Deleting and restoring evidence

Delete Evidence

You can delete evidence files that are listed in evidence search results. Evidence that you delete is added to a deletion queue for 7 days. This helps prevent deleting evidence unintentionally.

1. Search for the evidence that you want to delete.
2. For each evidence file that you want to delete, select the check box to the left of the evidence.
3. Above the search results, click Delete.

   A confirmation dialog box appears.

4. Click OK.

   A comment dialog box appears.

5. If you want to make a comment about the deletion, type it in the box provided.
6. Click OK.
7. On the notification message box, click OK.

   In the search results, the status of the evidence changes to “Queued for Deletion”.

Restore Evidence

From evidence search results, you can restore evidence that has a status of Queued for Deletion. Restoring evidence removes it from the deletion queue.

Note: When evidence that is queued for deletion is restored, if the evidence is assigned a category that has a retention period, then the evidence's new deletion date is set 30 days from the current date, regardless of the categories retention period. If the evidence is uncategorized or the assigned category does not have a retention period, then no deletion date is set for the evidence.

1. Search for the evidence that you want to restore. Ensure that, in the Status list, you click Queued for Deletion.
2. For each evidence file that you want to restore, select the check box to the left of the evidence.
3. Above the search result, click Restore.
4. On the confirmation message box, click OK.
5. On the notification message box, click OK.

   In the search results, the status of the evidence does not change.

6. If you want to confirm that the evidence status has changed to Active, search for the evidence again.