Understanding Litigation Hold

Applies to: Exchange Server 2010 SP2, Exchange Server 2010 SP3

When a reasonable expectation of litigation exists, organizations are required to preserve electronically stored information (including e-mail) that's relevant to the case. This expectation can occur before the specifics of the case are known, and preservation is often broad. Organizations may preserve all e-mail related to a specific topic, or all e-mail for certain individuals. Depending on the organization's electronic discovery (eDiscovery) practices, some of the measures adopted by organizations to preserve e-mail include the following:

• End users may be asked to preserve e-mail by not deleting any messages. However, users may still delete e-mail knowingly or inadvertently.

• Automated deletion mechanisms such as messaging records management (MRM) may be suspended. This could result in large volumes of e-mail cluttering the user mailbox, and thus impacting user productivity. Suspending automated deletion also doesn't prevent users from manually deleting e-mail.

• Some organizations copy or move e-mail to an archive to make sure it isn't deleted, altered, or tampered with. This increases costs due to manual efforts required to copy or move messages to an archive, or third-party products used to collect and store e-mail outside Microsoft Exchange.

Failure to preserve e-mail may expose an organization to legal and financial risks such as scrutiny of the organization's records retention and discovery processes, adverse legal judgments, sanctions, or fines.

In Exchange Server 2010, you can use litigation hold to accomplish the following goals:

• Enable users to be placed on hold and keep mailbox items in an unaltered state

• Preserve mailbox items that may have been deleted or edited by users

• Preserve mailbox items automatically deleted by MRM

• Keep the litigation hold transparent from the user by not having to suspend MRM

• Enable discovery searches of items placed on hold

Placing a Mailbox on Litigation Hold

Authorized users that have been added to the Discovery Management role-based access control (RBAC) role group or assigned the legal hold management role can place mailbox users on litigation hold. You can delegate the task to records managers, compliance officers, or attorneys in your organization's legal department, while assigning the least privileges. To learn more about assigning the Discovery Management role group, see Add a User to the Discovery Management Role Group.

In Exchange 2010 SP1, you can use the Exchange Management Console (EMC), the Exchange Control Panel (ECP) or the Exchange 2010 Management Shell to place a mailbox on litigation hold. In Exchange 2010 RTM, you must use the Set-Mailbox cmdlet to place a mailbox on litigation hold. To learn more about placing a mailbox on litigation hold, see Place a Mailbox on Litigation Hold.

Many organizations require that users be informed when they're placed on litigation hold. Additionally, when a mailbox is on litigation hold, any retention policies applicable to the mailbox user don't need to be suspended. Because messages continue to be deleted as expected, users may not notice they're on litigation hold. If your organization requires that users on litigation hold be informed, you can add a notification message to the mailbox user's Retention Comment property. Outlook 2010 displays the notification in the backstage area. The Retention Comment property can be added using the Exchange Management Console (EMC) or the Exchange Management Shell.

Litigation Hold and Mailbox Quotas

Items in the Recoverable Items folder aren't calculated toward the user's mailbox quota. In Exchange 2010, the Recoverable Items folder has its own quota. When a user's Recoverable Items folder exceeds the warning quota for recoverable items (as specified by the RecoverableItemsWarningQuota parameter), an event is logged in the Application event log of the Mailbox server. When the folder exceeds the quota for recoverable items (as specified by the RecoverableItemsQuota parameter), users won't be able to empty the Deleted Items folder or permanently delete mailbox items. Also copy-on-write won't be able to create copies of modified items. Therefore, it's critical that you monitor the Recoverable Items quotas for mailbox users placed on litigation hold.

For mailbox databases, the default RecoverableItemsWarningQuota and RecoverableItemsQuota values are set to 20 Gb and 30 Gb respectively. These settings are usually sufficient for storing several years of mailbox data when on litigation hold. To modify these values for a mailbox database, use the Set-MailboxDatabase cmdlet. To modify them for individual mailboxes, use the Set-Mailbox cmdlet.

Litigation Hold and the Recoverable Items Folder

Litigation hold uses a new Exchange 2010 feature called the Recoverable Items folder. This folder replaces the feature informally known as the dumpster in previous versions of Exchange. The Recoverable Items folder is hidden from the default view of Microsoft Outlook, Microsoft Office Outlook Web App, and other e-mail clients. To learn more about the Recoverable Items folder, see Understanding Recoverable Items.

By default, when a user deletes a message from a folder other than the Deleted Items folder, the message is moved to the Deleted Items folder. This is known as a move. When a user soft deletes an item (accomplished by pressing the SHIFT and DELETE keys) or deletes an item from the Deleted Items folder, or empties the Deleted Items folder, the message is moved to the Recoverable Items folder, thereby disappearing from the user's view.

Items in the Recoverable Items folder are retained for the deleted item retention period configured on the user's mailbox database. By default, the deleted item retention period is set to 14 days for mailbox databases. In Exchange 2010, you can also configure a storage quota for the Recoverable Items folder. This protects the organization from a potential denial of service (DoS) attack due to rapid growth of the Recoverable Items folder and therefore the mailbox database. If a mailbox is not placed on litigation hold, items are purged permanently from the Recoverable Items folder on a first in, first out (FIFO) basis when the Recoverable Items warning quota is exceeded, or if the item has resided in the folder for a longer time than the deleted item retention period.

The Recoverable Items folder has the following three subfolders used to store deleted items in various states and facilitate litigation hold:

1. Deletions   Items removed from the Deleted Items folder or soft deleted from other folders are moved to the Deletions subfolder and are visible to the user when using the Recover Deleted Items feature in Outlook. By default, items reside in this folder until the deleted item retention period configured for the mailbox expires.

2. Purges   When a user deletes an item from the Recoverable Items folder (by using the Recover Deleted Items tool in Outlook or Outlook Web App), the item is moved to the Purges folder. Items that exceed the deleted item retention period configured on the mailbox database or the mailbox are also moved to the Purges folder. Items in this folder aren't visible to users if they use the Recover Deleted Items tool. When the mailbox assistant processes the mailbox, items in the Purges folder are purged from the mailbox database. When you place the mailbox user on litigation hold, the mailbox assistant doesn't purge items in this folder.

3. Versions   In Exchange 2010, when a user who is placed on litigation hold changes specific properties of a mailbox item, the original item is preserved to meet discovery obligations. A copy of the original mailbox item is created before the changed item is written. The original copy is saved in the Versions folder. This process is known as copy on write. Copy on write applies to items residing in any mailbox folder. The Versions folder isn't visible to users.

   The following table lists the message properties that trigger copy on write.

   Properties that trigger copy on write

   Item type	Properties that trigger copy on write
   Messages (IPM.Note*) Posts (IPM.Post*)	Subject Body Attachments Senders/Recipients Sent/Received Dates
   Items other than messages and posts	Any change to a visible property, except the following: Item location (when an item is moved between folders) Item status change (read or unread) Changes to retention tag applied to an item
   Items in the default folder Drafts	None (items in the Drafts folder exempt from copy on write)

After a mailbox user is removed from litigation hold, items in the Purges and Versions folders are purged by the mailbox assistant.

Migrating mailboxes on Litigation Hold from Exchange 2010 to Office 365

If you have an Exchange hybrid deployment, the following conditions are true when you move (onboard) an on-premises Exchange 2010 mailbox to Office 365:

• If the on-premises mailbox is on Litigation Hold, the hold settings are preserved after the mailbox is moved to Office 365.

• If the on-premises mailbox is on Litigation Hold, any content in the Recoverable Items folder is moved to the cloud-based mailbox in Office 365.

There are other ways to migrate on-premises email data to Office 365, such as using a Staged Exchange migration or a Cutover Exchange migration.

• A staged migration can be used to migrate mailboxes from Exchange 2003 or Exchange 2007 to Office 365. In these versions of Exchange, the Recoverable Items folder (and its functionality) doesn't exist. So when you migrate Exchange 2003 or Exchange 2007 mailboxes to Office 365, there isn't any Recoverable Items folder content to move.

• A cutover migration can be used to migrate mailboxes from Exchange 2003, Exchange 2007, and Exchange 2010 to Office 365. As previously stated, Exchange 2003 and Exchange 2007 mailboxes don't have a Recoverable Items folder that can be migrated. Because the Recover Items folder was introduced in Exchange 2010, content in the Recoverable Items folder is migrated to Office 365 when you use a cutover migration to migrate Exchange 2010 mailboxes.

Return to top

 © 2010 Microsoft Corporation. All rights reserved.