Using CrashPlan for eDiscovery

CrashPlan supports the eDiscovery process from identifying custodians through producing files for review. This article maps each stage of that process to what CrashPlan provides for it, and names the console screen or API endpoint that does the work.

For the legal hold feature itself, including how to create policies, add custodians, and collect their files, see the Legal Hold section.

What CrashPlan provides for eDiscovery

• Keep files the custodian deletes, and versions their own retention settings would otherwise remove, for as long as the matter is open.
• Preserve across any number of custodians under a single policy, and across every destination their organization offers.
• Collect a custodian's files to a device you choose, from the console or through the API.
• Scope a collection by path or by pattern, so it gathers the files a matter needs rather than a whole selection.
• Collect files as they stood on a given date, collect every version of a file, and include files the custodian has deleted.
• Extend how long a departed user's archive is retained, so their data remains available to a matter raised after they left.
• Record that a collection happened, who performed it, when, and how much was collected.
• Run the whole legal hold lifecycle programmatically, from creating a matter to releasing its custodians.

The console and the API

CrashPlan offers two routes to all of this, and they are equals rather than a primary and a fallback.

The CrashPlan console covers the full preservation and collection workflow for a matter handled by hand: creating policies, adding custodians, collecting a custodian's files, and reviewing what happened.

The CrashPlan API exposes the same work as endpoints, and offers collection options the console does not. Matters, memberships, policies, and legal hold events can each be created and queried directly. Choose the API for a matter that is large, that recurs, or that is driven from a case management system rather than raised by hand.

The eDiscovery process

eDiscovery is the discovery process in legal cases where the information is in electronic format. It is commonly described in eight stages, though a matter may use only some of them, run them in a different order, or return to an earlier stage.

• Identification: begin the legal hold process, and locate and verify custodians and archives.
• Preservation: protect data against alteration or destruction.
• Collection: gather data for use in the rest of the process.
• Processing: convert data into forms suitable for review and analysis.
• Review: evaluate data for relevance and privilege.
• Analysis: evaluate data for content, context, and patterns.
• Production: deliver data in the required form.
• Presentation: display results and reports.

CrashPlan covers identification, preservation, collection, and production. Processing, review, and analysis take place in the tools your legal team already uses, working from the files and versions CrashPlan delivers to them.

Identification

Establishing who holds relevant data, and where it is, uses the console's search and reporting screens, and the same information is available through the API.

• Search for users, devices, and organizations in the CrashPlan console.
• Build or reconcile a custodian list programmatically with the User, Computer, and Org endpoints, which suits matching a list of names from a case management system against CrashPlan accounts.
• List a device's archives and the destinations holding them with the Archive and BackupSets endpoints.
• Produce a list of every active or deactivated device from Administration > Status > Reporting, on the Device Status tab, or through the DeviceBackupReport endpoint.

Preservation

Legal hold is the CrashPlan feature that preserves a custodian's data for a matter, independently of what the custodian does with their own backups.

• Define what to preserve and for how long with a preservation policy. See Create a legal hold preservation policy.
• Apply that policy to a group of custodians with a matter. See Create a legal hold matter and add custodians.
• Create and manage matters, memberships, and policies through the legal hold endpoints, which suits environments where holds are raised from a case management system rather than by hand.
• Tie a matter to an external case file or eDiscovery platform using its External Reference field, which is searchable through the same endpoints.

Preservation begins when a custodian is added to a matter. From that point their data is retained on the preservation policy's terms, which is what allows a matter to keep deleted files and older versions that the custodian's ordinary retention would remove. Material their retention had already purged before the hold applied is not recoverable, so raise a hold as early as a matter allows.

A matter sometimes arises after a user has already been deactivated, which is the case cold storage covers. Deactivating a user moves their archives to cold storage for the period their organization sets, and reactivating them within that period makes them available to be added to a matter. The ColdStorage endpoint reports what is held and can extend an archive's purge date, which widens the window in which a late matter can still reach that data. See Cold storage.

Confirm the file selection with your legal team before a matter relies on it. See Best practices for legal hold file selections and exclusions.

Collection and production

Collecting from a legal hold restores a custodian's preserved files to a device you choose, and the same mechanism produces files at the end of a matter.

• Collect through the console from the matter that holds the custodian. See Collect files from a legal hold.
• Collect through the restore endpoints, which push files to a device in the same way the console does, and accept a filter as well. A collection can include or exclude specific paths, include or exclude filename patterns, include files the custodian deleted, include every version of a file rather than only the most recent, and return files as they stood at a given date.
• Deliver files to a location your process already uses by defining and selecting a restore target with the restore targets endpoints.

Those filters are what make a collection proportionate. A matter concerning a date range, a file type, or a project folder can be collected on exactly those terms rather than taking a custodian's whole selection and reducing it afterwards.

Evidence of collection activity

A matter often needs a record of the collection itself. CrashPlan records this in three places.

• Legal hold activity. Each matter records its creation, closure, custodian additions and releases, and file collections. The same events are available through the legal hold event endpoints. See View legal hold activity.
• Restore history. The console shows who restored from an organization and when. Select Administration > Environment > Organizations, select an organization, select the number of Restores, and export the history as a CSV file from the action menu. The RestoreHistory endpoint returns the same record: who requested the restore, whose data it came from, the device that received it, when it started and finished, and how many files and bytes were restored. File names are not recorded.
• Audit log. Administrative actions across the environment are recorded independently of any matter. See Audit Log.

Where a matter needs the names of the files a custodian restored themselves, the CrashPlan app writes them to restore_files.log on the device. Retrieve the logs from the console by selecting Administration > Environment > Devices, selecting a device, and choosing Retrieve Logs from the action menu.

Ending preservation

Releasing a custodian or closing a matter ends preservation and begins the permanent deletion of the data the matter was preserving.

Release a custodian or close a matter in the console, or through the legal hold deactivation endpoints. See Release custodians and close a matter.

Getting started with the API

The CrashPlan API is a standard REST interface, and every endpoint named in this article is documented in it. Most eDiscovery workflows use it through short scripts that shape the output for a review platform.

• Start with Tools for interacting with the CrashPlan API, which covers authentication and the API documentation for your environment.
• Engage the CrashPlan Professional Services team through your Account Executive for help building a workflow.

Related

• How legal hold works explains what a legal hold does to a custodian's devices and data.
• Troubleshoot legal hold covers preservation and collection problems.
• Legal Hold reference describes every field in the Legal Hold area of the console.