Applying & Removing Legal Hold
Use Legal Hold to keep a copy of your emails and/or files
regardless of your system-set archiving retention policy. The
'Legal Hold' status will trump your Email Retention Policy and
retain the messages for ever, as long as the legal hold status
of a message remains enforced. Legal Hold can be applied
and removed at different levels from the search results page:
1. On an entire search results set.
2. On a filtered search result set.
3. On an individual result (email/file).
LEGAL HOLD ON A SEARCH/FILTER
1. From the search (or
filtered) results page, use the Legal Hold Actions... drop-down menu, and
select Place all results on
2. Once you've selected
the desired action to perform, a confirmation popup window
will prompt you to confirm the action taken.
Click OK to confirm
and start applying the Legal Hold status to the selected
4. The progress meter
displayed on the top right corner of the search result page
will allow you to track the status of your request live. The
different statuses are as follow:
***NOTE: It is not required to stay on the search result
screen while the Legal Hold request is processing. You can go
to other pages, logout of the archive, etc. This will not
disrupt the Legal Hold request from processing.
5. Once the status indicates
succeeded, refresh the page to see the legal hold status
applied to your search results (seen below).
6. Click on the
'Show Legal Hold Count' button as shown above. This
will indicate the number of search results placed on legal
***NOTE: Every time you access a search, where results have
been placed on legal hold, you have to click on the "Show
Legal Count" to display the amount of messages placed on hold.
This can be helpful when you have a search that has new
results that haven't been placed on hold.
7. To remove the Legal Hold
status from the entire result set, select the Remove all results from legal
hold from the Legal
Hold Actions... drop-down menu and follow the same
steps as for applying legal hold.
INDIVIDUAL LEGAL HOLD
The archive service allows you to selectively place and
remove messages from legal hold. In order to do so, from the
search results page:
1. Locate the message that needs to be placed or removed from legal hold.
2a. Click on the grey locker icon to place the message on legal hold to ensure that nobody can tamper or delete the data.
2b. Click on the
blue locker icon to remove the message from legal hold to set
back the email to the archive standard retention policy.
3. Once you've selected the
desired action to perform, a confirmation popup window will
prompt you to confirm the action taken. Click OK to confirm and start
applying/removing the Legal Hold status from the selected
4. The legal
hold request will be queued for processing. The legal hold
status (locker icon) will be updated accordingly once the
request goes through and you refresh the page.
AUDITING LEGAL HOLD ACTIVITY
Any time a legal hold is placed or removed, (at the search,
filter, or individual level) all the activity is logged and
reportable from the Saved Searches page.
1. Click on the
2. Click on the
"Audit" button next to the search for which you want to audit
3. From there, you'll have access to the entire search activity, including the legal hold activity. The username, date, time, IP address, and action taken are available from this page and can be reported on.
3a. Search and filter-level legal
hold activity will be shown in the form of an 'Action' and a
'Tag' being applied (legal hold).
3b. Individual legal hold activity
will be shown in the form of an 'Action', a 'Tag' being
applied (legal hold), and the unique 'Message UUID' of the
email that has been placed or removed from Legal Hold.
TECHNICAL SPECIFICATIONS AND DETAILS
* Legal Hold cannot
be applied to a search containing over one million search
results (messages and/or files). If you encounter this
scenario, we recommend breaking down the search, using the Filter My Result option.
* You can place a
legal hold status to any or all items in a given search result
set. This means that legal hold can be applied in three
* On an entire search result.
* On a filtered search result.
* On an individual result.
* A legal hold will
prohibit items from being removed during automatic maintenance
routines. Legal holds are typically used when legal actions is
taking place for the pertinent searches. Legal holds can be
placed on messages (an their associated attachments), files,
and co-mingled email and file search results.
* Any file tagged
with the legal hold attribute cannot be purged from the
archive service, even if an automatic retention policy is
configured to remove those items. Legal hold will overwrite
any system-set retention policy.
* From a performance
standpoint, we estimate that legal hold takes on average 1ms
per message, plus some buffer. Placing a result set with X
results on legal hold would take approximately X*1ms.
Administrators, and Search Administrator Plus have the ability
to use legal hold as a search criterion. To learn more about
this, refer to the Wizard search
* Legal hold is
applied at the message level and is not tied to a specific
search. As such, when a message is placed on legal hold, the
legal hold tag will be visible whenever a user views the
message in the search interface. Likewise, when a legal hold
us removed from a message, the message will no longer be on
legal hold, and the legal hold tag will no longer be visible
when a user views the message in the search interface. In case
you have multiple Search Admins running different searches, if
one SA removes legal hold from an email in 'his' search, it
will affect the other Search Admin search(es) with legal hold
if they have the same email.