I remember sitting across from a brilliant backend developer in a dimly lit coffee shop. Let’s call him Alex.
Alex looked completely defeated.
He had spent four months building a custom inventory-routing system for a mid-sized e-commerce brand.
The final invoice was for $35,000.
The client’s response ?
Total radio silence for three weeks.
Then came an aggressive email claiming the code was “unusable” and full of bugs.
They said they had scrapped the whole project.
They refused to pay a single dime.
But here was the problem.
Alex was a smart developer. He had noticed certain API calls hitting a third-party service he had temporarily hosted during development.
The traffic looked remarkably similar to the behavior of the system he had built.
He suspected the client was still using his work in production.
He looked at me, gripping his coffee cup, and asked:
“How do I prove they are lying?”
Look, it’s a terrifying place to be.
You are staring down a corporate client. You feel completely powerless.
But in the legal world, what you believe happened and what you can prove with admissible or otherwise usable evidence are two different things.
Digital records can sometimes provide powerful corroborating evidence. But server logs are not automatically complete, immutable, or conclusive. They have to be preserved, authenticated, interpreted and connected to the legal claims you are actually making.
And that distinction matters.
When a client claims your software was deleted but you have reason to believe it remains in production, you may have a discovery problem as much as an invoice problem.
In the right case, third-party records from a hosting provider, repository provider, cloud platform or other service may help establish what happened.
Today, I’m going to show you how a subpoena for server logs can potentially help prove that a client continued using your code after a payment dispute.
We are going to bridge the gap between developer logic and courtroom reality.
Important: This article is primarily a U.S.-oriented educational guide. Subpoena authority, discovery procedures, privacy restrictions, preservation duties, admissibility requirements and provider-response rules vary by jurisdiction. A subpoena is not a guaranteed way to obtain every server record, and a server log does not automatically prove copyright infringement, ownership, breach of contract or unauthorized use.
Table of Contents
The Problem: The “Phantom Codebase” Defense
When a client wants to avoid paying for software development, they rarely admit:
“We are still using the system, but we don’t want to pay for it.”
Instead, they may claim that your work was defective.
They may say the project had serious bugs.
They may tell you they hired another development team.
They may claim they had to rebuild everything from scratch.
I call this the “Phantom Codebase” defense.
The basic factual dispute becomes:
You: “You are still using the system I built.”
Client: “We deleted it months ago.”
Without independent evidence, you can end up with a classic “he said, she said” dispute.
That is particularly difficult when the relevant infrastructure is inside the client’s AWS, Google Cloud, GitHub, Vercel, DigitalOcean or other accounts.
You may know the architecture intimately.
You may recognize your own API routes.
You may remember the database structure.
You may even see behavior that looks identical to the system you delivered.
But knowing something happened is not the same as proving it.
If you simply walk into court and say:
“I know they are using it.”
the obvious question is:
“What evidence supports that?”
That is where digital discovery can become important.
If your underlying dispute is broader than server evidence, you may also want to understand what to do when a client uses your work but refuses to pay you, because the server-log issue is usually only one part of the recovery strategy.
What a Server-Log Subpoena Can—and Cannot—Prove
This is the part developers often misunderstand.
A server log can potentially show that:
- a particular server received requests;
- an endpoint was accessed at a particular time;
- an IP address connected to an infrastructure component;
- a deployment or infrastructure event occurred;
- certain application behavior occurred;
- a repository or cloud account recorded particular activity;
- activity continued after a date when the client claimed the system had been removed.
But a log does not automatically establish:
- who personally made the request;
- who owns the underlying software;
- whether every line of your code remained unchanged;
- whether the client had a valid license;
- whether a particular use constitutes copyright infringement;
- whether a contract was breached;
- whether the client acted intentionally;
- or whether the evidence is admissible for every purpose.
Think of logs as pieces of the evidentiary puzzle, not a magical “client is guilty” button.
That distinction will make your case much stronger.
For example:
| Server evidence may help establish | It does not automatically establish |
|---|---|
| An endpoint was accessed | Who personally accessed it |
| A production system remained active | Who owned the system |
| Requests continued after a particular date | Copyright infringement |
| A repository recorded activity | Unauthorized use |
| An IP address interacted with infrastructure | The identity of the individual behind the IP |
| A deployment event occurred | That your entire codebase was deployed |
| Application behavior resembles your implementation | A legally sufficient ownership or infringement claim |
The strongest cases usually combine server records with contracts, invoices, repository history, communications, source-code comparisons, deployment records and other evidence.
If you are dealing specifically with stolen website code, see Client Stole My Website Code: What to Do, Prove Ownership, and Recover Access.
The Law: Discovery and Third-Party Subpoenas
Discovery Is Broader Than the Client’s Own Files
Once you file a civil lawsuit, discovery can allow parties to obtain relevant information within the scope permitted by the applicable procedural rules.
In federal court, the Federal Rules of Civil Procedure govern civil proceedings in the U.S. district courts. The U.S. Courts publishes the current rules and forms.
Discovery can involve documents, electronically stored information, testimony and other forms of evidence.
And importantly, discovery is not always limited to information sitting directly in your opponent’s office.
Rule 45 and Non-Party Records
Federal Rule of Civil Procedure 45 provides a mechanism for subpoenaing a non-party to produce designated documents, electronically stored information or tangible things.
The subpoena must comply with specific procedural requirements. Rule 45 also contains protections for the person or entity receiving the subpoena, including provisions concerning undue burden and objections.
The official federal judiciary also provides Form AO 88B for subpoenas seeking documents, information or objects in a civil action.
That is important because you are not simply emailing AWS and saying:
“Please send me my client’s server logs.”
A civil subpoena is a formal legal process.
And the correct procedure depends on the court, the claims, the provider, the type of records sought and the applicable law.
You can review the current Federal Rules of Civil Procedure from the U.S. Courts before discussing the issue with counsel.
What About the Stored Communications Act ?
This is where the analysis gets more complicated.
Federal electronic-communications law can affect what a provider may disclose and under what circumstances.
The Stored Communications Act contains restrictions concerning certain disclosures by providers of electronic communication and remote-computing services. Whether a particular category of server or account information falls within a particular statutory provision depends on the nature of the provider, the records and the legal process being used.
So do not assume:
“I have a Rule 45 subpoena, therefore every record in the provider’s possession must be handed over.”
That is not a safe assumption.
The legal treatment of account records, content, non-content information and other technical records can differ.
This is precisely why the subpoena should be drafted by counsel familiar with electronic discovery and the applicable jurisdiction.
The Solution : The Discovery Discovery Framework
I created a simple framework for developers trapped in this exact nightmare.
I call it the Discovery Discovery Framework.
Its purpose is not to promise that a subpoena will “crack open” a client’s infrastructure.
Its purpose is to help you think systematically about:
- preserving evidence;
- identifying where potentially relevant records exist;
- determining which records are actually relevant;
- requesting them narrowly;
- analyzing what they really establish; and
- connecting those records to the underlying contract or intellectual-property dispute.
Here is how the process can work.
1. Send a Preservation Letter
Why Preservation Comes First
Before worrying about extracting records, think about whether potentially relevant evidence is disappearing.
If litigation is reasonably anticipated, preservation can become an important issue.
That may include:
- server logs;
- deployment records;
- repository history;
- cloud audit records;
- communications;
- invoices;
- project files;
- source-code versions;
- access records.
A preservation or litigation-hold communication should be carefully drafted for the circumstances.
Do not tell a client:
“You are legally required to preserve everything because I sent this email.”
That is too simplistic.
Preservation obligations depend on the applicable law and the circumstances of the dispute.
But if litigation is reasonably anticipated, ignoring potentially relevant electronic evidence can create serious problems.
Federal discovery rules also address electronically stored information and the consequences that can arise when relevant information is lost in circumstances covered by the rules.
The safest approach is to preserve your own evidence immediately and have counsel assess the client’s preservation obligations.
For broader payment disputes, you may also want to read When Is It Officially Time for a Freelancer to Take Legal Action?.
2. Identify the Host and Architecture
You cannot subpoena “the internet.”
You need to identify where the potentially relevant records actually exist.
Was the application deployed to:
- AWS EC2?
- Amazon CloudWatch?
- AWS CloudTrail?
- Google Cloud?
- DigitalOcean?
- Vercel?
- GitHub?
- another Git provider?
- a managed database?
- a third-party API platform?
If you previously worked on the infrastructure, document everything you legitimately know.
Create a technical evidence map.
For example:
Application: Inventory Routing System
Frontend: Vercel
Backend: AWS EC2
Database: Managed PostgreSQL
Repository: GitHub
CI/CD: GitHub Actions
Monitoring: CloudWatch
Custom API: /api/v2/inventory-route
Relevant period: June 1–July 31
That is much more useful than saying:
“They have my code somewhere in AWS.”
If the client specifically has your software running on AWS, your existing article The Client Has Your Code on AWS and Won’t Pay: The Code-Audit Breakdown is a natural companion resource.
3. Draft the Third-Party Subpoena Narrowly
Do Not Ask for “Everything”
This is where inexperienced litigants often make a mistake.
They become angry and request:
“All records concerning my client, their servers, their users, their employees, their accounts and their use of my software.”
That is exactly the kind of request that can create objections and proportionality problems.
Federal discovery has limits. Relevance and proportionality matter, and courts can restrict discovery when the burden or expense outweighs its likely benefit.
A better request might identify:
- a specific account;
- a specific server or resource;
- a defined date range;
- a specific repository;
- particular deployment records;
- particular access records;
- specific event categories;
- a defined production environment.
For example:
Server access logs between June 1 and July 31 relating to the production instance identified by [specific identifier].
Or:
Cloud audit records reflecting deployment, creation, modification or deletion events for the identified production resources during the specified period.
The exact wording should be determined by counsel after identifying what records actually exist.
Why Specificity Matters
A narrow request helps answer three questions:
What are you asking for?
Why is it relevant?
Why is the burden justified?
That is much stronger than using a subpoena as a fishing expedition.
The federal judiciary’s Rule 45 materials specifically address subpoenas for electronically stored information and the procedural protections surrounding them.
4. Establish the Digital Footprint
Once potentially relevant records are produced, your job is not to scream:
“Gotcha!”
Your job is to determine exactly what the records show.
This is where your developer knowledge becomes extremely valuable.
You know the architecture.
You know the unusual endpoint names.
You know the custom data structures.
You know the deployment patterns.
You know the naming conventions.
You know which components were standard libraries and which components were uniquely created for the client.
Look for Corroborating Technical Identifiers
Depending on the records available, potentially useful identifiers might include:
- unique API routes;
- unusual function names;
- deployment identifiers;
- repository activity;
- custom database structures;
- configuration references;
- timestamps;
- resource identifiers;
- application-specific error messages;
- distinctive request patterns.
Suppose you created:
/api/v2/alex-custom-inventory-route
and the client later claimed the entire system was deleted.
If properly obtained records show repeated production requests to that exact endpoint after the alleged deletion date, that could be powerful corroborating evidence.
But don’t overstate what it proves.
The evidence may establish continued activity associated with that endpoint.
You still need to connect the endpoint to your work and then connect that technical fact to the legal elements of your claim.
That is how you turn a developer observation into useful litigation evidence.
5. Authenticate and Interpret the Records
This is the part many online articles completely ignore.
Getting a spreadsheet of logs is not the end.
You need to ask:
Where did these records come from?
Who produced them?
How were they maintained?
What system generated them?
What does each field actually mean?
Are timestamps in UTC?
Is the IP address a corporate NAT address?
Could multiple employees share it?
Were logs rotated or deleted?
Does the record show an event or merely an inference?
Electronic evidence generally has to be authenticated under the applicable rules before its evidentiary significance can be determined.
For federal cases, the Federal Rules of Evidence include authentication provisions addressing whether evidence is what its proponent claims it is.
You can review the Federal Rules of Evidence through the U.S. Courts and the Federal Rules of Evidence materials at Cornell Law School.
That is why a forensic analyst or technically qualified witness can sometimes be extremely useful.
The goal is not to overwhelm the judge with 500 pages of Nginx logs.
The goal is to explain what those records reliably show.
6. Present Server Metrics to a Lay Judge
This may be the hardest part.
Judges are legal professionals.
They are not necessarily software engineers.
If you hand a judge 500 pages of raw Nginx output, you may have created more confusion than clarity.
Instead, build a simple timeline.
Example
June 1: Client says the system was scrapped.
June 3: Client allegedly deploys replacement software.
June 5: Production records show requests to a distinctive endpoint created during your project.
June 10–June 30: The same endpoint continues receiving substantial traffic.
July 1: Client again states that your implementation was deleted.
July 2–July 15: Relevant records show continued activity.
That does not automatically prove liability.
But it may create a factual contradiction that deserves explanation.
Your objective is to make the evidence understandable without exaggerating what it proves.
Case Study : The $40k Phantom Codebase
Let’s go back to Alex.
Illustrative hypothetical: The following example is a fictional scenario designed to demonstrate how the evidence strategy might work. It is not presented as a report of an actual client matter.
Alex believed the client had continued using portions of his inventory-routing system after refusing to pay the $35,000 invoice.
Rather than accessing the client’s systems himself, Alex preserved his own development records and consulted counsel.
A lawsuit was filed.
Counsel evaluated whether third-party discovery was appropriate and identified the relevant hosting provider.
A narrowly tailored subpoena was then pursued through the applicable legal process.
The records obtained included technical information concerning the relevant production environment during the disputed period.
Alex’s development records showed a distinctive caching implementation and unusual API architecture.
The production records showed activity consistent with those distinctive technical characteristics after the date on which the client claimed the system had been abandoned.
A technical analysis was prepared.
The evidence did not magically “force a win.”
Instead, it strengthened Alex’s factual position.
During settlement discussions, the client now had to explain why production activity appeared inconsistent with its earlier statements.
The parties eventually settled.
That is a much more realistic way to understand the value of server records.
The logs did not win the case by themselves.
They potentially strengthened the evidentiary picture.
If you are dealing with a dispute where you have no formal written contract, read Can You Sue a Client Without a Contract? Real Legal Answer (2026) before assuming that server evidence alone determines the outcome.
Visualizing the Subpoena Process
To make this easier to digest, here is the basic conceptual flow:
Third-Party Evidence & Subpoena Workflow
Strategic legal progression for extracting server logs and backend files
Potential Legal Dispute
Client refuses payment, claims code was scrapped, or violates IP terms.
Preserve Your Own Evidence
Lock down commits, hash repository archives, and document custom API endpoints.
Identify Relevant Third-Party Records
Map out hosts (AWS, GCP, Vercel), databases, and CI/CD deployment pipelines.
Lawsuit / Applicable Discovery Process
Initiate formal proceedings to gain subpoena power under FRCP Rule 45 or local court rules.
Draft Narrow Third-Party Request
Focus specifically on access logs, timestamps, and route executions to resist motions to quash.
Serve Appropriate Subpoena / Legal Process
Deliver formal legal demand directly to the hosting provider’s legal department.
Provider Objects / Seeks Protection
Motion to Quash filed or GDPR/SCA pushback. Requires judicial review of specificity.
Provider Produces Records
Unfiltered server logs, CloudTrail histories, or deployment records delivered.
Authenticate / Analyze
Parse raw server files for unique mathematical functions, signatures, and custom endpoints.
Compare With Your Evidence
Cross-reference third-party timestamps directly against your baseline repository and staging data.
Settlement / Motion / Trial Use
Present visual proof to force an immediate out-of-court financial settlement or trial victory.
Notice what is missing:
“Send subpoena → automatically receive everything → win.”
Real litigation is not that simple.
The United States vs. Global Legal Reality
The strategy changes substantially depending on where the dispute is being litigated and where the provider or relevant records are located.
In the United States
The U.S. federal discovery framework provides mechanisms for obtaining information from non-parties, including electronically stored information, subject to the applicable procedural rules.
Rule 45 is particularly important for subpoenas directed to non-parties. But the subpoena still has to comply with procedural requirements, and the recipient can object or seek protection where appropriate.
The U.S. Courts maintains the current federal civil rules and official subpoena forms.
For a deeper look at the underlying payment dispute, you can also read The Freelancer’s Legal Guide to Recovering Unpaid Invoices.
In the United Kingdom
The procedure is different.
UK civil procedure uses the Civil Procedure Rules, and obtaining information from a non-party can involve different procedural mechanisms depending on the circumstances.
A Norwich Pharmacal order, for example, is a specific type of order developed for circumstances where an innocent third party is sufficiently connected with alleged wrongdoing and information is needed to identify or pursue the wrongdoer.
It should not simply be described as the UK version of a Rule 45 subpoena.
The UK’s Ministry of Justice has described Norwich Pharmacal orders as a mechanism that can be directed toward an innocent third party that has become “mixed up” in alleged wrongdoing and may hold information useful to the claimant.
If you are working internationally, read How to Protect Yourself When Working With International Clients before assuming U.S. discovery rules apply.
In the European Union
Privacy and data-protection considerations can become significant when server records contain personal data.
An access log may contain information such as IP addresses, user identifiers, timestamps or other information that can potentially relate to identifiable individuals.
That does not mean:
“GDPR makes server logs impossible to obtain.”
It means the legal basis, scope, minimization, disclosure and handling of personal data need to be considered carefully.
Depending on the circumstances, a request may be narrowed, anonymized, pseudonymized or otherwise structured to reduce unnecessary exposure of personal information.
Do not promise a provider that a simple request for “anonymized logs” automatically solves every GDPR issue.
The actual legal analysis depends on the data, parties, jurisdiction and purpose of the disclosure.
Interactive Tool: Subpoena Evidence-Potential Calculator
Before spending money on litigation, you need to assess whether the underlying evidence is potentially strong enough to justify further investigation.
This calculator is not a legal viability test.
It is simply an educational screening tool.
It asks whether you possess several facts that can make a server-record strategy more practically interesting.
Subpoena Viability & ROI Calculator
Calculate your evidence strength, estimated discovery costs, and net financial recovery viability before filing.
Your claim value easily covers discovery overhead. Issue a formal Preservation Letter (Litigation Hold) immediately, followed by an FRCP Rule 45 Subpoena to the hosting provider.
If the dispute is still at the invoice stage rather than litigation stage, you may be better served by How to Recover an Unpaid Invoice Yourself Without Hiring a Lawyer.
The Hard Evidence Checklist
If you believe server evidence may become important, do not wait until the lawsuit to organize your own records.
Start with evidence that is already lawfully available to you.
Preserve Your Original Repository
Keep the original source-code versions, repository history and relevant project files.
Where appropriate, preserve cryptographic hashes and metadata in a documented manner.
The goal is not to create a magical “timestamp certificate.”
The goal is to preserve a reliable record of what you actually possessed and when.
Document Your Endpoints
Create a spreadsheet containing:
- API routes;
- custom functions;
- custom database structures;
- distinctive algorithms;
- unusual configuration;
- custom integrations;
- deployment identifiers;
- version numbers.
The more distinctive the feature, the easier it may be to explain why a later production record is relevant.
Preserve Your Own Staging Records
If you legitimately possess staging-server records, preserve them.
They may help establish how your application behaved before delivery.
Do not attempt to access a client’s systems after your authorization has ended simply to obtain evidence.
Preserve the Communication Timeline
Export relevant:
- emails;
- Slack messages;
- project-management messages;
- invoices;
- payment records;
- change requests;
- bug reports;
- delivery confirmations;
- termination messages.
A technical record becomes much more useful when it can be placed next to the client’s own statements.
If you need to turn communications into organized evidence, see How to Turn an Email Trail Into a Legally Defensible Invoice Statement.
Do Not Hack the Client’s Server
This deserves its own warning.
If you believe the client is still using your code, do not respond by:
- guessing passwords;
- using old credentials;
- bypassing access controls;
- entering systems without authorization;
- deleting production files;
- disabling services;
- planting code;
- modifying logs;
- or secretly accessing infrastructure.
That can create an entirely new legal problem.
You do not need to become a vigilante sysadmin.
Use lawful evidence-gathering procedures.
If you are tempted to shut down the client’s infrastructure because they have not paid, read Can I Shut Down a Client’s Server for Non-Payment? first.
The Risk Matrix
I promised you raw honesty.
This strategy can be powerful, but it is not flawless.
| Risk Factor | Practical Concern | Potential Severity | Sensible Mitigation |
|---|---|---|---|
| Motion to Quash or Objection | Provider or client challenges the request | High | Keep requests relevant, specific and proportionate |
| Data Retention | Relevant logs may have expired | High | Identify likely retention periods early |
| Data Deletion | Relevant records may no longer exist | High | Preserve your own evidence and assess preservation issues promptly |
| Attribution | An IP or account may not identify a particular person | Medium/High | Combine technical records with other evidence |
| Privacy | Logs may contain personal information | High | Minimize unnecessary data and obtain jurisdiction-specific advice |
| Cost | Discovery can become expensive | High | Compare expected recovery with likely litigation costs |
| Technical Interpretation | Raw records may be misunderstood | Medium/High | Use qualified technical analysis where appropriate |
| Jurisdiction | Provider and litigation court may be in different places | High | Have counsel assess subpoena authority and enforcement |
Knowing these risks separates the emotional freelancer from the strategic business owner.
If your client is simply running out of money rather than intentionally avoiding payment, see Client Runs Out of Money Mid-Project? Legal & Smart Recovery Guide for Developers.
Quick Decision Section: Sue, Settle, or Pursue Third-Party Discovery?
You are standing at a crossroads.
You strongly suspect the client is still using your work.
What should you actually do?
Consider Walking Away When:
The likely recovery is small compared with the probable cost, time and stress of litigation and discovery.
There is no shame in recognizing that litigation economics matter.
The objective is to recover money—not simply to prove that you were right.
Consider a Demand Letter When:
You have not yet clearly presented your payment demand and supporting evidence.
A professionally drafted demand can sometimes resolve the dispute without litigation.
If you need a broader payment-recovery strategy, see The Freelancer’s Legal Guide to Recovering Unpaid Invoices.
Consider Targeted Discovery When:
You have:
- a significant potential recovery;
- a credible legal claim;
- a clearly identifiable third-party provider;
- specific records that may exist;
- a legitimate reason those records matter;
- and enough evidence to explain why the request is not speculative.
That is very different from:
“I think they stole my code, so subpoena everything.”
Targeted discovery works best when you already have a factual foundation.
FAQ: Subpoenas and Server Logs
Will AWS automatically hand me my client’s server logs if I send a subpoena ?
No.
Do not treat a subpoena as an automatic data-delivery mechanism.
The provider may review the request, raise objections, seek clarification or protection, or produce only records that are properly responsive to the legal process.
The precise process depends on the provider, jurisdiction, type of information and applicable law.
Federal Rule 45 itself contains procedures governing subpoenas for documents and electronically stored information.
Can server logs prove that the client used my code ?
They can potentially provide strong corroborating evidence, but the answer depends on what the logs actually contain.
For example, an unusual API endpoint appearing repeatedly in production after the client claimed the application was deleted may be significant.
But you still need evidence connecting that endpoint to your work and explaining what the records actually establish.
What if the client changed some of my code ?
That does not automatically eliminate your claim.
But do not assume that any percentage match creates an automatic legal result.
There is no universal rule saying that an “80% match” automatically establishes derivative work, copyright infringement or breach of contract.
The legal analysis depends on the applicable contract, intellectual-property rights, license terms, jurisdiction and facts.
The technical evidence should therefore be presented as evidence of what happened, not as a substitute for the legal analysis.
Can I subpoena GitHub to prove that the client cloned my private repository ?
Potentially, depending on the records sought, the applicable legal process, the account and what information the provider maintains.
But be careful about making categorical claims concerning exactly what GitHub “logs.”
A repository event, IP address or timestamp may be useful evidence, but it does not necessarily identify the individual who performed the action or prove unauthorized use by itself.
If clients are ghosting you on GitHub, you can also read When Clients Ghost on GitHub: How to File a DMCA Takedown on Your Own Code Repository.
How much does it cost to issue a subpoena ?
There is no universal price.
The total cost can include:
attorney time;
drafting;
service;
filing or clerk-related costs where applicable;
discovery disputes;
forensic analysis;
expert assistance;
provider objections;
motions to compel;
and broader litigation costs.
A $500–$1,500 estimate should therefore not be presented as a universal subpoena price.
The better question is:
What will the entire evidence-gathering strategy cost compared with the likely value of the claim?
What if the client uses an offshore hosting provider ?
That can make the problem substantially harder.
The relevant questions may include:
where the provider is located;
where the records are stored;
where the lawsuit is pending;
whether the provider is subject to the issuing court’s jurisdiction;
what recognition or enforcement mechanisms exist;
and what privacy or data-transfer restrictions apply.
There is no universal rule that an offshore provider will ignore a U.S. order.
But cross-border enforcement can be considerably more complicated.
What if the server logs have already been deleted ?
That is why preservation matters.
If records no longer exist, a subpoena cannot magically recreate them.
You may instead need to look for alternative evidence such as:
repository history;
deployment records;
invoices;
emails;
screenshots;
monitoring data;
source-code comparisons;
backups;
third-party records;
or testimony.
This is another reason not to wait until months into litigation before thinking about evidence preservation.
Can I subpoena server logs before filing a lawsuit ?
Sometimes other legal mechanisms may exist depending on the jurisdiction and circumstances, but you should not assume that a Rule 45 subpoena is simply a pre-lawsuit investigative tool available to every freelancer.
Rule 45 is part of the federal civil-procedure framework, and the subpoena must issue from the appropriate court in accordance with the rule.
If you believe third-party evidence may disappear before litigation, discuss the available preservation and pre-suit discovery options with counsel promptly.
Final Thoughts
Look, building software is hard enough.
Having a client refuse to pay while claiming they have abandoned your work can be completely infuriating.
But anger is not a strategy.
Evidence is a strategy.
If you genuinely believe a client is still using your software after telling you that the project was scrapped, do not immediately try to break into their infrastructure or shut down their systems.
Preserve what you already have.
Document the timeline.
Identify the relevant infrastructure.
Understand what third-party records may exist.
Then, if litigation becomes appropriate, discuss targeted discovery with qualified counsel.
A subpoena for server logs is not a magic weapon.
It does not automatically prove ownership.
It does not automatically establish infringement.
It does not automatically prove breach of contract.
And it certainly does not guarantee a settlement.
But in the right case, properly obtained and properly interpreted server records can become an important piece of the evidentiary puzzle.
You stop relying entirely on:
“I know they are using my code.”
And you start building:
“Here is the technical evidence showing what happened.”
That is a much stronger position.
Your goal is not to “crack open” a client’s server room.
Your goal is to obtain relevant evidence lawfully, explain what it actually proves, and use that evidence alongside your contract, invoices, communications, repository history and other records.
If you are dealing with a client who used your work but refused to pay, your next step may not even be litigation. Start with the broader recovery options in What to Do When a Client Uses Your Work But Refuses to Pay You.
And if you ultimately need to send a formal pre-litigation demand, consider How to Write a Clean Cease-and-Desist Letter If a Client Steals Your Code or Designs.
The strongest freelancer recovery strategy is rarely the loudest one.
It is the one that creates a clean, documented and legally defensible record.
Protect your code.
Preserve your evidence.
Know what your records can actually prove.
And never assume that a corporate client’s denial is the end of the story.
Author Box
Adv. Sagar Haribhau Shirsat is a legal professional writing about freelancer payment disputes, commercial transactions, cross-border compliance and digital recovery strategies. His work focuses on translating complex legal and technical problems into practical frameworks for freelancers, independent contractors and digital businesses.
Connect via his official professional LinkedIn profile.
Disclaimer: This guide is intended for educational and general informational purposes only. It does not create an attorney-client relationship and does not replace legal advice from a qualified lawyer in the relevant jurisdiction. Subpoena procedures, discovery rules, privacy obligations, intellectual-property rights and evidentiary standards vary by jurisdiction and by the facts of each dispute. Do not access, modify, disable or delete a client’s systems without lawful authorization. For a specific dispute, consult qualified counsel before taking legal action.