Lesson 4.69: Legal hold and evidence handling
When litigation, a regulator's investigation or a serious incident is expected, an organisation must preserve the relevant information, even if its normal rules would delete it. This is a legal hold. Failing to stop routine deletion can mean sanctions or losing the case, and evidence that can't be shown to be unchanged is worth much less. In the lab you read Northwind's first legal hold, find the automatic deletion jobs that would destroy held data, suspend them, hash the collected files, record the chain of custody and verify the hashes.
15 min
You will learn to
- Explain what a legal hold requires
- Map a hold's scope to systems
- Suspend conflicting deletion jobs
- Hash collected evidence and keep a custody log
- Verify evidence integrity later
Key terms
- Legal hold
- An instruction to preserve information relevant to expected litigation or investigation, overriding normal deletion.
- Custodian
- A person or account whose data falls under the hold.
- Spoliation
- Destroying or altering evidence, even by routine deletion after a duty to preserve arose.
- Chain of custody
- The record of who handled evidence, when and how.
- ISO/IEC 27037
- International guidelines for identifying, collecting, acquiring and preserving digital evidence.
← Incident response: prepare, detect, contain, eradicate, recover, learn · All lessons · Running a major incident →