In-Place eDiscovery In Microsoft Exchange

Microsoft Exchange makes possible in place preservation of email messages. The archiving of relevant emails involves significant costs because of the need for a user to manage the copying or because of the need to purchase software to implement the hold on the email messages.

The LitigationHoldEnabled property of a mailbox will prevent any item in a mailbox from being removed.

The alternate 'in-place hold' will only direct the retention of emails which come up in a search query. A single mailbox can have multiple in-place holds, but no more than 500 search terms can be used.

Using more than 500 terms in a query will cause all content in the mailbox to be preserved. The LitigationHoldEnable property is either set or not. Either type of hold can be set to remain for a specific time period.

Searches can be run on the messages that are subject to in-place holds. While a hold is in place a user will retain the same rights to delete emails. The admin has the option of informing the user that the mailbox is subject to a hold.

Both types of holds use the Recoverable Items folder to preserve emails. So even when SHIFT + DELETE is used or emails are deleted from the Deleted Items folder, the emails are transferred to the Recoverable Items folder. The recoverable items folder is not visible to users. Note that a user does have the option to recover deleted items on the folder tab.

How ephemeral is Snapchat?

The content of ephemeral social media like Snapchat may stick around for longer than you'd guess. The basic concept behind Snapchat is that messages will be automatically deleted after they have been viewed. Once all recipients of a Snapchat message have viewed a message it is deleted from the Snapchat servers. As the policy posted here makes clear, messages which are not opened will be deleted 30 days after they are sent.

When two users communicate in a one on one chat. their messages will be deleted when the chat ends, but the settings can be changed so these messages are retained for 24 hours. Snapchats can be saved by simply pressing on a chat and holding on it until a Snapchat's background turns gray.

Snappables are inactive games multiple users can play in Snapchat. These can saved by a user in the memories archive indefinitely. The online policy makes clear that Snapchat backs up snaps saved to 'Memories'.

Snapchat also hosts online 'Stories' which are public content. This content may remain after a user has deleted their post.

The different types of data extraction

There are four main types of data extraction used in electronic discovery.

1. Logical Extraction - a computer program is used to extract data from a network or mobile device. The extraction is read only and does not alter data. A forensic tool is connected with a cable to the device.

2. File System (manual) Extraction - an application is used in conjunction with copying data off the file system. Electronic files and hidden files can be accessed.

3. Physical Extraction - an image of a device's memory is performed. Deleted data can also be recovered. Creating a bit-by-bit image is time consuming.

4. Advanced Physical Extraction - forensics tools can be used to recover flash memory. This involves recovering data from memory chips, which must be removed from a device. Advanced Physical Extraction may make it possible to determine what a device was being used for when it was damaged (e.g., ascertaining that a smartphone was being used to send a text message when it was broken in a car accident); or recover data from devices that don't have USB or other data ports.