This is a HOT question!
These demands are being done across the board with no real guidelines.
There really are only 2 ways to preserve Electronic Data.
- STOP using the device and disconnect it from ANY connectivity. Leaving it sit unused in the same status as when you received the notice.
- Get an immediate forensic Extraction of the device
We have a focused topic on this in our blog.