top of page

A good legal hold will include the following elements:

  1. Specify that the hold be provided to anyone who can assist with its implementation.

  2. Distribute the hold to IT personnel who can assist with the suspension of ESI deletion and perform backups.

  3. Have each potential custodial certify in writing that they have complied with their preservation obligations and retain these certifications indefinitely.

  4. Have each recipient identify who they are aware of who has had access to relevant ESI and hard copy records.

  5. Instruct the custodian that they are not to try to determine the relevancy of any document to a case, but to take steps to preserve everything.

  6. Documents falling within the scope of the hold that are generated after its distribution should also be preserved.

  7. Warn that copying, moving, or printing any electronic files may result in alterations and subject the client to penalties.

  8. Specify that ESI will include data in proprietary software; user created files; voicemails; and internet usage logs.

  9. Create a full backup of the mailboxes, hard drives, and network drives belonging to key custodians.

  10. SMS and voicemail stored on SIM cards for personal cell phones that may have relevant data should be preserved.


For more information see the form letter included in section 9:25 of the 2021 edition of the Thomson Reuters Electronic Discovery and Records and Information Management Guide.





 
 

The Pro edition of Windows 10, the EFS (Encrypting File System) system is designed to support file encryption. You can encrypt any file by right clicking on it, selecting 'Properties', on the 'General' tab, clicking on 'Advanced' and then checking off 'Encrypt contents to secure data'.


If this checkbox is grayed out, open the Registry Editor, and at: Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem set the value of 'NtfsDisableEncryption' to 1. Then reboot your PC.



If this does not work, in admin mode of command prompt run this command:

fsutil behavior set disableencryption 1




Also run 'sevices.msc', and find Encrypting File System in the menu. Right click on it and select Properties. Then select the startup type to 'Automatic'.



Reboot your PC after making these changes.


 
 

The 2021 edition of the Thomson Reuters Electronic Discovery and Records and Information Management Guide provides checklists for legal holds and preservation notices. It’s interesting to compare the recommendations in this textbook against the tips suggested by two Zapproved employees based on experience, which was discussed in last night’s tip.


Here are some tips left out last night:


- take steps to preserve native files and metadata.

- image a backup of any relevant digital media.

- don’t redeploy hardware which may contain relevant data.

- “Forbid forensically naive network administrators or other members of the information technology department from

checking out or otherwise investigating relevant devices.” Id. at 244.

- State the name of the case, the venue, and the causes of action

- state the business relationship between the requesting party and the company.

- instruct that the current retention schedule be suspended.



 
 

Sean O'Shea has more than 20 years of experience in the litigation support field with major law firms in New York and San Francisco.   He is an ACEDS Certified eDiscovery Specialist and a Relativity Certified Administrator.

The views expressed in this blog are those of the owner and do not reflect the views or opinions of the owner’s employer.

If you have a question or comment about this blog, please make a submission using the form to the right. 

Your details were sent successfully!

© 2015 by Sean O'Shea . Proudly created with Wix.com

bottom of page