
Follow up systematically and escalate through I4C if needed
Track all requests and renewal dates in a case log