Detailed Analysis
Preservation is the process of ensuring that electronically stored information is not altered, deleted, or destroyed after the duty to preserve has been triggered. This duty usually begins when litigation is reasonably anticipated.
The primary tool for preservation is the Legal Hold notice. This is a formal communication sent to custodians and IT departments instructing them to halt any routine data destruction or recycling processes. Failure to preserve data can result in claims of spoliation, leading to adverse jury instructions or significant fines. Preservation must be documented meticulously to prove that the organization took reasonable steps to maintain the integrity of the evidence.
Critical considerations include:
- Suspending automatic deletion policies on email servers.
- Ensuring backup tapes containing unique data are not overwritten.
- Developing a defensible and repeatable preservation audit trail.
- Addressing dynamic data sources that change frequently.