Legal Hold
Definition
A directive from legal counsel instructing relevant people within an organisation to preserve documents, data, and physical items that may be relevant to anticipated litigation. For engineering evidence, the legal hold triggers the responsibility to stop routine maintenance, disposal, or repair of failed components.
- Also called
- Litigation hold or preservation notice
- Covers
- Electronic data, documents, and physical items
- Timing
- Issued as soon as litigation is reasonably anticipated
Common questions
What is a legal hold and when is it issued?+
A legal hold is a directive that tells people and organisations to stop destroying or deleting documents, data, and physical items because they may be needed as evidence. It is issued as soon as a lawsuit or investigation is reasonably expected, even if litigation has not started yet. The goal is to prevent evidence from being lost through routine deletion or disposal.
Who issues a legal hold and what does it cover?+
Legal counsel issues the hold to relevant people in an organisation. It can apply to electronic data such as emails, files, and databases, as well as paper documents and physical items. For engineering evidence, a legal hold triggers the responsibility to stop routine maintenance, disposal, or repair of failed components that might be needed as evidence.
What happens if someone ignores a legal hold?+
Organisations have a legal duty to comply with a hold and must ensure their staff knows about it so they do not accidentally delete or dispose of key evidence. Failing to preserve evidence that is subject to a hold can result in serious legal consequences.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Audit Trail
- A log maintained by an accounting system, ERP, or cloud application recording who accessed, created, modified, or deleted each record, with timestamps....
- Cryptographic Hash (MD5/SHA-256)
- A fixed-length digest computed from the contents of a file or disk image. Used to verify that a forensic copy is identical...
- Electronically Stored Information (ESI)
- Any information created, stored, or transmitted in electronic form, including emails, database records, spreadsheets, accounting system logs, chat messages, and metadata. ESI...
- Engagement Scope
- The defined boundaries of a fraud examination: the organisational units, time period, transaction types, and evidence sources to be examined. Scope is...
- Forensic Image
- A bit-for-bit verified copy of a storage medium, created using a write-blocker to prevent modification of the original. The copy is verified...
- Hash Value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Joint Inspection
- An examination of physical evidence attended by the experts for all parties under an agreed protocol. Joint inspection ensures that each expert...
- Metadata
- Data about data. In document forensics, metadata includes file-creation timestamps, last-modified dates, author fields, revision history, and embedded GPS coordinates in images....
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- Photogrammetry
- A technique that uses overlapping photographs to reconstruct three-dimensional geometry from two-dimensional images. In forensic engineering, photogrammetry and Structure-from-Motion (SfM) software allow...
- Predication
- The reasonable basis that justifies opening a fraud examination. The ACFE holds that no examination should begin without adequate predication, meaning a...
Explained in these topics
- Digital Evidence in Financial CasesA directive issued to document and data custodians requiring them to suspend routine deletion and preserve all potentially relevant ESI. Also called a litigati...
- Evidence Preservation and DocumentationA directive from legal counsel instructing relevant people within an organisation to preserve documents, data, and physical items that may be relevant to antic...
- Evidence Preservation During ContainmentA formal directive, typically from legal counsel, to suspend normal data destruction or overwrite policies for evidence relevant to anticipated litigation or i...
- Predication and Engagement Planning in Fraud ExaminationsA directive, typically issued by legal counsel, requiring the preservation of documents and data that may be relevant to anticipated or actual litigation or in...