Event based retention of read only files

A computing device, comprising:

• a memory containing machine readable medium comprising instructions for performing a method;
• and
• a processor coupled to the memory, the processor configured to execute the instructions to cause the processor to:
• evaluate a data structure to identify a first attribute indicative of a first event that will trigger a start of the data structure being retained in a write once read many (WORM) state for a retention period and a second attribute indicative of a second event that will trigger modification of the retention period before a retention end date, wherein a data source is monitored through an automated monitoring process to determine whether monitored data matches the first attribute indicating that the first event occurred;
• transition the data structure to the WORM state to create an event-retained data structure comprising a data field within which the retention end date is to be subsequently stored upon the first event occurring, wherein no retention end date is stored within the data field until the first event occurs;
• trigger the retention of the event-retained data structure for the retention period based upon the monitored data matching the first attribute at a point in time based upon the first event occurring, wherein the event-retained data structure is to be retained in the WORM state that cannot be deleted until the retention end date calculated based upon the point in time as the starting date and the retention period, wherein the occurrence of the first event triggers an override of the data field to comprise the retention end date;
• and
• modify the retention period to extend the retention period to a later point in time for the event-retained data structure based upon the second event occurring before the retention end date, wherein data sources are monitored through the automated monitoring process to determine whether monitored data matches the second attribute indicating that the second event occurred.

A non-transitory computer-readable storage medium having stored thereon instructions for performing a method, which when executed by a machine, causes the machine to:

• evaluate a data structure to identify a first attribute indicative of a first event that will trigger a start of the data structure being retained in a write once read many (WORM) state for a retention period and a second attribute indicative of a second event that will trigger modification of the retention period before a retention end date, wherein a data source is monitored through an automated monitoring process to determine whether monitored data matches the first attribute indicating that the first event occurred;
• transition the data structure to the WORM state to create an event-retained data structure comprising a data field within which the retention end date is to be subsequently stored upon the first event occurring, wherein no retention end date is stored within the data field until the first event occurs;
• trigger the retention of the event-retained data structure for the retention period based upon the monitored data matching the first attribute at a point in time based upon the first event occurring, wherein the event-retained data structure is to be retained in the WORM state that cannot be deleted until the retention end date calculated based upon the point in time as the starting date and the retention period, wherein the occurrence of the first event triggers an override of the data field to comprise the retention end date;
• and
• modify the retention period to extend the retention period to a later point in time for the event-retained data structure based upon the second event occurring before the retention end date, wherein data sources are monitored through the automated monitoring process to determine whether monitored data matches the second attribute indicating that the second event occurred.