How in-place holds work
In-place holds work on the basis that messages are evaluated
by the Email Lifecycle Assistant (ELC), a component of the Managed
Folder Assistant (MFA), against hold criteria when they are considered
for deletion from a database. If an item satisfies hold criteria, ELC
moves it into the DiscoveryHolds subfolder in the Recoverable Items
folder. Users cannot see items held in this folder by using normal
clients such as Outlook. It is possible to view the items by using a
raw protocol client such as MFCMAPI or the EWS Editor. However,
although you can export a copy of an item, you can’t remove items from
the DiscoveryHolds folder by using these utilities.
As noted
earlier, an administrator can assign up to five hold queries to a
mailbox. If a sixth hold query is added, the entire mailbox is placed
on hold because it is more efficient to retain everything rather than
attempting to resolve multiple queries.
The life cycle of items subject to a query hold is as follows:
Normal
processing occurs for the item. It is delivered or created, dealt with
by the user, and eventually deleted and moved into the Deleted Items
folder. The user might delete the item, or the MFA might move it to
comply with a retention policy.
Eventually,
the Deleted Items folder is emptied, and the items held there are moved
into the Recoverable Items folder. Because the item is still available
to the user and accessible by an eDiscovery search, there is no need to
consider it against any query hold criteria that might be set on the
mailbox. As normal, the user can restore an item from the Recoverable
Items folder and move it back into a regular mailbox folder.
The
MFA runs on a work cycle basis with the goal of processing every
mailbox on a server at least once a week. As part of its regular
processing, the MFA assesses items in the Recoverable Items folder to
determine whether their retention period has expired. Because an
in-place hold has been assigned to the mailbox that requires items to
be retained for another period (or indefinitely), the MFA moves expired
items that would otherwise be permanently removed from the database
into the DiscoveryHolds folder. The same processing occurs if a user
deletes an item from the Recoverable Items folder.
ELC
evaluates the items in the DiscoveryHolds folder to determine whether
they are needed for the in-place hold. If the item satisfies the
criteria, the item is retained. If not, it is purged from the database
as normal.
ELC continues to
evaluate items in the DiscoveryHolds folder every time the MFA
processes the mailbox. Items are retained for as long as they satisfy
any of the in-place holds in existence. When a query-based hold is
removed, the items that were retained are purged from the database
unless they are subject to another in-place hold.
Figure 17
shows the contents of the DiscoveryHolds folder for a mailbox that is
subject to an in-place hold. You can see that the folder is a subfolder
of Recoverable Items and the items in the folder.
After the last query-based holds are removed from a mailbox, the items held in the DiscoveryHolds folder are removed.
