SUMMARY
How to use the legal hold retention control feature to prevent a backup from being purged from the appliance.
ISSUE
In some cases, you may wish to guarantee certain backups for some clients are not purged for a specified time ensuring online ability to instantly recover data is maintained through a sufficient PRO term, or to protect specific select jobs fro ever being purged.
RESOLUTION
When to Use Legal Hold Retention Settings
If you want to ensure that your older backups are NEVER deleted to make space for newer backups until a certain point, then set the Keep backups for N days option. This applies a standard retention policy that will ensure that no backups are deleted unless they are older than N days. If you run out of storage space before meeting your retention of at least N days, new backups will fail as old data will be unable to be removed.WARNING: If the appliance is full of backups and all remaining backups are subject to legal hold, incoming backups will fail. It is critical to set legal hold to a low enough value such that some backups are always outside of this threshold. The best practice is to set Legal Hold to a value at least one full backup rotation less than the desired backup retention maximum.
Important note, Legal Hold protects every backup in a chain going back to the chain's full (called the head). Because Unitrends can only purge the entire chain at once (keeping an incremental without keeping it;s full would render that incremental unrecoverable, so we always keep the full too). This means that if legal hold is set to 15 days, we cannot purge any part of a chain untuil every part of the chain is over 14 days old. Typically when using incremental forever backup strategies as recommended a synthetic full happens every 14 days. It is possible that the head "full" of a backup chain would be as old as 29 days before the most recent incremental dependent on that full is more than 15 days old. To set a legal hold of 15, you would need to ensure you could always exceed a retention temporarily of 29. If you cannot meet that higher number, legal hold may cause backup failures due to out of space conditions.
Legal Hold is typically used in conjunction with a regimented cold copy archive strategy, or hot copy replication to ensure 2 or more copies of data always exist for recovery. In most organizations subject to disaster recovery compliance (HIPAA, SOx, PCI, HiTEK, etc) data must not only be kept for a specific period of time, it is usually the law that at least one copy be offsite within 7 days (some compliance is next business day). In these cases, Legal Hold is used to ensure the data is not locally purged until it has reasonably been archived to another offsite media. Typically a legal hold of 14 or 30 days is used which is more than sufficient to ensure other copies of compliance data have been made or issues with such have been remediated. In these cases legal hold is also typically only used for systems that are subject to that compliance, but not all systems typically are.
In other cases, you may wish to ensure selective files for certain systems are available for online recovery quickly without the need to import from other copies and a longer retention may wish to be enforced. In these cases, legal hold may be a larger value. For example, a file server may tend to have users periodically request individual files or folders to be recovered with great speed going back many weeks or even months. Generally these higher settings are applied selectively only to specific servers that require them, and are not used globally.
NOTES
For information on how this topic interacts with other retention settings, see this KB https://helpdesk.kaseya.com/hc/en-gb/articles/4407528044817 or,
To gain an understanding of how the Unitrends system handles backup retention, see the following sections of the Recovery-Series and UEB Administrator's Guide: