How Long Must Evidence Be Kept After a Forensic Investigation?

A Complete Reference for Insurers, Legal Counsel, and Forensic Professionals

There is no single answer to how long evidence must be kept after a forensic or site investigation — but there is a framework for getting it right. This article sets out that framework: the governing legal principles, the retention requirements by evidence type, the triggers that extend those periods, and the consequences of getting it wrong.

This is intended as a practical reference for everyone involved in managing investigation files: insurers, adjusters, legal counsel, forensic engineers, fire investigators, and subrogation professionals.

Evidence Retention Is Event-Based, Not Time-Based — Here’s Why It Matters

The most important concept in evidence retention is that the obligation is event-based, not calendar-based.

Evidence must be preserved until the litigation risk associated with it is extinguished — not simply until a fixed period has elapsed. A two-year retention policy applied mechanically, without regard to whether litigation is active or anticipated, is not a compliant policy. It is a disposal schedule that may destroy evidence while a claim is still viable.

The correct question is not “how long has it been?” but “has the litigation risk passed?”

Litigation risk is extinguished when:

• All known interested parties have completed inspection
• No litigation is active, pending, or reasonably anticipated
• The applicable limitation period has expired without a claim being commenced
• Written authorization for disposal has been obtained from the responsible party

Until all of these conditions are met, the retention obligation continues.

Ontario Limitation Periods: The Legal Foundation for Evidence Retention

In Ontario, the Limitations Act, 2002 establishes the legal deadlines within which civil claims must be commenced. These periods directly govern how long evidence must be preserved to remain useful and to avoid spoliation exposure.

Basic limitation period: 2 years. Most civil claims must be commenced within two years of the date the claim was discovered — the date a reasonable person in the claimant’s position would have known they had a claim against an identifiable defendant. This is the minimum floor for evidence retention on any file with civil liability potential.

The discoverability rule. The two-year clock does not necessarily start on the date of loss or the date of the investigation. It starts when the claimant discovered — or ought to have discovered — that they had a claim. On complex files involving latent defects, product liability, or delayed property damage, the discovery date may be well after the incident. This can extend the effective retention window significantly beyond two years from the date of loss.

Ultimate limitation period: 15 years. Regardless of when a claim is discovered, no civil proceeding may be commenced more than 15 years after the act or omission giving rise to the claim. For high-value losses, product liability matters, or long-tail exposures, this is the outer boundary of civil liability — and therefore the outer boundary of evidence retention risk.

Subrogation-specific consideration. In subrogation, the limitation period typically runs from when the insurer paid the claim and became subrogated to the insured’s rights — not from the date of loss. On files where payment was delayed, the effective limitation window may extend well beyond what a date-of-loss calculation would suggest.

Other provinces. Limitation periods vary across Canada. Most provinces have adopted a two-year basic period, but practitioners should verify the applicable period for any file involving property or parties in a jurisdiction other than Ontario.

How Long to Keep Each Type of Evidence: Requirements by Category

Different evidence types have different characteristics and different retention requirements. The table below summarizes the key categories.

1. Physical Evidence: The Highest-Stakes Category

Physical evidence — failed components, debris samples, equipment, artifacts collected from the site — is the most consequential category. It cannot be regenerated. Once disposed of, it is gone permanently.

Minimum retention: 2 years from the date of the final report, subject to all event-based conditions being met.

Extended retention applies when:

• Subrogation is active or anticipated
• The failed component is the subject of product liability exposure
• Another party has not yet had the opportunity to inspect
• The loss is high-value, complex, or involves multiple insurers

Custody and possession. The retention obligation rests with the party in possession of the evidence — whether that is the insured, the insurer, a forensic firm, or another custodian. Possession determines responsibility. Where large items remain on-site after investigation (due to size, weight, or ongoing access requirements), the party controlling that site bears the preservation obligation.

Chain of custody. Chain of custody documentation must be maintained from the moment evidence is collected through to its final disposition. Any break in the chain — undocumented transfer, change of location without recorded authorization, loss of control — can compromise the admissibility of the evidence and expose the custodian to spoliation claims.

Disposal. No identified physical evidence should be disposed of without:

• Written authorization from the retaining client or responsible party
• Prior written notice to all known interested parties, with a reasonable inspection window (30 days is standard practice)
• Documentation of the disposal itself (who authorized it, when, how it was carried out)

2. Photographs and Video: Preserving What No Longer Exists

Site photographs, video walkthroughs, drone footage, and scene documentation are a primary record of conditions that no longer exist. The scene changes — it is demolished, remediated, or simply deteriorates. The photographic record is often the only surviving evidence of the original conditions.

Minimum retention: Same as the underlying file — 2 years minimum, extended for any file with active or anticipated litigation.

Format and integrity requirements. Photographs must be retained in their original, unedited format. Metadata embedded in image files — date, time, GPS coordinates, device information — is part of the evidentiary record and must be preserved. Cropped, filtered, or otherwise edited versions may be prepared for reports, but originals must be maintained separately and intact.

Storage. Digital photographic files should be stored in a format that will remain accessible over the retention period. Proprietary formats that may become obsolete are a risk. Standard formats (JPEG, TIFF, RAW) stored in redundant locations (local and cloud backup) are best practice.

Volume. Unlike physical evidence, digital photographic records have negligible storage cost. There is no legitimate reason to cull the photographic record before the retention period has expired. All photographs taken at a scene — including those not selected for the final report — should be retained.

3. Electronic and Digital Evidence: Integrity and Native Format Requirements

Electronic evidence includes data recovered from equipment — control system logs, fault records, SCADA data, alarm panel histories, event logs from transformers and switchgear, surveillance footage, and any other machine-generated records relevant to the investigation.

Minimum retention: 2 years from the final report, subject to event-based conditions.

Integrity requirements. Under the Canada Evidence Act, electronic records are admissible if the party tendering them can establish that the system used to create, store, or transmit the record was operating properly and that the record has not been altered. This means electronic evidence must be stored in a manner that preserves its integrity and supports authentication. Hash verification, write-protected storage, and documented chain of custody for electronic files are best practices.

Native format preservation. Electronic evidence should be retained in its native format — the original file, not a screenshot or printout. Where native format is not practical (e.g., proprietary equipment data), the extraction method and the tool used to extract the data should be documented.

Metadata. Metadata is part of the evidentiary record for electronic files. File modification dates, access logs, and system timestamps are relevant. Evidence that has been opened, copied, or modified without documentation loses probative value.

4. Field Notes and Working Papers: Discoverable, Non-Negotiable

Field notes, sketches, hand-drawn diagrams, measurements, and working papers generated during the investigation are part of the evidentiary record — not just internal working documents. In litigation, opposing counsel may seek production of an expert’s complete file, including notes that pre-date or differ from the final report.

Minimum retention: Same as the file. Field notes must be retained in their original form and must not be altered or destroyed after the investigation is complete.

What this includes: All contemporaneous notes taken at the scene, measurements and calculations, sketches and rough diagrams, interview notes, and any written record made during the course of the investigation.

What this means in practice. Field notes that are inconsistent with the final report do not become less relevant because of that inconsistency — they become more relevant in litigation. Notes must be retained as made. Altering or destroying field notes after the fact exposes the investigator and their retaining client to serious credibility and spoliation consequences.

5. Investigation Reports and Expert Opinions: Seven-Year Standard

The final investigation report, any supplemental reports, preliminary findings communicated in writing, and expert opinions in any form are core records of the file.

Minimum retention: 7 years from the date of the final report is standard professional practice for engineering and forensic files. Where the matter proceeds to litigation, the file must be retained until final judgment plus a minimum of 2 years.

Draft reports. Draft reports and preliminary opinions are discoverable in litigation. They should be retained as part of the file. A draft report that differs materially from the final report will be of interest to opposing counsel and must be available if sought in production.

Working files. Calculations, data analysis, laboratory requests and results, third-party test reports, and all materials that informed the final opinion are part of the expert’s file and are subject to the same retention standard as the report itself.

6. Laboratory and Testing Records: Special Rules for Destructive Testing

Where physical evidence has been submitted for laboratory analysis — materials testing, chemical analysis, metallurgical examination, fire debris analysis — the laboratory records are part of the evidentiary chain.

Minimum retention: Laboratory reports and chain of custody records for submitted samples should be retained for the same period as the underlying investigation file.

Destructive testing. Where testing is destructive — the sample is consumed or altered in the process — the laboratory record is the only surviving evidence of the sample’s condition. These records warrant the same care as the original physical evidence. Before destructive testing is conducted, all known interested parties should be notified and given the opportunity to attend or object.

Third-party labs. Where samples are submitted to an external laboratory, the retaining party should confirm that the lab’s own retention policies are consistent with the file’s requirements, and should request return of any remaining sample material upon completion of testing.

7. Communications and Correspondence: The Overlooked Category

Emails, letters, retainer agreements, scope confirmations, invoices, and other correspondence generated during the investigation are part of the file record and may be relevant in litigation.

Minimum retention: 7 years is standard for business records in most professional and insurance contexts, consistent with CRA requirements for business records and general commercial practice.

Scope confirmations. Written confirmations of the scope of investigation, access authorizations, and instructions from the retaining client are particularly important. They document what the investigator was asked to do and what access they were given — relevant if the scope of the investigation is later challenged.

Litigation hold notices. Any communication received directing that evidence or records be preserved — a litigation hold notice from counsel, a preservation demand from an adverse party — must itself be retained and must trigger immediate review of all evidence and records on the file.

Evidence Retention by Type: Minimum Periods and Key Conditions

When the Clock Resets: Events That Extend Evidence Retention Obligations

Certain events require immediate review of all evidence on a file and will extend retention obligations regardless of where the file stands in its standard retention cycle:

Litigation hold notice. Receipt of a formal preservation demand or litigation hold notice from any party — counsel for the insured, an adverse insurer, a defendant, or a regulatory body — immediately suspends any planned disposal and requires preservation of all evidence and records on the file.

Subrogation action commenced. Where a subrogation claim is filed or formally anticipated, evidence must be preserved until the action is fully resolved, including any appeal period.

Criminal referral or regulatory investigation. Where a matter is referred to police or a regulatory authority (fire marshal, technical standards authority, occupational health and safety regulator), all evidence must be preserved until the authority confirms it is released.

Identification of additional responsible parties. Where investigation reveals a potentially responsible party not previously identified, the limitation period with respect to that party may not have begun to run. Evidence must be preserved until the liability landscape is fully resolved.

Re-opening of a closed file. A file considered closed for limitation purposes may be re-opened if new facts come to light that restart the discoverability clock. Where there is any doubt, retain.

Spoliation Risk: The Legal Consequence of Improper Evidence Disposal

Spoliation is the destruction, alteration, loss, or failure to preserve evidence that is relevant to actual or anticipated litigation. In Ontario civil practice, courts have broad remedies available where spoliation is established.

Consequences can include an adverse inference against the party responsible for the loss of evidence — the court may instruct a jury that the missing evidence would have been unfavorable to that party. In serious cases, expert evidence that depended on access to destroyed material may be excluded, or a claim or defence may be struck entirely.

In the insurance and subrogation context, spoliation most often arises in three ways:

• Physical evidence disposed of before all parties have had the opportunity to inspect
• Remediation or demolition of a loss site before adverse parties could attend
• Electronic records deleted or overwritten before their relevance was recognized

The best protection against spoliation exposure is a documented, consistent retention policy applied across all evidence types — one that is event-driven, not calendar-driven.

Evidence Retention on Multi-Party and Joint Investigation Sites

On investigations involving multiple insurers, multiple investigators, or contested liability — including joint scene investigations where more than one forensic firm is present — the retention obligation applies to every party in possession of identified evidence.

The presence of another party’s investigator at the scene does not discharge your own preservation obligation. It does not mean the other party has already seen everything it needs to see. Destructive testing, re-examination, or independent analysis by an adverse party’s expert may be sought at a later stage. Evidence must be available for that purpose.

Where joint scene access has been conducted, the investigators present should document in their reports who attended, what evidence was observed, and what was its condition and location at the time. This contemporaneous record is the most reliable protection against subsequent spoliation allegations.

Four Principles for a Compliant Evidence Retention Practice

A compliant evidence retention practice has four components:

1. Document custody from day one. Chain of custody records should be established at the moment evidence is collected. Every transfer, every change of location, every access for examination or testing should be documented. The chain must be unbroken from collection to final disposition.

2. Notify relevant parties promptly. All known interested parties should be identified early and placed on notice of the evidence. On fire investigations, this means adverse insurers and potentially responsible parties. On equipment failure investigations, this may include the manufacturer, the installer, and the maintenance contractor. Early notice reduces spoliation risk and, on subrogation files, strengthens the recovery position.

3. Do not dispose without authorization. No evidence should be disposed of without written authorization from the responsible party and prior written notice to all known interested parties. The notice should specify what is to be disposed of, when disposal will occur, and provide a reasonable window for any party to object or request inspection before disposal proceeds.

4. Apply event-based review, not calendar triggers. Rather than scheduling disposal at a fixed date, retention decisions should be made by reviewing the status of the file: Is litigation active? Has subrogation been resolved? Have all parties inspected? Has the limitation period been confirmed as expired? These questions, not a calendar date, should govern the disposal decision.

This article addresses civil forensic and insurance investigation practice. Evidence retention in criminal investigations is governed by separate statutory and common law obligations and is outside the scope of this article. Practitioners with questions about specific files should consult legal counsel.

Dealing with an active investigation file?
MC Forensics provides independent forensic engineering for insurers, adjusters, and legal counsel across Ontario — electrical, fire and explosion, mechanical, equipment breakdown, and complex losses.
Request a Consultation