How do we handle backups that still contain records under a legal hold after the live copies were deleted?

A legal hold suspends normal disposition. So when the live copies of records have already been deleted, any surviving instance, including the version sitting in a backup, becomes the operative copy that must be preserved. The fact that it lives on backup media does not exempt it from the hold.

Why the backup still matters

A legal hold attaches to information, not to a particular storage location. If responsive records exist only in a backup after the live copies are gone, that backup is now the source of record for the held material and may not be overwritten, recycled, or aged out under your normal backup rotation. Letting a routine tape recycle destroy held content can expose the organization to spoliation findings and sanctions.

Practical steps

• Map the gap immediately. Identify which held records survive only in backups, on what media, and when those backups are scheduled to be overwritten.
• Suspend the rotation for affected media. Pause recycling, overwriting, or destruction of any backup set that contains held records until the hold is released.
• Document the decision. Record what is being preserved, why, and who authorized it, so you can later show defensible, good-faith handling.
• Coordinate with legal and IT. Counsel defines the scope of the hold; IT executes the technical preservation. Neither should act alone.
• Consider restoration where appropriate. If the held records are needed for review or production, restore them to a managed environment rather than relying on the backup as a long-term repository.

Avoiding the problem going forward

Backups are designed for disaster recovery, not records retention, and treating them as a de facto archive creates exactly this conflict. The cleaner pattern is to apply holds at the records system level before live copies are deleted, so disposition is suspended on the authoritative copy rather than discovered later on a backup tape.

When the matter closes and the hold is formally released, the surviving backup content returns to normal disposition rules and can be destroyed under your approved schedule, with the release documented just as carefully as the hold.

For related guidance on preserving authoritative copies over time, see /topics/archives-preservation/.