Tags


Litigation hold, also known as legal hold, allows organizations to preserve electronically stored information. When a user’s mailbox is put on litigation hold, the user can delete items from their mailbox but the items are retained on the servers in the Microsoft Exchange datacenter. Litigation hold retains e-mail messages, calendar items, tasks, and other mailbox items. Litigation hold also protects the original version of each mailbox item from modification by the user. If a user changes the properties of items in a mailbox on litigation hold, a copy of the item before it was changed is retained.

This topic explains the following:

Why put a mailbox on litigation hold?

If your organization is involved in a legal action, you may have to take steps to preserve relevant data, such as e-mail messages, that may be used as evidence. In situations like this, you may have to retain all e-mail sent and received by specific people or retain all e-mail sent and received in your organization for a specific time period. Putting mailboxes on litigation hold is the first step in meeting these types of litigation requirements. Typically, a discovery manager, lawyer, or other authorized official in your organization puts mailboxes on litigation hold.

What happens when a mailbox is on litigation hold?

When a user deletes messages from their Deleted Items folder or uses Shift+Delete to permanently delete a mailbox item, the deleted items are copied to a hidden folder in the user’s mailbox. This folder is called Recoverable Items. Its also known as the dumpster. Permanently deleted items are copied to a subfolder called Deletions in the Recoverable Items folder.

Items in the Recoverable Items folder are retained for 14 days by default and then purged by Microsoft Exchange. When a mailbox is put on litigation hold, the Recoverable Items folder isn’t purged and items in this folder are retained indefinitely. Litigation hold doesn’t affect users’ day-to-day e-mail workflow, so users can continue to modify and delete mailbox items as they normally would.

Users can manually purge items from the Recoverable Items folder.

  • In Microsoft Outlook 2010 Click the Folder tab, select Recover Deleted Items > Purge Selected Items.
  • In Outlook Web App Deleted Items > Recover Deleted Items > Purge Selected Items.

Items that are manually purged from the Recoverable Items folder are moved to a subfolder called Purges. If the user’s mailbox is put on litigation hold, Microsoft Exchange retains items in the Purges folder indefinitely.

Litigation hold preserves the original version of mailbox content

If a mailbox is on litigation hold, Microsoft Exchange protects the original version of each mailbox item by retaining an unaltered copy of the item if a user changes the properties of that item. A copy of the original message and all its MAPI properties are saved to the Versions subfolder in Recoverable Items folder in a user’s mailbox. This happens when one of these properties is changed:

  • Subject field
  • Message body
  • Attachments
  • Senders and recipients
  • Sent and received dates

Users can’t access the original version of a modified item that is copied to the Versions subfolder in the Recoverable Items folder. However, administrators can use Multi-Mailbox Search to search users’ mailboxes for original and modified versions of a mailbox item. For more information, see Multi-Mailbox Searches.

The following diagram shows the subfolders in the Recoverable Items folder and the message flow when items are deleted, modified, and purged.

Single item recovery process

Return to top

Litigation hold and retention policy

Retention policy is still applied to mailboxes on litigation hold. That means an organization’s retention policy moves deleted items to the Recoverable Items folder and then moves those items to the user’s archive mailbox when the retention period expires. All items in a user’s primary and archive mailboxes are retained indefinitely when a mailbox is on litigation hold. For more information, see Set Up and Manage Retention Policies in Exchange Online.

Note The Recoverable Items folder has a maximum quota of 30 GB, but this quota isn’t charged against the quota for the user’s primary mailbox. For more information, see the “Quota for the Recoverable Items folder” section in Recover Deleted E-mail Messages in Exchange Online.

What happens when a mailbox is removed from litigation hold?

When a mailbox is no longer on litigation hold, Microsoft Exchange no longer retains deleted items or copies of items whose properties were changed. Items that were retained because of the litigation hold aren’t immediately purged from the Recoverable Items folder but will be purged the next time Microsoft Exchange checks the Recoverable Items folder for items older than 14 days.

Put a mailbox on litigation hold

Before you begin A discovery manager, lawyer, or other authorized official in your organization must be assigned the Legal Hold role to put a mailbox on litigation hold. The easiest way to assign this role is to add the person to the Discovery Management role group. For more information, see Add or Remove Role Group Members.

  1. In the Exchange Control Panel, select Manage My Organization > Users & Groups > Mailboxes.
  2. Select the mailbox to put on litigation hold and click Details.
  3. Under Mailbox Features, select Litigation Hold and click Enable.
  4. On the Litigation Hold page, you can configure the following optional fields. The text from these fields appears in the user’s mailbox.
    • Note Use this field to notify the user about the litigation hold, explain why the mailbox is on litigation hold, or provide additional guidance to the user, such as informing them that the litigation hold won’t affect their day-to-day use of e-mail.
    • URL Use this field to provide a URL to a Web site that provides information or guidance about the litigation hold on the mailbox.
      Important The text from these fields appears in the user’s mailbox only if they are using Outlook 2010. It doesn’t appear in Outlook Web App or other e-mail clients. To view the text from the Note and URL fields in Outlook 2010, click the File tab, and on the Info page, under Account Settings, you’ll see the litigation hold comment.
  5. Click OK. At this point, the litigation hold is pending. You must click Save to complete the process.
  6. Click Save to put the mailbox on litigation hold. A warning is displayed saying it may take up to 60 minutes for the litigation hold to take effect.
  7. Click Close.

Return to top

Remove the litigation hold

  1. In the Exchange Control Panel, select Manage My Organization > Users & Groups > Mailboxes.
  2. Select the mailbox you want to remove from litigation hold from and click Details.
  3. Under Mailbox Features, select Litigation Hold and click Disable.
  4. Click Yes in the warning dialog. At this point, disabling the litigation hold is pending. You must click Save to complete the process.
  5. Click Save to remove the mailbox from litigation hold. A warning is displayed saying it may take up to 60 minutes for the change to take effect.
  6. Click Close.

Return to top

Next steps

  • Want to see which mailboxes are on litigation hold? In the Exchange Control Panel, select Manage My Organization > Users & Groups > Mailboxes, and in Select view, select Mailboxes on litigation hold.
  • Want to see when a mailbox was put on litigation hold? In the Exchange Control Panel, select the mailbox on litigation hold and click Details. Under Mailbox Features, select Litigation Hold and click Edit. The Litigation Hold window shows when the mailbox was put on litigation hold and the person who put it on hold. You can also change or add a note or URL, which is displayed in the user’s mailbox if they are using Outlook 2010.
  • Want to find changed or deleted items in a mailbox on litigation hold? Use Multi-Mailbox Search on the Discovery tab in the Exchange Control Panel to search for items retained by Microsoft Exchange for mailboxes on litigation hold. When you search a mailbox on litigation hold, the Recoverable Items folder is searched for deleted or changed items that meet your search criteria. For more information, see Multi-Mailbox Searches.
Advertisements