Skip to content
Request a demonstration

Legal Intelligence

Investigation and Evidence Preservation

Legal holds, defensible retention, chain of custody, authorised evidence collection and an investigation chronology.

Demonstration: Dunmore Building Services (fictional) · Construction services. Fictional data and a scripted answer.

The situation

Organisation
Dunmore Building Services (fictional)
Who is asking
Legal operations manager
Industry
Construction services
What happened
An internal investigation has opened and some relevant data sources delete themselves on short cycles.

The question asked

Which data sources must be placed on hold now so evidence is not lost?

What it reads, and who can see the result

  • Data source inventory registerSystems with retention settings and custodians.
  • Matter scope documentThe people and dates in scope.
Reads
The inventory of systems and their deletion cycles, and the matter scope.
Does not read
The content of messages or files at this step.
Permission
Legal operations' inventory access.
Who sees it
Legal operations, IT and the investigation lead.

Try it

Review each flagged record: confirm it or dismiss it. The totals and the answer below follow your decisions.

SourceCustodianDeletesRecords at riskFindingDecision
Email, project teamProject managerNever (archived)41,000MatchedNone needed
Chat channel #site-4Site teamAfter 30 days12,600Deletes automatically after 30 days; the matter covers last quarter
Site CCTVFacilitiesAfter 14 days280Overwritten every 14 days; footage from the relevant week may already be gone
Finance systemFinanceNever8,800MatchedNone needed
Departed manager's laptopITWiped on redeployment in 20 days3,300Device scheduled to be wiped and reissued
Personal phone messagesProject managerUser-controlled900Not company-controlled; preservation depends on the individual
Flagged
4 of 6 · 17,080
Place on hold
0 · 0
Release
0 · 0
Undecided
4 · 17,080

The answer

Simulated answer. Written for this fictional case, not produced by a live model. Only the figures in it are computed, from what you decided above.

4 of 6 sources are at risk of losing evidence, about 17,080 records.

Four sources delete or are wiped on a cycle shorter than the matter will run [S1]. The CCTV may already have overwritten the key week; that gap should be recorded now, not discovered later. A personal phone is outside the company's control, so preservation there is a request to the individual, not an instruction [S2].

You have placed 0 on hold (0 records at risk) and released 0; 4 sources are undecided. Anything undecided keeps deleting.

Relies on: S1 · Retention and deletion scheduleS2 · Matter scope memo

Review and approval

The legal operations manager with the investigation lead decides. Approving issues the holds to IT and the custodians for the sources placed on hold. It does not collect or read any data.

Not ready to approve. 4 flagged sources are still undecided. Confirm or dismiss each one first.

In the product this is a different person with the right permission. Here you play that role to see the rule.

What it produces

registerDraft, not approved

Legal hold register

  • On hold: 0 sources, 0 records at risk.
  • Released with a reason: 0.
evidenceDraft, not approved

Preservation gap record

  • Sources that had already begun deleting are recorded with the date, so the gap is documented.

Limits of this example

  • A hold stops deletion going forward; it cannot recover data already overwritten.
  • Preservation of personal devices needs the individual's cooperation.
  • This is a scripted demonstration on fictional data. No model was called and no real organisation, person or result is shown.