Legal Hold and Cyber Discovery Lab
Practise legal hold and cyber discovery. Three fictional clients, three decisions where lawyers get hurt: logs that roll off before anyone stops them, a request for every log ever written, and a departing employee's evidence that sits in another jurisdiction.
Each fact pattern is scored on seven decisions, with a seeded "how it played out" step, named classic mistakes, and a case memo and register you can download with Pro. Where the law is unsettled, the best answer is the defensible practice.
Not legal advice. Educational practice only, not legal advice. The people, companies, domains and facts are fictional. Rules differ by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer before relying on anything here.
Not legal advice. Educational practice only, not legal advice. The people, companies, domains and facts are fictional. Rules differ by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer before relying on anything here.
You are outside cyber counsel at Fennimore Rook LLP
Fennimore Rook LLP is a fictional law firm with a cyber incident practice. Three clients call about the same quiet risk: the evidence disappears, or the other side asks for too much of it. You advise on when a legal hold must start, which logs and devices it covers, how to answer sweeping requests for security data, and how to keep a defensible record of what you preserved. All parties are fictional. The legal rules named are real and were checked against the sources listed on the page.
- 1Issue spotting: What is the real preservation or discovery problem in this fact pattern?
- 2Governing rule: Which rule or test decides it?
- 3Hold scope and timing: What do you preserve or produce, and when?
- 4Evidence and chain of custody: What record do you create now so you can prove what you did?
- 5Custodians and data sources: Which custodians, systems and materials belong in scope? Tick every one that does.
- 6Hold notice and communications: What do you send, to whom, and how?
- 7Next step: What do you do next?
- 8See how it played out, from a seeded outcome
3 fact patterns. Pro keeps the rules in a fold-out and hides the hints. A good record choice uncovers hidden complications as you go. Passing score is 70%.
Loading…
TL;DRWhat this lab is
4 points
- A fictional-client practice lab for cyber counsel: three fact patterns on legal hold, log retention against a hold, security-data discovery and chain of custody, with seeded outcomes.
- It is built from real rules (FRCP 26, 34 and 37(e), FRE 502, 901 and 902, GDPR Arts 5, 17 and 49) that were checked against rule and statute texts, listed on the page.
- Educational practice, not legal advice. Rules vary by jurisdiction and change.
- Pro lab: free to try with 3 Pro tool runs in total, shared across all Pro tools. Downloading the case memos and CSV register is Pro only.
Sources checked
Every rule named in this lab was checked against these pages on 2026-11-02. Law changes, so read the current text before you rely on any of it.
The logs that roll off on Sunday
- Federal Rules of Civil Procedure, Rule 37 and Advisory Committee notes (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 37(e) text: ESI that should have been preserved in anticipation or conduct of litigation, lost because reasonable steps were not taken and not replaceable; prejudice allows measures no greater than necessary; presumptions, adverse-inference instructions or dismissal only on intent to deprive. 2015 committee note: the rule rests on the common-law duty and creates no new one, does not apply to loss before the duty arises, requires reasonable steps not perfection, and says the prospect of litigation may call for intervening in routine deletion.
- Federal Rules of Civil Procedure, Rule 26 (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 26(b)(1) relevance and proportionality factors; 26(b)(2)(B) sources not reasonably accessible; 26(b)(5)(A) express claim and description of withheld privileged material; 26(c)(1)(G) protective order for confidential commercial information; 26(f)(3)(C) discovery plan covers preservation of ESI.
- Federal Rules of Evidence, Rule 901 (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 901(a): the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims.
Three years of every log
- Federal Rules of Civil Procedure, Rule 26 (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 26(b)(1) relevance and proportionality factors; 26(b)(2)(B) sources not reasonably accessible; 26(b)(5)(A) express claim and description of withheld privileged material; 26(c)(1)(G) protective order for confidential commercial information; 26(f)(3)(C) discovery plan covers preservation of ESI.
- Federal Rules of Civil Procedure, Rule 34 (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 34(a)(1)(A) ESI is within the rule; 34(b)(2)(B) objections must state grounds with specificity; 34(b)(2)(C) an objection must state whether responsive materials are withheld.
- Federal Rules of Evidence, Rule 502 (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 502(d): a federal court may order that disclosure connected with the litigation before it is not a waiver, also binding in other federal or state proceedings.
The departing engineer in Germany
- Federal Rules of Civil Procedure, Rule 37 and Advisory Committee notes (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 37(e) text: ESI that should have been preserved in anticipation or conduct of litigation, lost because reasonable steps were not taken and not replaceable; prejudice allows measures no greater than necessary; presumptions, adverse-inference instructions or dismissal only on intent to deprive. 2015 committee note: the rule rests on the common-law duty and creates no new one, does not apply to loss before the duty arises, requires reasonable steps not perfection, and says the prospect of litigation may call for intervening in routine deletion.
- GDPR Article 5 (gdpr-info.eu reproduction of Regulation (EU) 2016/679) (reproduction of official text, checked 2026-11-02). Art 5(1)(e) storage limitation: identifiable form kept no longer than necessary for the purposes of processing. The official EUR-Lex page could not be opened in this session.
- GDPR Article 17 (gdpr-info.eu reproduction) (reproduction of official text, checked 2026-11-02). Art 17(3)(e): the erasure right does not apply to the extent processing is necessary for the establishment, exercise or defence of legal claims.
- GDPR Article 49 (gdpr-info.eu reproduction) (reproduction of official text, checked 2026-11-02). Art 49(1) opens "in the absence of an adequacy decision ... or of appropriate safeguards"; condition (e) is a transfer necessary for the establishment, exercise or defence of legal claims.
- Federal Rules of Evidence, Rule 901 (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 901(a): the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims.
- Federal Rules of Evidence, Rule 902 and committee notes (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 902(14) certified data copied from an electronic device, medium or file; committee note explains authentication by hash value comparison certified by a qualified person, and that hearsay is a separate question.
Frequently asked questions
Is this legal advice?
No. It is educational practice with fictional clients. Rules vary by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer.
When does a legal hold have to start?
In US federal practice the duty to preserve is tied to anticipated litigation. The committee note to Rule 37(e) describes it as the common-law duty when litigation is reasonably foreseeable. What counts as foreseeable depends on the facts and the court.
Does Rule 37(e) only punish bad faith?
No. Curative measures for prejudice can follow a failure to take reasonable steps. The harsher measures, such as an adverse-inference instruction or dismissal, require a finding of intent to deprive.
Does GDPR stop a company keeping data for a lawsuit?
Article 17(3)(e) says the erasure right does not apply to the extent processing is necessary for legal claims, and Article 5(1)(e) ties retention to necessity. Moving data to another country is a separate question. The lab teaches treating them separately and getting local advice.
Do I need Pro to use the lab?
The lab is free to try with 3 Pro tool runs in total, shared across all Pro tools. Downloading the memos and register is Pro only.
Where do the rules come from?
Each fact pattern lists the rule and statute texts opened to check it, with the date checked. The Sources block on the page shows them all.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.