Use case
Litigation hold and preservation services.
A hold notice is only as useful as the preservation behind it. We turn the legal hold into a defensible, hash-verified, retention-aware preservation record.
Signs you may need this
Common indicators we hear from counsel and corporate clients.
- Litigation has been threatened or commenced
- Counsel has issued a hold notice
- Devices or accounts at risk of routine deletion
- Departing custodian whose data must be preserved
- Need for documented, defensible preservation steps
How we approach it
A defensible, repeatable process.
1. Hold scope review. We review the hold notice with counsel, identify the custodians, the data sources, and the date range. We document any data sources that are not in scope and why.
2. Custodian preservation. For each custodian, we identify the relevant endpoints, mailboxes, cloud accounts, chat history, and personal-cloud or messaging accounts where applicable. We preserve each source through the appropriate forensic-grade method.
3. Cloud audit log preservation. M365 unified audit log retention is 90 to 180 days by default. Google Workspace varies by event type. We export and archive the relevant logs immediately to prevent the retention window from running out.
4. Hash verification and archive. Every preserved source is hash-verified and archived on encrypted storage with documented retention. The hold register is maintained centrally.
5. Defensibility documentation. We deliver a written preservation memo describing the methodology, the sources preserved, the hash values, and the retention schedule. This memo is the foundation of any future defensibility argument.
What we deliver
Concrete outputs from a typical engagement.
- 01
Custodian and data-source mapping
- 02
Forensic preservation of identified sources
- 03
Hash-verified preservation log
- 04
Custodian interview support
- 05
Preservation report defensible at production
- A preserved evidence set covering every in-scope source, hash-verified.
- A written preservation memo describing methodology, scope, and retention.
- An ongoing hold register documenting any additions or changes to scope.
- An expert affidavit if the preservation is later challenged.
- A chain-of-custody record from intake through release.
Services typically engaged
Forensic services we draw on for this scenario.
Computer Forensics
Forensic imaging and analysis of Windows, macOS, and Linux systems for litigation, internal investigations, and expert witness work.
Learn moreCloud Forensics
Defensible collection and analysis of Microsoft 365, Google Workspace, AWS, Slack, Teams, and Salesforce evidence under legal hold.
Learn moreMobile Forensics
iOS and Android extraction including chip-off, JTAG, and ISP techniques for damaged or locked devices that conventional tools cannot read.
Learn moreCommon questions
Litigation Hold questions we hear most.
How fast can you start a hold?
Within hours of engagement. Cloud audit log preservation is the most time-sensitive piece and we begin immediately.
Does a hold cover personal devices and personal accounts?
It depends on the matter and the preservation order. Personal devices and accounts often raise PIPEDA and BC PIPA issues. We work with counsel on the appropriate scope.
What if a custodian deletes data after the hold notice?
The forensic record often surfaces evidence of deletion, including timestamps and methods. Spoliation arguments depend on this kind of evidence.
Can you preserve Slack and Teams chat history?
Yes, on workspace plans that support legal hold or export. Free and Standard Slack tiers do not preserve indefinitely; preservation requires a specific export and is time-sensitive.
How long do you hold preserved evidence?
As long as the matter requires, with documented retention agreed at scoping. We can extend, transfer, or release on counsel's instruction.
Related scenarios
Other use cases that often arise alongside this one.
Employee Data Theft
Departing-employee data theft: USB, cloud upload, and email exfiltration forensics.
ExploreIP & Trade Secret Theft
Source code, formulas, and proprietary data theft investigations with court-ready reports.
ExploreAnton Piller Orders
On-site forensic acquisition for Anton Piller order executions across Canada.
ExploreHave a hold to execute or revisit?
Tell us the matter and the scope. Our team will reach out as soon as possible.