What is a legal hold?¶
A legal hold is a measure used to preserve relevant data so that ordinary deletion or retention processes do not remove it.
It may be applied by an organisation, provider or legal team depending on the service and authority involved.
What this means in practice¶
Investigators should identify what the hold covers, when it started, who applied it and which systems are included.
A legal hold is not the same as evidence collection. Preserved data may still need to be lawfully obtained, exported and documented.
Where several providers or linked systems are involved, separate preservation steps may be required.
What this does not show on its own¶
The dangerous assumption is that a legal hold automatically preserves every form of cloud evidence.
A hold may cover selected accounts, files, messages or date ranges. It may not include all logs, backups, application data or records held by another provider.
The hold must also be applied before the relevant data disappears. It cannot preserve material that has already expired or been permanently deleted.
A hold may also preserve data beyond the ordinary user’s deletion rights. That does not mean the user loses all control of the account, but it may prevent the preserved material from being permanently removed through normal actions.
What to do next¶
Check whether the hold preserves content, metadata, versions, deleted items and audit records separately.
Do not assume that the ordinary user can see that a legal hold exists. It may operate in the background through administrator or compliance tools.
Key takeaway
A legal hold can suspend ordinary deletion for defined data, but its scope, timing and systems must be confirmed rather than assumed.