Applying Legal Hold
It might become necessary during the course of an investigation to place a mailbox on Legal Hold. In IPRO, Legal Hold is a way of preserving the data to create an immutable record. Regulations or court proceedings might require you to show chain of custody, that records are intact, and that there has been no spoliation. In that case, you will need to "freeze" certain data sets to ensure they cannot be deleted, either intentionally or accidentally.
Two types of Legal Hold are possible in IPRO Search:
- Legal Hold for Archives: This feature places data that has been archived on Legal Hold. This feature is only available if at least one archive location (email archive or file archive) is selected as part of the case setup—see Editing Cases .
- Legal Hold for Live Content: This feature places live email, file, Teams, SharePoint or Slack content on Legal Hold. This feature is only available if at least one live location is selected as part of case setup—see Editing Cases .
Placing Archives on Legal Hold and the IPRO Admin UI
The function of the Legal Hold feature in IPRO Search is to prevent the data in question from being deleted at the end of the retention period.
For Legal Hold on Archives, it enforces the process of collecting the data to match the Legal Hold scope, this includes the collection of data that is beyond the archive policy and new data entering the source system.
A Legal Hold for Archives is achieved by setting up a corresponding Legal Hold job in the IPRO Admin UI. A Legal Hold job must be configured for each Archive location you want to place under Legal Hold—see Configuring Legal Hold Jobs.
If this step is not performed first, you will not be able to save the Legal Hold parameters for archives.
Placing a Legal Hold on Live Content
The function of the Legal Hold feature for Live Content in IPRO Search is to prevent the data in question from being deleted.
For Legal Hold on Live Content, it enforces the process of collecting the data to match the Legal Hold scope that is set by the Federated Search performed. This includes new data entering the source system.
A Legal Hold for Live Content is achieved by first performing a Federated Search. To apply a Legal Hold for Live Content, you must include at least one live location in the search (i.e., Gmail, MS Teams, SharePoint, or Slack).
The scope of the Legal Hold for Live Content will match the scope of the Federated Search applied in the selected search tab—see Federated Searches.
Access and Confidentiality
It is a best practice in IPRO Search to create a case dedicated specifically to the purpose of Legal Hold. This is a way of controlling any confidential aspects around Legal Holds. Due to the sensitive nature of the legal proceedings that precipitate Legal Holds, you might not want a wide internal audience to know whose mail, files, and messages are being preserved this way.
The Case Manager can grant case access to any Case Manager who needs to know about the Legal Hold and in some cases, participate in it.
Placing data on Legal Hold "freezes" it for all users, meaning that once someone places the content on Legal Hold, it cannot be deleted by anybody, regardless of what case they are working in, and whether or not they know certain data has been placed on Legal Hold.
- Create a case dedicated to Legal Hold, with a meaningful name relevant to the data being placed under Legal Hold. For more information on how to create a case—see Creating New Cases.
As part of this step, ensure that you have selected at least one archive location (email archive or file archive). - In the Legal Hold tab, select Enable In-Place Legal Hold for Archives. This affects any archive or file repositories you selected when creating the case. Legal Hold can therefore be placed on multiple repositories at once (as long as there is a corresponding job in the IPRO Admin UI to enforce the Legal Hold on each repository.)
- Enter the From and To dates. You can choose one of two options:
- Specific dates, allowing you to select any date range from a date in the past until the current day.
- Oldest to Newest. This is the most comprehensive option, capturing all data. This is often used in conjunction with an ongoing zero-day archive policy and job that archives new data continuously so that it can be placed on Legal Hold. You can use this option when you do not know when the first targeted archives were created.
-
IMPORTANT
You must ensure that the dates of the corresponding Legal Hold job set up in the IPRO Admin UI match the dates or otherwise cover the scope of the dates you enter in this step. If this is not the case, you will see a warning—see Configuring Legal Hold Jobs. - Click Save.
- Clicking Save will prompt you once again to configure the required Legal Hold job in the IPRO Admin UI for the archive locations selected in the case—see Configuring Legal Hold Jobs.
- Click OK.
- You can then observe the progress of setting Legal Hold on the specified archives. When you see a Completed status, the archives you specified have been placed under Legal Hold.
- You can see more details by reviewing the Reports section of the Legal Hold tab.
- Create a case dedicated to Legal Hold, with a meaningful name relevant to the data being placed under Legal Hold. For more information on how to create a case—see Creating New Cases.
As part of this step, ensure that you have selected at least one live location (i.e., Gmail, MS Teams, SharePoint, or Slack). - Run a Federated Search for the scope that you want Legal Hold to cover—see Federated Searches. Give your Federated Search tab a meaningful name.
- In the Legal Hold tab, select Enable Legal Hold for Live Content.
- Set the Scope of the Legal Hold by selecting the relevant search tab from the dropdown menu. The scope will be limited to the parameters applied in the performed search.
-
NOTE
There is no date selection option when placing live content under Legal Hold. If you would like to limit the scope of live content by date, you can do so by selecting dates in your Federated Search—see Federated Searches. -
IMPORTANT
If you need to change the scope of the Legal Hold (the criteria of the Federated Search) after Legal Hold has been set, you need to disable Legal Hold by unchecking Enable Legal Hold for Live Content. Be sure to check it again after making a scope change. - Choose the Location from the options available in the dropdown menu. This refers to the locations available to store the Legal Hold, as previously set up by the Admin.
-
IMPORTANT
It is strongly suggested that you do not change the location selected for your Legal Hold. - You can revisit the case parameters if you require a change to the live repository you are placing under Legal Hold—see Editing Cases .
- Click Save.
- Clicking Save will prompt you once again about configuring the required Legal Hold job in the IPRO Admin UI for the locations selected in the Legal Hold case—see Configuring Legal Hold Jobs.
- Click OK.
- You can then observe the progress of setting Legal Hold on the specified locations. When you see a Completed status, the locations you specified have been placed under Legal Hold.
- You can see more details by reviewing the Reports section of the Legal Hold tab.
- Your Legal Hold case will be locked and you cannot edit the selected locations or . In your Legal Hold case, the search tab on which you applied the legal hold will be renamed LegalHold Scope. This tab will also be locked, and cannot be edited unless Legal Hold is disabled.
All custodians placed on Legal Hold will appear under Legal-Hold in the Location View of your Legal Hold case. Click on a Legal-Hold location to expand the custodian list.
Alternatively, in the Case Management tab, click on Legal Hold.
This tab shows metadata related to on Legal Hold. The columns can be sorted to assist with finding specific data.
If you need to search the , you can export to CSV then search the CSV file—see Exporting.
Click Rescan at any time to refresh the results.