Legal hold is a snapshot that doesn't expire

Counsel sends the email at 4:50 PM: preserve everything related to the Henderson account, effective now, until further notice.

The Henderson data lives in two containers. You snapshot both with expiry: 3650. The snapshots capture the whole disk at 4:52: every file, every database row, every log line, not a curated export. Then POST /api/v1/containers/{id}/copy with source_snapshot onto a server in another rack, because a snapshot lives on the server that made it. Set the copy's permissions to default: deny with one group for legal.

The copies sit idle for two years and cost nothing beyond the box they share. When discovery comes, legal opens a files URL and greps the disk as it was at 4:52 on the day of the email.

The old hold was a shared drive, a folder named HOLD, and a prayer that it was complete.

The hold is a frozen disk, and the disk has an address.