How does Litigation Hold work? In the normal deleted item workflow, a mailbox item is moved to the Deletions subfolder in the Recoverable Items folder when a user permanently deletes it (Shift + Delete) or deletes it from the Deleted Items folder. A deletion policy (which is a retention tag configured with a Delete retention action) also moves items to the Deletions subfolder when the retention period expires. When a user purges an item in the Recoverable Items folder or when the deleted item retention period expires for an item, it's moved to the Purges subfolder in the Recoverable Items folder and marked for permanent deletion. It will be purged from Exchange the next time the mailbox is processed by the Managed Folder Assistant (MFA).
When a mailbox is placed on Litigation Hold, items in the Purges subfolder are preserved for the hold duration specified by the Litigation Hold. The hold duration is calculated from the original date an item was received or created, and defines how long items in the Purges subfolder are held. When the hold duration expires for an item in the Purges subfolder, the item is marked for permanent deletion and will be purged from Exchange the next time the mailbox is processed by the MFA. If an indefinite hold is placed on a mailbox, items will never be purged from the Purges subfolder.
The following illustration shows the subfolders in the Recoverable Items folders and the hold workflow process.
Note:If an In-Place Hold is placed on a mailbox, purged items are moved from the Deletions subfolder to the DiscoveryHolds subfolder and are preserved for the hold duration for the In-Place Hold. - If your organization requires that all mailbox data has to preserved for a specific period of time, consider the following before you place all mailboxes in an organization on Litigation Hold.
- When you use the previous command to place a hold on all mailboxes in an organization (or a subset of mailboxes matching a specified recipient filter) only mailboxes that exist at the time that you run the command are placed on hold. If you create new mailboxes later, you have to run the command again to place the new mailboxes on hold. If you create new mailboxes often, you can run the command as a scheduled task as frequently as required.
- Placing all mailboxes on Litigation Hold can significantly impact mailbox sizes. In an Exchange 2016 organization, plan for adequate storage to meet your organization’s preservation requirements.
- The Recoverable Items folder has its own storage limit, so items in the folder don’t count towards the mailbox storage limit. As previously explained, preserving mailbox data for a long period of time will result in growth of the Recoverable Items folder in a user’s mailbox and archive. We recommend that you periodically monitor the size of this folder to ensure it doesn’t reach the limit. For more information, see Recoverable Items folder.
The following table provides an overview of the messaging policy and compliance features in Exchange 2013:
| Feature | Description |
| Messaging Records Management (MRM) | To meet legal or business requirements, organizations include e-mail lifecycle policies as part of their messaging policy. Exchange 2013 includes MRM features that allow administrators to implement organization’s e-mail lifecycle policies. MRM can be used to apply uniform retention settings to all messages, or to allow users to classify messages so that they can be retained for a specified duration. |
| In-Place Archiving | In-Place Archiving helps regain control of the organization's messaging data by eliminating the need for personal store (.pst) files and allowing users to store messages in an archive mailbox accessible in and Outlook Web App. |
| In-Place Hold | Organizations are required to preserve electronically stored information, including e-mail that is relevant to a litigation case. In-Place Hold allows the search and preservation of messages matching query parameters. Messages are protected from deletion, modification, and tampering and can be preserved indefinitely or for a specified period. |
| In-Place eDiscovery | In-Place eDiscovery allows the search of mailbox data across an Exchange organization, preview search results and copy them to a Discovery mailbox. |
| Journaling | Journaling can also help organizations respond to legal, regulatory and organizational compliance requirements by recording inbound and outbound e-mail communications. |
| Transport Rules | Transport rules can look for specific conditions for messages that pass through an organization and then take action on them. Transport rules can also apply messaging policies to e-mail messages, secure messages, protect messaging systems and prevent information leakage. |
| Data Loss Prevention (DLP) | DLP capabilities help protect sensitive data and inform users of policies and regulations. DLP can also help prevent users from mistakenly sending sensitive information to unauthorized people. |
| Information Rights Management (IRM) | IRM provides persistent online and offline protection for e-mail messages and attachments using Active Directory Rights Management Services (AD RMS). |
| Mailbox audit logging | Because mailboxes can potentially contain sensitive, high business impact information, it is important to keep track of who logs on to the mailboxes in an organization and what actions are taken. It is especially important to track access to mailboxes by users other than the mailbox owner (known as delegate users). Mailbox audit logging logs mailbox access by mailbox owners, delegates (including administrators with full mailbox access permissions) and administrators. |
| Administrator audit logging | Administrator audit logging keeps a log of changes made by administrators to an Exchange environment. They can be used as part of a change control process or to track changes and access to configuration and recipients for compliance purposes. |
Table 1
Immutability of data is another key feature of any messaging and archiving product and the way Exchange treats immutability is slightly different from other products. Traditionally, immutability was associated with WORM storage that would guarantee that the data could not be tampered with once it was written to disk. In Exchange, this is all done at the software level using the In-Place Archive feature, and is fully independent from the storage used.
How to perform a search:
http://msexchangeguru.com/2014/08/21/in-place-hold/
