WorkDrive Data Retention

Organizing and tracking the WorkDrive files can be a tedious process. Zoho Mail's eDiscovery makes it easy to search, create holds, export files and produce them as evidence whenever they are required for audits or legal investigations. You can enable WorkDrive retention and configure retention policy either at the time of setting up eDiscovery or from the Settings section. When a user deletes a file permanently (removed from trash), it will be retained in the eDiscovery portal for the duration you specify in the default retention policy.

Create a new Investigation

Follow the below instructions to create a new investigation:

1. Log in to Zoho Mail Admin Console and select eDiscovery on the left pane.
2. Navigate to the Investigations section to view or create investigations.
3. Click the   Create Investigation button.
   
4. Provide the Investigation name and a detailed description.
   
5. Click Save. The investigation gets created.

You can now do the following actions in the Investigation you created:

• Search - Search WorkDrive files based on specific criteria. You can save any number of searches before creating Holds.
• Hold - Create one or more holds based on different conditions, as required for the investigation. The deleted files that are placed on Hold via investigations will not be deleted even after the expiry of the retention period defined by retention policy.
• Export - Use this tab to export a user or team's WorkDrive file.
• Audit logs - The activities performed by admins in a particular investigation can be viewed under the Audit logs tab of that investigation.

Create a WorkDrive Search

You can create multiple searches and save the search with the preferred condition queries. Saved search allows you to quickly locate a file saved by users or teams in your organization. Preview and validate the search results before creating a hold. To create a WorkDrive search, follow these steps:

1. Log in to Zoho Mail Admin Console and select eDiscovery on the left pane.
2. Navigate to the Investigations section and create a new investigation or select an existing one.
3. From the Searches tab, choose WorkDrive in the All Services drop-down and click New Search.
   
4. Make sure that WorkDrive is selected in the Service name drop-down.
5. Enter a name for the search and choose the desired option:
   • All files and folders - Individual user's files/ folders and team folders will be searched.
   • Specific users' folder - Add the users under the Username whose files you wish to search.
   • Team folders - Enter the Team folder name to be searched.
6. Select the File status from the drop-down menu. Available options are all files, active files, trashed files and deleted files.
7. You can either select a predefined duration or choose Custom range.
8. Select the start and end dates for the custom range option. 
9. Choose the filter condition:
   • File/ folder name - A search will be performed on the file or folder name. Enter the file or folder name to be searched.
   • File content - A search will be performed on the file content. Provide the desired file content to be searched.
   • Both - Search will be performed on file name, folder name and file content.
10. Click Preview results and validate the search result.
    
11. If required, click the download icon against a file to save it to your computer.
12. Click Save search to save the search for future reference.
    

The search results get saved to the investigation.

Create a WorkDrive Hold

Holds are used to retain WorkDrive files for a legal investigation, or audits. There can be multiple Holds created for each Investigation. Once a Hold is created, the files that are part of the hold will be retained until the hold exists. The steps to create a WorkDrive hold are given below:

1. Log in to Zoho Mail Admin Console and select eDiscovery on the left pane.
2. Select Investigations and open to the desired investigation for which you wish to create a hold.
3. Navigate to the Holds tab, choose WorkDrive in the All Services drop-down, and click New Hold.
   
4. Make sure that WorkDrive is selected in the Service name drop-down.
5. Specify the Hold name and choose the folder type:
   • Specific users' folder - Hold will be created for the selected users. Select the user mailbox whose files you wish to save.
   • Team folders - Hold will be created with all the files within the organization's team folders. Select the desired team folders to be saved.
6. Click Preview results to view the files and folders. You can also click the download icon against a file to save it to your computer.
   
7. Click Save hold.

The WorkDrive files and folders get saved to the Hold within the investigation.

Exports

Exports allow you to save/ download a copy of your organization's WorkDrive files to your computer. To create a new export, follow these instructions:

1. Log in to Zoho Mail Admin Console and select eDiscovery on the left pane.
2. Navigate to Investigations and open an existing investigation.
3. From the Exports tab, choose WorkDrive in the All Services drop-down, and click New Export.
   
4. Make sure that WorkDrive is selected in the Service name drop-down.
5. Enter a name for the export and select Specific users' folder or Team folders.
6. Search and add the desired user mailbox or a team folder based on your selection.

7. Choose whether to include deleted and trashed files in the export.

   Note:

   The maximum allowed file size for an export is 50 GB. Exported files will be available for seven days from the date of export and cannot be downloaded later.

8. Click Export and provide confirmation in the dialog that appears. The export gets scheduled.
9. Click the refresh icon to view the export status.
   
10. Select a completed export and navigate to the Files tab.
11. Hover over the exported file and click Download file to save it to your computer.
    
12. Alternatively, you can select Preview results and click the download icon to save a file.
13. If required, click the duration drop-down and modify the range as per your requirements.
14. Click the download icon next to a file to save it to your machine.
    

Audit logs for an investigation

Once you have created an investigation, you can view all the investigation activities in the Audit logs tab, inside that particular investigation.

Steps to view the audit logs related to a particular investigation

1. Log in to Zoho Mail Admin Console and select eDiscovery on the left pane.
2. Select Investigations and open the relevant investigation.
3. Navigate to the Audit logs tab and choose WorkDrive under the Service name.
4. Select the Start date and End date.
5. If required, enter the desired User accounts whose logs are required.
6. Select the desired actions from the options available:
   • Select all actions
   • Saved Search
   • Search
   • Holds
   • Exports
   • Audits
7. Select the Preview audit option to view the activity.
   
8. Click Download audit from the preview page.
9. Encrypt the file with a password to prevent unauthorized access to your data.
10. Click Download audit to download the audit logs to your machine.