If I worked at a firm without a document retention policy and a preservation order arising from an active complaint was pending, I would first contact all individuals and supervisors who may be involved and instruct them to immediately refrain from deleting any email or destroying any documents pertinent to the situation. Then, I would contact the firm's IT department. I would ask what information is backed up on our servers and how long that information is retained. I would also ask what communication tools are used by those involved (ie: email, company phones, Slack, Teams, etc.) and what historical information is accessible via these tools