This is the action phase where the data is actually captured or preserved, creating that snapshot in time of all types of data to be culled in the future, sometimes years in the future.
Why Preserve the Data?
A high ranking officer in your company suddenly leaves and the notebook computer and desktop computers they left behind are reassigned to their replacement. A year later, you start to hear from loyal clients who have been contacted by the former employee about a new competing business. This would not be the time to wish the computers had been sequestered. Data on the computers could have helped prove:
efforts to recruit other employees
movement of critical data to an online storage service
movement of critical data to external devices
theft of contact correspondence and/or databases
When to Preserve the Data?
In the scenario above, intuition is the guide, there is no clear-cut answer in such a situation. Given the cost of new computers today, taking the computers out of service immediately would have been an economical choice when contrasted against possible loss of business to the competition.
For businesses, data should be preserved as soon as there is even a hint that a litigation hold is pending. Examples of what needs to stop would be any deletion of data by employees from work computers and for IT personnel, stop destroying old back-up media that may make it into a cycle of wipe and reuse.
What Data Should Be Preserved?
Obvious answers are desktop and notebook computers used by employees who are named in a litigation hold. Other devices to consider are back-up media currently on a reuse rotation schedule; consider purchasing additional media and continue to sequester older back ups. Less obvious answers would be external storage devices, PDA's, Blackberry devices, cell phones, etc.
The depth and breadth of just what data needs preserving can be determined at the onset of a litigation hold.