This article covers the problems most often reported when preserving and collecting data under legal hold. It applies to CrashPlan Enterprise environments.
For how a legal hold works and what it changes on a custodian's devices, see How legal hold works.
Symptoms covered in this article
Collecting files
- Get Files is unavailable for a custodian
- Files cannot be collected from a custodian at all
- A custodian's files are not available yet
Preserving files
- Files that should be preserved are missing
- A preservation policy cannot be deleted
- A change to a preservation policy has not taken effect
User accounts and licenses
- A user cannot be deactivated
- A departing employee on legal hold still has access to CrashPlan
- License usage did not fall after deactivating users
- A deactivated user cannot be added as a custodian
- A former employee's data is no longer available to preserve
After a hold ends
Collecting files
Get Files is unavailable for a custodian
Cause: An Org Legal Admin can collect files only for custodians in their own organization and its child organizations. Selecting a custodian outside that hierarchy shows the message that you do not have permissions to get files for this custodian.
Resolution: Ask an administrator with the Cross Org Legal Admin role to perform the collection. See the roles reference.
Files cannot be collected from a custodian at all
Cause: Collecting files from a legal hold through the console depends on administrator access to the custodian's archive. The advanced encryption key options, Archive key password and Custom key, withhold that access, so files cannot be collected from a custodian using either. Organizations with Compliance Settings activated require one of these options, so every custodian in such an organization is affected. Preservation continues in all cases, so the data exists.
Resolution: The custodian can restore the files themselves in the CrashPlan app, where files backed up by a legal hold are available in their own restore view. They must supply their encryption key or archive password.
This route requires the subject of the legal hold to perform the collection, which makes them aware of it and places them in the chain of custody. Confirm with your legal team that this is acceptable for the matter before proceeding.
A custodian already on legal hold cannot change to an advanced encryption key option, so this condition is always established before the hold begins rather than arising during a matter.
A custodian's files are not available yet
Cause: Adding a custodian creates a new backup set on each of their devices, and files are available to collect only once that set has backed them up. The time required depends on the size of the preservation policy's selection and on the custodian's connection.
Resolution: Allow the backup to progress and collect again later. A custodian whose devices are rarely online will take longer. For the collection procedure, see Collect files from a legal hold.
Preserving files
Files that should be preserved are missing
Cause: Filename exclusions configured under Global Exclusions in the CrashPlan console apply to every preservation policy, so matching files are excluded from every legal hold.
Resolution: Review Global Exclusions, and move any exclusion that should not reach legal holds to the backup set instead. The procedure is in Best practices for legal hold file selections and exclusions. Files excluded before the change are preserved from the point the policy next selects them, so earlier versions of those files are not recovered.
A preservation policy cannot be deleted
Cause: A preservation policy that is applied to a matter cannot be deleted. The console reports "Unable to delete preservation policy. In use by matter <matter id> and <number> others".
Resolution: Change the affected matters to a different preservation policy, or close them, and then delete the policy. See Create a legal hold preservation policy.
A change to a preservation policy has not taken effect
Cause: Devices apply changes to a preservation policy at their next file verification scan. The policy's Verify selection every setting controls the interval, and the default is daily.
Resolution: Wait for the next scan, or shorten the interval on the policy. On a device you control, open the CrashPlan app, go to Backup Set Settings, and select Scan for file changes.
User accounts and licenses
A user cannot be deactivated
Cause: The user is a custodian on an active matter, and their data must be retained. The console reports "Cannot deactivate a user on legal hold. User blocked instead." This is expected. This applies to deactivation from the CrashPlan console and from a provisioning provider.
Resolution: No further action is required. The blocked state is correct while the matter is open, and the deactivation completes on its own once the user is released from every matter. See Block, deauthorize, and deactivate users and devices.
A departing employee on legal hold still has access to CrashPlan
Cause: A legal hold preserves data for an active user, so a custodian cannot be deactivated while the matter is open. Attempting it reports "Cannot deactivate a user on legal hold. User blocked instead."
Resolution: If the account will not be needed again, deactivate the user. The deactivation is held, the user is blocked now, and it completes when they are released. If the user is staying, block them instead. Either action removes access without affecting preservation.
Blocking is the right action here rather than deauthorizing the device. Deauthorizing signs the device out and stops it backing up, which leaves data already preserved intact but means files created or changed afterwards are never added to the hold.
License usage did not fall after deactivating users
Cause: A user consumes a license while they are active with active devices, and also while their archives sit in cold storage after deactivation. Custodians on a legal hold remain active users. A user who is a custodian on an active matter is blocked rather than deactivated, so they remain active and continue to consume a license.
Resolution: No action is required if the matters concerned are still open. Preserving a former employee's data requires keeping their user account active, and a blocked custodian consumes a license for as long as the matter lasts. The license is released once the user is released from every matter, the deactivation completes, and their archives have expired. See User subscriptions for CrashPlan.
A deactivated user cannot be added as a custodian
Cause: Only active users appear when searching for custodians to add.
Resolution: Reactivate the user, then add them to the matter. Reactivation moves their unexpired archives out of cold storage and makes the data available to preserve.
A former employee's data is no longer available to preserve
Cause: Only an active user can be placed on a legal hold. Deactivating a user moves their archives to cold storage, where they are retained for the organization's cold storage period. Once that period ends, the archives are permanently deleted.
Resolution: Reactivate the user while their archives are still within the retention period, then add them to a matter. Archives that have already expired cannot be recovered, and no legal hold can preserve them.
A matter concerning someone who has already left the organization is time critical. Check the cold storage retention setting for that user's organization before assuming their data is still available.
The reliable approach is to place a user on hold before deactivating them. A user who is already a custodian and is then selected for deactivation is blocked rather than deactivated, so the hold is never lost. Extending the cold storage retention period is the backstop for cases where the deactivation has already happened.
After a hold ends
Legal hold archives are in cold storage
Cause: The custodian was moved to an organization that does not offer the destinations holding some of their archives. Those archives remain available for as long as the custodian is on legal hold, and move to cold storage when the custodian is released or the matter is closed.
The console warning shown when moving a custodian states that the archives will be deleted immediately. The archives are retained until the hold ends.
Resolution: Restore the data from cold storage within the organization's cold storage retention period. To avoid the situation for other custodians, collect any required files before releasing a custodian who has changed organizations. See Release custodians and close a matter.
Preserved data is missing after a release
Cause: Releasing a custodian or closing a matter removes the legal hold backup set. Files preserved only by that set are permanently deleted at the next archive maintenance, and version history kept only by the preservation policy is pruned to the custodian's original retention.
Resolution: Reactivating the custodian or the matter recovers the data if archive maintenance has not yet run. Anything already removed cannot be recovered, and the preservation policy's selection is backed up again from the custodian's devices without its earlier version history.