Legal Hold Implementation, Preservation in Place and Verification

Legal Holds That Beat the Retention Policy to the Data

The duty to preserve attaches long before anyone knows which mailbox matters, and the retention settings keep deleting while the hold notice sits unread. Global Digital Forensics turns preservation instructions into configured holds on the systems that actually delete data, across Microsoft 365, Google Workspace, messaging platforms, phones and laptops. Every hold is verified on a date and recorded, so counsel can show the court what was preserved, when and by whom.

Get a Free Consultation Call (800) 868-8189

Bagged hard drive beside a forensic write blocker.

Why a Hold Notice Alone Does Not Preserve Anything

A legal hold notice tells people to keep records. It does not tell the mail system to pause the deletion policy the administrators set, it does not stop a departed employee’s mailbox from being purged on the schedule that applies to every other departed employee, and it does not keep a custodian from trading in the phone that holds the text thread. Preservation happens in systems, and until someone with the right access changes the settings and confirms the change, the notice is a promise the organization may not be able to keep.

Global Digital Forensics turns the custodian list, the trigger date and the preservation obligation into configured holds, documented custodian records and dated verification, working with the client’s administrators and IT so the technical steps match the legal scope. When a release is authorized, we check for overlapping holds and retention obligations before any setting changes and record the approval, the exact scope and the result, because releasing one hold never authorizes deletion under another.

The current Federal Rules of Civil Procedure set out the duty to preserve and the consequences of losing data, and our job is to make sure that the record of what was preserved, when and by whom exists when it is needed.

Has the notice gone out while the deletion policies kept running? Describe the systems and the trigger date to a senior examiner and we will map which settings still need to change.

Get a Free Consultation

Technical methods and scope

Hold Support From Examiners Who Collect What Holds Protect

Global Digital Forensics has practiced since 1992, and our legal hold support grew out of a simple observation from the collection side of the practice: by the time a collection is scheduled, the records that matter have often already been lost to a retention policy nobody thought to pause. Our examiners have collected from the systems that holds are meant to protect, and they have explained in deposition what survived and what did not. That experience shapes how we plan and verify a hold.

Rule 37(e) addresses electronically stored information that should have been preserved and was lost, and the reasonable steps a party took are what the court examines. We document the technical preservation steps, the verification and any gaps, so the organization can show the court a dated record of reasonable steps rather than a description of good intentions.

The engagement is scoped in writing: which notification, acknowledgment tracking, reminder, escalation and configuration tasks GDF performs and which the client’s administrators perform. That clarity matters later, because the record identifies who did each thing and when, and a hold that nobody owned is the hold that fails.

Preserve in Place Across Microsoft 365, Google Workspace and Messaging

Where the client’s license supports it, Microsoft 365 can hold identified mailboxes, Teams conversations, SharePoint sites and OneDrive accounts in place, and Google Workspace can hold accounts and organizational units for defined dates. We coordinate the configuration with the tenant owner, confirm what the policy actually covers for each data type and timing, and verify the effect so the record reflects the hold as applied rather than as intended.

Messaging and collaboration platforms vary. Some offer administrative retention controls, some require an approved export or connector and some offer nothing suitable. Where a platform cannot hold data natively, counsel can approve an alternative such as a targeted collection, a change to the deletion policy or preservation of an existing backup, and the record explains why that route was chosen for that source. Phones, laptops and file shares usually need preservation steps outside the tenant altogether, which is where our mobile and endpoint collection practice joins the hold.

Keep the Hold Current as the Case Moves

Custodians are added as the case develops, removed as claims narrow and lost when people leave. The agreed program updates notices and records each addition, removal and departure with a dated reason, showing how preservation followed the developing matter rather than a snapshot from the day the first notice went out.

A departing custodian is the moment a hold most often fails. We coordinate with the legal team and IT on account retention, deletion settings and the capture of the device or account records the hold requires before the account is disabled or the laptop is wiped and reissued. The action record documents how that custodian’s sources were handled, which is precisely the question that gets asked a year later.

If a custodian is leaving this week or a retention cycle is about to run, call before it does. We will tell you which sources are at risk and what can be done today.

Get a Free Consultation Call (800) 868-8189

A Dated Record of Every Notice, Hold and Check

The audit record connects the trigger date and its legal basis to the notified custodians and timestamps, the acknowledgment status, the reminders and escalations, the configured holds with their settings and screenshots, the scope changes, the verification checks and the release. Material entries are dated and attributed to the responsible person, so the sequence can be examined by anyone who needs to test it.

That record supports counsel’s account of how preservation operated and can inform an expert declaration when one is needed. It ties instructions to system settings, settings to verification and verification to exceptions, which is a far stronger position than pointing to the fact that a notice once existed.

Your Hold Records and Verification Reports

The hold package begins with a matter specific notice template prepared for counsel’s review before issuance and a custodian log that records who was notified, who acknowledged and what supplemental communications followed. The configuration report identifies each technical hold, its settings and the sources it covers, and the tracking report records acknowledgments, reminders, escalations and unanswered notices by date.

Verification memoranda document the dated checks and any corrective steps, the modification log records scope changes and custodian additions or removals with dates and reasons, and the release record documents the authorized termination, the affected sources, the collection status and any overlapping hold or retention obligation checked before settings changed.

Describe the custodians and the platforms involved and we will set out in writing which of these records the engagement would produce.

Methodology

From Preservation Duty to a Verified Hold Record

Map custodians and retention risks

We map custodians, sources, retention periods and data types to the hold instructions and flag the settings that would delete records before anyone configures a hold.
Preserve the approved sources

We implement or coordinate the approved holds and record the settings, owners, dates, changes and exceptions as they happen.
Verify and keep the record current

We run dated verification checks, update notices and custodians as the case moves and document departures and corrections.
Hand off to collection and review

When collection follows, we use supported methods, verify transfers and reconcile exceptions so the hold record and the collection record read as one history.

If a departing custodian or an expiring retention window makes the first step urgent, call (800) 868-8189 and we will start with preservation while counsel settles the wider scope.

Evidence commonly examined

Systems and preservation records we review

Custodian and source inventories identify the people and systems covered by the instruction. Microsoft 365 and Google Workspace configurations provide the business suite preservation records, collaboration and messaging systems require their own retention and export review, and computers, phones and file shares often need measures outside a tenant hold. Databases and structured business systems call for source specific retention and collection decisions, and the method and exception logs document the actions taken and the records that remain unavailable.

What you can expect

What the verified hold record contains

The source map and scope record connect the legal instructions with the assigned technical tasks. Collection and processing logs retain the history when those later tasks are included, the reconciliation and exception report identifies discrepancies and unresolved items, and where production follows, the validated package carries its audit links forward.

Mistake four in the five digital evidence mistakes to avoid is issuing preservation instructions without an operational plan, and this record is the plan.

Plan the Technical Side of Your Legal Hold

Bring the hold instructions, the custodians, the platforms and the preservation deadline to a free initial consultation. We will define the technical hold tasks, the verification record and the person responsible for each.

Ask which examiner would verify the hold and testify about it; the team and credentials are on the About page, and a data discovery case study shows how records supplied without access to the live system were made usable for the litigation team.

Get a Free Consultation

Frequently asked

In Place Holds, Departing Custodians and Hold Releases

What should counsel define before technical hold support begins?

Identify the custodians, the systems, the trigger date and the retention risks you already know about. From there we define the technical preservation steps, the verification checks and the record that will show what was done and when.

Can you preserve Microsoft 365 or Google Workspace data without collecting it?

Often, yes. Where the license supports it, mailboxes, chat, sites and drives can be held in place and verified. We confirm what each hold actually covers for each data type, and where a platform cannot hold data natively we propose a targeted collection or a retention change for the legal team’s approval.

What happens when a custodian leaves during the hold?

We work with legal and IT before the account is disabled or the device is wiped, so the mailbox, files and phone records the hold requires are retained or collected, and the action record documents exactly how that custodian’s sources were handled.

What if the preservation deadline is already here?

Call (800) 868-8189 with the custodians, the systems and the current status. We will set priorities, address the sources at greatest risk first and document each step as it happens, then build the rest of the program around the deadline.

How is a hold released without losing data?

When a release is authorized, we check for overlapping holds and retention obligations before any setting changes, then record the approval, the affected sources and the result. Releasing one hold never authorizes deletion under another, and the release record shows that check was made.

Talk with an examiner

Preserve the Accounts and Records the Hold Names

Share the accounts, devices and retention settings covered by the hold. We will discuss authorized changes, verification and who keeps the hold record current.

GDF has operated since 1992 and provides court tested forensic expertise.

Talk with an examiner

Talk With a Preservation Specialist Before the Next Deletion Cycle

On the first call a senior examiner reviews the custodians, the platforms and the retention settings in force, identifies which sources are still deleting data and sets out the holds, checks and records the engagement would produce. The consultation is free.

Call (800) 868-8189 Get a Free Consultation

For technical legal hold support, call (800) 868-8189.

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed November 3, 2026.