Legal Holds for Laptops

I had this question after viewing Legal hold, eDiscovery: device or data.

For a legal hold, do you preserve the entire laptop including system files or do you preserve just the common file types that may exist on a laptop?
Valerie ProwellAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Gary CaseRetiredCommented:
The "safest" approach would be to completely image the laptop's hard drive -- save the image with a descriptive name [e.g. "VProwell's Laptop"] -- and then you can reformat the drive and repurpose the laptop.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
serialbandCommented:
It would be much simpler to just remove the disk drive and then buy a new drive to replace it.  It saves time over cloning and then erasing and you'd have the original to fully clone for the purpose of forensic recovery of the empty sectors.  You never want to boot from the disk you try to forensically recover and you'd want to make sure it's only ever put into read only interfaces.
0
Gary CaseRetiredCommented:
Removing the disk certainly works too; but a forensic image (i.e. not compressed) is just as good, and is much easier to store than a bunch of drives.
0
serialbandCommented:
My main point is that swapping out the disk takes 3-10 minutes versus a few hours for cloning, then, if there's sensitive data, securely erasing it.  It really depends on how much time you have and how much physical space you have.  Laptop disks are quite small already.
0
Jackie ManCommented:
No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I have recommended this question be closed as follows:

Split:
-- garycase (https:#a41788367)
-- serialband (https:#a41788982)


If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.

jackieman
Experts-Exchange Cleanup Volunteer
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Laptops Notebooks

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.