Question 1

Do we have to preserve every backup we hold, forever?

Accepted Answer

No: the duty is bounded by relevance and reasonableness: suspend recycling for the systems and periods the issues touch, hold the generations that bracket the key dates, and document the bounds you chose and why. An unbounded freeze is neither required nor wise; a reasoned, notified, recorded suspension is the standard the court will actually test you against.

Question 2

Are backups "disclosable documents"?

Accepted Answer

The material on them is: backup copies of documents within your control are within your control, and the DRD expects them described. Whether they must be searched is the separate proportionality question this guide frames: and describing them accurately while declining to search, with reasons, is a legitimate and commonly correct position. Silence about them is neither.

Question 3

Our key custodian's mailbox was deleted before the dispute. Is that spoliation?

Accepted Answer

Routine deletion before any preservation duty arose is not spoliation: leaver processes are lawful housekeeping. The consequences are practical: the backup and archive layers become the custodian's only remains, the catalogue question becomes urgent (retention there is also finite), and if generations exist, the only-remaining- source test points firmly at restoration. Deletion after the duty arose is a different conversation, and Example 2 shows where it goes.

Question 4

How much does targeted restoration actually cost now?

Accepted Answer

On modern platforms: typically laboratory days, not months: a mailbox or file-set from catalogued disk-based sets is hours-to-days including processing; a handful of generations for evolution questions, low single-digit days. Managed tape multiplies handling but stays estimable. The open-ended numbers belong to legacy and orphaned media, where honest assessment (sample reads, environment reconstruction scoping) is the product. Any figure offered without naming the platform tier is a guess wearing a suit.

Question 5

Can we get access to the other side's backups directly?

Accepted Answer

Orders for restoration and disclosure of the results are the norm; direct access to an opponent's backup environment is rare and reserved for guide-32-style d is trust scenarios, usually via an independent examiner under protocol rather than party access. The productive route is almost always: catalogue disclosure, targeted restoration by them (or an agreed neutral), and the output into ordinary disclosure: sought with the engineering specificity that Example 3's reframed request modelled.

Question 6

Cloud services back everything up anyway, don't they?

Accepted Answer

Partially and differently: SaaS platforms run retention, recycle and version layers (excellent short-to-medium reach, per the cloud guides ahead) and providers keep their own resilience copies you generally cannot reach; many tenants add third-party backup products that behave like this guide's modern tier. The practical rule transfers intact: map the layers, read the retention windows, suspend what your side controls, and ask the catalogue question of what ever backup product the tenant runs: "it's in the cloud" is the beginning of the analysis, not its answer. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

Should Backup Systems Be Searched For Disclosure