Ten years ago, a federal white-collar case was mostly paper: bank records, printed emails, a hard drive pulled from a desk. Keep the paper clean and the case was hard to make. Those days are over. An investigator can now reconstruct where you were, who you talked to, which app you used to talk to them, and what you deleted afterward, often without asking you a single question.
The old rule was ‘don’t put it in writing.’ The new reality is that almost everything you do is already in writing, somewhere, whether you meant it to be or not.
That shift changes what a careful person should do when a business decision starts to feel wrong. Below are the questions people tend to ask once they realize they might be sitting on the wrong side of one of these investigations.
What Counts as Data Exhaust in the First Place?
Data exhaust is the trail you leave without meaning to. It isn’t the memo you drafted or the spreadsheet you saved. It’s the metadata around all of it: timestamps, login records, location pings, message read receipts, the version history nobody thinks to look at. Most people underestimate how much of it exists and how long it sticks around.
How Do Investigators Actually Get to It
Most of this data doesn’t live with you. It lives with a third party: your carrier, your bank, your cloud provider, your employer. Different rules apply depending on where the data sits and what kind of order the government has in hand.
Long-term location data pulled from a carrier now typically requires a warrant after the Supreme Court’s decision in Carpenter, which treated that kind of prolonged tracking as a Fourth Amendment search. Plenty of other categories, like subscriber records, transactional logs, and older emails, can still be obtained on a lower showing under the Stored Communications Act.
The practical takeaway isn’t the doctrine. It’s that by the time you know a case exists, agents may already have months of your movements, messages, and logins sitting in a binder.
Why Are Text Messages Suddenly Such a Big Deal
Prosecutors used to treat texts as a bonus. Now they treat them as the main event. When employees run business conversations through personal WhatsApp, iMessage, or Signal threads, those threads become discoverable, and the company’s failure to preserve them becomes its own problem.
DOJ made this explicit in its 2023 guidance for evaluating corporate compliance programs, which added a whole subsection on personal devices, third-party messaging apps, and ephemeral communications. If a company can’t produce those messages during an investigation, prosecutors are told not to accept the gap at face value.
For an individual employee, that changes the calculus. The phone in your pocket is now part of your employer’s compliance obligation, and the company’s cooperation credit may depend on whether it can hand over what’s on it.
What Should You Do the Moment Something Feels Off
The instinct to clean up is the wrong instinct. Deleting messages, wiping a laptop, or pulling documents off a shared drive can turn a bad situation into an obstruction charge, and forensic recovery usually surfaces the deletion anyway. The better move is to stop creating new exposure and get advice before you make decisions you can’t take back. Talking to a defense attorney early, before an interview request, before a subpoena, before a colleague’s lawyer calls yours, is what preserves options later.
Where Defense Actually Lives in a Digital Case
A case built on data exhaust looks airtight in a slide deck. In a courtroom, it rarely holds together as neatly. Metadata gets misread. Location pings are less precise than juries assume. Chat exports lose context when a reaction, a thread reply, or a follow-up message drops out. And prosecutors still have to authenticate every record they want to put in front of a jury: showing that a log is what they say it is, that the account belongs to who they say it does, and that nothing was altered along the way.
That’s where a real defense lives now. Not in denying that the data exists, but in pressing on how it was collected, how it was interpreted, and what the story around it leaves out. The paper trail is bigger than it used to be. It’s also noisier, and noise cuts both ways.