Problem description
inSync Admin placed a user on legal hold and downloaded the data for that user using the eDiscovery download client.
The total size of the downloaded data turns out to be extremely larger than the actual usage of the device.
For example, check the following screenshot:
In the above example, the user’s device usage in inSync is only around 220.57 MB whereas the total data collected by the legal hold policy, is around 1.80 GB
Cause
When previously backed up files are modified by the end-user on their devices -> in the incremental backup run, inSync only backs up the changed data.
It then creates a new version of that file for the new snapshot.
Thus, you have 2 different file versions across two different snapshots for a file that has been modified.
However, on the storage, only the changed data is stored.
Legal hold collects all the data across all the snapshots. This means, all the versions of each file are collected and are ready for download.
For example:
if you have a file of 1 MB backed up in the first run -> you modify the file and its size increases to 2 MB -> on the inSync storage, inSync will backup only the extra 1 MB that got added to the file.
Then inSync creates a database entry for the new file version, which contains the changed data.
Now, you will have 2 different versions of the file - 1 MB and 2 MB.
With Legal Hold, both the versions will be collected individually -> leading to the total collected data being 3 MB in size.
Resolution / Workaround
This is not a defect, but an expected behavior out of the Legal Hold Policy. It is designed such that all the files, including the original and changed ones, are available for legal use.
If you do not wish to download all the versions, then you can restrict the type of collected data from the Legal Hold Policy -> click on the policy -> click on “Data Collection & Access” -> under Data Access Settings, click on Edit -> Select either the Last Collected Data or with specific time range:
This will help you to control the amount of data that is downloaded in a more precise manner.