Retention, holds and redaction

Retention decides when Foxborne deletes evidence, and a legal hold decides what it never deletes. Redaction decides what never travels: positions in exported reports, and secrets in journal lines before they leave the vehicle. An admin sets all three in Settings, and every change is recorded in the audit log.

Before you start#

• You need the Admin role.
• You have your program's retention schedule.
• You can see how the storage under the originals is locked. In AWS, that is the Object Lock setting of the originals bucket.

Retention settings#

Go to Settings and find Retention.

Deletion is scheduled, with a deletion certificate per run that lists each hash. A run deleted under the policy opens as This run does not exist, with the line It may have been deleted under the retention policy.

Change retention#

1. 01

   Open the Retention dialog

   Select Edit on Original files or on Reports and case files. Both open the Retention dialog, which notes Shortening retention does not delete anything on hold.

2. 02

   Choose the periods

   Choose a period for Original files and one for Reports and case files. Events and notes follow the originals.

3. 03

   Save

   Select Save. The console confirms Retention saved. The audit log records Changed retention on Settings, with the originals period as the detail, such as 2 years after import.

Legal holds#

Legal holds reads Held runs are never deleted, whatever the policy, with a count such as 2 runs on hold. A hold outranks every retention setting, and shortening retention never deletes anything on hold.

Match the write-once lock#

Retention in Settings decides when Foxborne deletes an original. The storage under the originals decides whether anything can delete it at all.

In the example deployment, the originals bucket uses S3 Object Lock in compliance mode. The Retention column on Hosting reports Object Lock, compliance mode, 7 years for Original files, with the note Written once. Foxborne cannot modify or delete an original.

In compliance mode, S3 refuses to delete or overwrite a locked object version before its retention date, whoever asks. The lock and the setting live in different places, so keep them in step:

In the example, the lock runs 7 years, so the matching setting is 7 years after import. Check both after every change to either one.

Redaction#

Coordinates on export#

Remove coordinates on export reads Positions are removed from exported reports unless the exporter turns them back on. The switch applies at once. The audit log records each change as Changed redaction on Settings.

With the policy on:

• The Export dialog opens with Remove coordinates ticked: From derived files and the case file. Originals stay byte-identical, so they keep theirs.
• The report's Location line reads Removed on export.
• The report's Before you export checklist shows Coordinates are removed on export. When positions will go out, it warns Coordinates will be included on export instead.
• The export's audit entry ends with coordinates removed.

Patterns removed from logs#

Patterns removed from logs reads Applied on the vehicle before upload. The example lists AWS access keys, Bearer tokens, Passwords in URLs and Internal hostnames matching *.hfr.internal.

1. 01

   Open the patterns

   Select Edit on Patterns removed from logs. The dialog notes One per line. Matches are replaced with [redacted] on the vehicle, before upload.

2. 02

   Edit the list

   Write one pattern per line. Blank lines are dropped.

3. 03

   Save

   Select Save. The console confirms Saved, and the audit log records Changed redaction with the number of patterns, such as 4 patterns.

Matches never leave the vehicle. The collector replaces them before upload, so the original Foxborne stores already reads [redacted] where a match was. A journal exported by hand and brought in through Import files has not passed through the collector.

Process arguments and environment#

Process arguments and environment reads Never collected. The collector's own list of what it never collects adds camera frames.

Expressions in the collector policy#

The collector policy holds the expressions the collector matches in journal lines, under Redact from journal lines. The example policy holds AKIA[0-9A-Z]{16}, which matches AWS access key IDs, and Bearer [A-Za-z0-9._-]+, which matches bearer tokens.

Change them in Set the collector policy. Vehicles pick up a saved policy at their next check-in.

Check the result#

• Retention in Settings shows the new periods, and the audit log has a Changed retention entry.
• The Retention column on Hosting and the Original files setting name the same period.
• The Export dialog opens with Remove coordinates ticked, and the report's Location reads Removed on export.

Troubleshoot#

A run survived a shorter retention. It may be on hold, since shortening retention does not delete anything on hold. Otherwise, the storage lock on its originals has not expired.

An export carried positions. The exporter cleared Remove coordinates, or the policy is off. The export's audit entry ends with coordinates removed only when positions were removed.

A secret appears in a journal line. No pattern matched it, or the journal came in by hand and never passed through the collector. Add a pattern in Settings and an expression in the collector policy to cover later uploads. Lines already uploaded stay as they arrived, because originals are write-once.

Next#

• Set the collector policy holds the expressions the collector redacts.
• Export a case file shows coordinate removal at export.
• Encryption and keys covers the key that encrypts every store.