Litigation holds and backups: when old backups become evidence

About this article: AI-assisted writing, reviewed against the cited sources. This is source research, not lab validation. Check the stated versions and your own requirements before making changes.

This guide is general information, not legal advice. If your business is in, or expects, a dispute, speak to a lawyer before changing how you keep or delete anything.

Most businesses think of backups as insurance against disk failure or ransomware. They are rarely thought of as records. But when a dispute arises, the other side may ask what documents exist, and backups are one place where old emails and files can still be found. At the same time, backup systems usually delete old copies automatically, and once litigation is in view, automatic deletion needs more thought.

This guide is for business owners, managers and in-house legal staff. It explains how Australian courts and the Australian Law Reform Commission (ALRC) have treated backups in discovery, why holds matter, and how to plan for one without turning backups into a poor substitute for an archive.

Why it matters

Two risks pull in opposite directions (our reading). If a business keeps every backup forever, just in case, it builds an expensive, hard-to-search store of old data, which may also hold personal information it should have destroyed. If it keeps deleting on schedule after a dispute is anticipated, it may be accused of destroying evidence. A plan agreed before any dispute makes the right path easier to follow.

Backups are made for recovery, not as archives

Courts have recognised the purpose of backups while still expecting parties to deal with them. The ALRC's 2010 consultation paper on discovery quotes Sackville J in BT (Australasia) Pty Ltd v New South Wales & Telstra, finding that Telstra had not fully met its discovery obligations because it "neither disclosed the existence of back-up tapes, nor took any steps to restore those tapes with a view to ascertaining whether and how discoverable electronic material could be identified and presented in usable form."

The judge went on: "I accept and appreciate that the purpose of making and retaining the back-up was essentially disaster recovery, rather than archival. Nonetheless, as subsequent events have demonstrated, it is feasible, albeit difficult and expensive, for the tapes to be restored and a review process set in place to identify discoverable material."

In our reading, the lesson for a business is that calling something only a backup does not by itself remove it from consideration.

How far a search must go

The ALRC describes the question as one of reasonableness: "A particular issue that can arise in an e-discovery process is the extent to which it is 'reasonable' for a party to search through back-up tapes or disaster recovery systems. This is a question of fact and degree and, therefore, will depend on the circumstances of each case".

It gives examples on both sides. In one, the judge "accepted that it would be a very substantial burden on the respondent to search for emails stored electronically in computer terminals, servers and backup tapes", yet still held the emails were relevant enough not to be ignored. In another, the burden of discovering deleted emails "would have been disproportionate to the potential probative value of that electronic information—had the defendant not already embarked upon the course of recovering the deleted emails from the backup tapes."

The cost can be high. The ALRC heard "that the discovery of information stored on old back-up tapes can require the reconstruction of outmoded hardware at great expense in order to read the tapes only to discover completely irrelevant information."

The Federal Court's Technology and the Court Practice Note (GPN-TECH), issued 25 October 2016, stresses proportion: "any discovery plan and document management protocol considered by the parties must be proportionate to the nature, size and complexity of the case and should not amount to an unreasonable economic or administrative burden on the parties or the Court." The ALRC also suggested a discovery plan "might address such issues as whether and the extent to which the party giving discovery will search through back-up tapes or disaster recovery systems for particular classes of electronic documents identified in the plan."

When routine deletion becomes a problem

Ordinary deletion under a sensible policy is normal. The ALRC records a comment by Professor Peta Spender that "although a good document management policy may involve the destruction of documents, at some point the routine destruction of corporate documents rises to the level of spoliation of evidence."

It points to McCabe v British American Tobacco Australia Service Ltd as illustrating "the tension in practice between appropriate and legitimate destruction of documents in accordance with a document management system, and the deliberate destruction of documents". The ALRC also notes: "The wrongful destruction of documents is also an offence under the Crimes Act 1958 (Vic)." The rules and their reach differ between jurisdictions (our understanding); this is a reason to get advice early, not to guess.

What a legal hold is

The ALRC describes the idea, which developed in the United States: "Legal holds are implemented by interrupting a company's ordinary document management system—which, for example, might delete emails after 30 days—to ensure relevant material is preserved."

Law firm Clayton Utz, writing for Australian businesses in 2022, advises: "When litigation is reasonably anticipated, act quickly , and issue a hold letter to ensure documents are not destroyed inadvertently." It describes the hold letter as "directing them to segregate and protect from destruction documents and data (both hard copy and electronic) that are, or arguably may be, relevant to the litigation." It adds that relevant documents should "be retained until the conclusion of the litigation."

Retention policy and holds work together

A hold is easier to defend when it interrupts a clear retention policy. Clayton Utz notes there is no single period: "Although the general rule of thumb is that documents should be preserved for seven years, the obligation to retain documents will vary, depending on: the jurisdiction, as document retention obligations are scattered across numerous pieces of Federal, State and Territory legislation; the industry in which a business operates; and the type of document that has been created".

It also stresses preparation: "Ensure staff are familiar with the document retention policy , and how to respond should a hold letter be issued." And it gives the reason: "A hold letter will ensure that the company is best placed to defend itself against any subsequent allegations of document destruction."

Lawyers have their own duties too. The ALRC notes that in New South Wales, "a legal practitioner is prohibited from destroying or wrongfully moving documents, and from advising a client to do the same, if legal proceedings are likely." In our reading, this is one more reason to bring a lawyer in early, before IT changes any backup setting in response to a dispute.

Backup retention is usually much shorter than record retention (our understanding). Backups are kept for weeks or months to allow recovery; records are kept for years in systems built to find them. Mixing the two, by stretching backup retention to cover record-keeping, tends to produce the costly, hard-to-search store the ALRC describes.

Backups make poor archives for discovery

In our reading, a hold is usually best met from the live systems and records where relevant documents sit, not by keeping every backup. Backups are a poor discovery source because:

• They are copies of whole systems, so finding one person's emails can mean restoring everything.
• They need the right software, keys and sometimes hardware to read, which may not survive years of change.
• They mix relevant and irrelevant data, including personal information that would otherwise have been destroyed.
• They are hard to search until restored.

That does not mean backups can be ignored. Where relevant data now exists only in backups, for example because it was deleted from live systems before the hold, the backups covering that period may need to be kept (our understanding). The decision is a legal one, made with advice.

Planning before any dispute

The following steps are our recommendation.

1. Write down what your backups are for and how long each set is kept. This shows that deletion follows a policy.
2. Know how to pause deletion for a chosen set of backups without stopping new backups.
3. Name who decides: who can issue a hold, and who tells the backup provider.
4. Prefer preserving at the source: hold mailboxes, folders and records directly where your systems allow.
5. Record the preservation scope. Under the legal owner's instructions, identify the required backup points, complete dependent chain, catalog/manifest and encryption keys. Record their identities, custody, hold coverage and any gap; a retention-setting change alone does not establish readable evidence.
6. Require documented legal-owner release. Before any held copy returns to normal disposal, the legal owner must consider appeals or continuing proceedings, overlapping holds and all other retention duties, then approve the exact release scope in writing. A review reminder or nominal end date is not release authority. Record the decision and retain any material still covered by another duty.

Read-only checks

These checks read information; they change nothing. In Windows PowerShell, this command lists candidate files by filesystem modification time in the named folder only. It does not identify backup recovery-point dates, complete chains or retention coverage (the path is an example):

Get-ChildItem -Path 'D:\Backups' -File | Sort-Object LastWriteTime | Select-Object -First 10 Name, LastWriteTime

LastWriteTime is the time a file was last written, not the date of a usable backup point. Copies can retain old timestamps and containers can be rewritten. Establish dated restore points and all required dependencies from the backup catalog/manifest and job records, recording missing pieces and coverage limits. An authorised isolated retrieval establishes readability for the selected material; the oldest file date does not.

Then review:

1. Retention per backup set. How long is each set kept, and what deletes it?
2. Pause ability. Can deletion be paused for one set without affecting others?
3. Hold process. Is there a written step for telling IT or the provider about a hold?
4. Open holds. Are any holds in place now, and is each still needed?

These checks show the design. They do not show whether a held backup can still be read; a test does (our recommendation).

Safe restore rehearsal

1. Agree scope and authority with the legal owner if held evidence is involved. Use synthetic/non-sensitive material for routine training; do not alter preserved evidence to run a test.
2. Identify a selected dated point and its complete chain, catalog, software and keys from the inventory and job records. Record identifiers and custody as instructed.
3. Retrieve a separate authorised sample copy into an isolated environment with no production connection. Preserve the held originals and their required dependencies unchanged.
4. Check that the selected sample can be read and the requested document found. Record retrieval time, the method and the exact scope; this does not establish all held material is readable or complete.
5. Record gaps for the legal owner and follow the approved treatment of test copies. Release of any hold requires the separate documented decision described above.

Diagnosing what you find

• The oldest backup cannot be read: the software version is no longer available; the encryption key was not kept; or the storage format has changed.
• Finding one document took days: the backup covers whole systems; there is no index; or the data had to be restored in full first.
• Deletion could not be paused for one set: retention is set system-wide; the provider controls it; or no one knew where the setting was.
• Holds were never released: no one owns them; there is no record; or release was not part of the process.

Worked example (illustrative)

In this invented scenario, a lawyer directs preservation of email for three staff and a defined earlier period after one mailbox was cleared. IT records the mailbox holds and the identities of the required backup chain, catalog and keys, then confirms the instructed components are protected from routine expiry. A separate authorised sample copy is retrieved in isolation and the specified sample message is readable; this hypothetical result covers that sample only. A monthly review tracks gaps and continuing obligations. No hold is released until the legal owner approves the exact scope after checking appeals, other proceedings, overlapping holds and retention duties.

Risks and limits

• This is general information, not legal advice; obligations depend on the case and jurisdiction.
• The ALRC material dates from 2010 and 2011 and describes cases at that time; rules and practice notes may have changed.
• Original drafting used an archive copy of GPN-TECH. This correction uses the independent reviewer's saved primary-page public-web material for the cited scope; it is not a complete current-law audit.
• One source is a law firm article, not a court or regulator.

Sources

All accessed 14 November 2026.

• ALRC, Discovery in Federal Courts (Consultation Paper 2, November 2010), Issues with the process of discovery: https://www.alrc.gov.au/publication/discovery-in-federal-courts-alrc-cp-2/3-discovery-practice-and-procedure-in-federal-courts/issues-with-the-process-of-discovery/
• ALRC, Managing Discovery (Report 115, March 2011), Potentially unethical discovery practices: https://www.alrc.gov.au/publication/managing-discovery-discovery-of-documents-in-federal-courts-alrc-report-115/12-professional-and-ethical-discovery-2/potentially-unethical-discovery-practices/
• Federal Court of Australia, Technology and the Court Practice Note (GPN-TECH), 25 October 2016 (Internet Archive copy): https://www.fedcourt.gov.au/law-and-practice/practice-documents/practice-notes/gpn-tech

• Clayton Utz, Litigation 101: Document retention for business (August 2022): https://www.claytonutz.com/insights/2022/august/litigation-101-document-retention-for-business

• FileSystemInfo.LastWriteTime Property (System.IO) | Microsoft Learn: https://learn.microsoft.com/en-us/dotnet/api/system.io.filesysteminfo.lastwritetime?view=net-10.0

• NIST SP 800-209, Security Guidelines for Storage Infrastructure: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf

Related future topics

• Personal information in backups and the duty to destroy
• Australian record retention periods
• Preserving mailboxes at the source

This article was originally published on 14 November 2026.