What is your first move when a lifecycle rule deletes legal-hold VPN logs mid-case?

## The order matters, and it is not the intuitive one The instinct on discovering that four months of VPN and firewall records covering an intruder's traversal from a partner network were expired by an object-lifecycle rule is to fix it before anyone notices. That instinct is what turns a preservation failure into a much worse problem. The defensible order is: stop further loss, tell counsel, scope the loss with evidence, look for second copies, then repair the hold. ## 1. Stop further loss Disable the offending rule, then treat it as a sentinel rather than an isolated fault. If one deletion mechanism was never suspended, the same gap probably covers others: index-lifecycle delete phases in the SIEM, ticket-system purges, backup expiry, vendor-side endpoint telemetry rolling off, and rebuild queues that reimage hosts. Sweep them in one pass, and where a platform supports an explicit immutability flag on stored objects, set it rather than relying on somebody remembering not to re-enable the rule. ## 2. Notify counsel immediately Counsel owns the duty and the disclosure decisions that follow, including whether and how the loss is described to the other side. Delay is the aggravating factor: a loss reported the day it was found reads as a control gap, while a loss reported after a month of quiet remediation reads as concealment, and that is the distinction between a curable problem and an argument about intent. Route the notification through the channel your organisation uses for privileged communications. ## 3. Scope the loss with evidence Establish, from records rather than recollection, what actually went: the source system, the object or index names, the exact date range now missing, the rule that deleted it with its configured age, the date the deletions ran, when the hold was issued and to whom, and who confirmed which jobs were suspended. Preserve the evidence *of the deletion* too, because storage-side management logs and the rule's own configuration history are what let a third party verify your account. ## 4. Hunt for surviving copies This is the step that most often changes the outcome, because the sanctions that matter turn on whether the information can be restored or replaced. For network session records four months old, realistic second copies include: - the SIEM's searchable index or a warm tier, which often has a different lifecycle from the raw archive - a backup or snapshot of the archive taken before expiry - the firewall or VPN appliance's own local buffer, usually short but occasionally decisive - flow records from a different sensor covering the same path, which prove that bytes moved between two endpoints but carry no payload - extracts already quoted into case notes, tickets, or an earlier report to management - the partner's records of their end of the same tunnel, requested through counsel rather than through an engineer-to-engineer chat Document the search as thoroughly as the loss, including where you looked and found nothing. ## 5. Things that turn this into misconduct Do not regenerate the period from a model, a heuristic or a partial source and present it as the original. A reconstruction may be a legitimate analytical product if it is labelled as one, with its inputs and assumptions stated; passed off as recovered evidence it is fabrication. Do not edit timestamps or file names to make surviving material look continuous. Do not delete the lifecycle-management logs that show what happened. And do not let an engineer explain it away in an email to the partner before counsel has seen it. ## 6. Repair the hold The recurring defect is a hold written about people. Custodian notifications preserve mailboxes and drives; a lifecycle rule belongs to no custodian, so nobody was told. Rewrite the scope as a table of system, date range, destructive mechanism and the named owner who has confirmed suspension in writing, then re-confirm it on a schedule for as long as the matter is open. The reason to state the fix in an interview is that it shows you read the incident as a scoping failure rather than an individual's mistake. ## What you will be asked in the deposition Expect: when did you learn preservation was required, what did you do that day, who told the platform team, what did they confirm, and how did you discover the loss. Every one of those answers is a document you either wrote at the time or did not.