Legal Holds for Laptops

Valerie Prowell
Valerie Prowell used Ask the Experts™
on
I had this question after viewing Legal hold, eDiscovery: device or data.

For a legal hold, do you preserve the entire laptop including system files or do you preserve just the common file types that may exist on a laptop?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Retired
Most Valuable Expert 2013
Top Expert 2009
Commented:
The "safest" approach would be to completely image the laptop's hard drive -- save the image with a descriptive name [e.g. "VProwell's Laptop"] -- and then you can reformat the drive and repurpose the laptop.
It would be much simpler to just remove the disk drive and then buy a new drive to replace it.  It saves time over cloning and then erasing and you'd have the original to fully clone for the purpose of forensic recovery of the empty sectors.  You never want to boot from the disk you try to forensically recover and you'd want to make sure it's only ever put into read only interfaces.
Gary CaseRetired
Most Valuable Expert 2013
Top Expert 2009

Commented:
Removing the disk certainly works too; but a forensic image (i.e. not compressed) is just as good, and is much easier to store than a bunch of drives.
My main point is that swapping out the disk takes 3-10 minutes versus a few hours for cloning, then, if there's sensitive data, securely erasing it.  It really depends on how much time you have and how much physical space you have.  Laptop disks are quite small already.
Jackie Man IT Manager
Top Expert 2010

Commented:
No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I have recommended this question be closed as follows:

Split:
-- garycase (https:#a41788367)
-- serialband (https:#a41788982)


If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.

jackieman
Experts-Exchange Cleanup Volunteer

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start Today