I understand that DA has the ability to place documents that it returns as a result of searches in a "legal hold" state, which would then prevent the documents from being deleted as a result of user action or EV retention policy. My question is, how do I enforce this legal hold going forward?
For example, say I create a search for all email sent and received by user "X". My search result set will contain all of that email up until the last one received/sent that is found in the Vault (assuming that's the criteria used).
Now what happens to all of the email going forward. In other words, tomorrow, User "X" receives and sends 100 new messages. How do I now include those messages (or a subset of those messages, as defined by my search criteria) as part of an ongoing legal hold?
Is there some sort of scheduling mechanism in DA? Do I rerun the same query (that would seem to be very inefficient)? Do I create a new query every day?
Help!!!
