If the subpoenas can get issued before any pre-configured expiry deletes the evidence…
So good luck. I worked at a place with a 6mo expiration policy across the board. Perfectly legal way to avoid getting your emails in the news.
NAL, but typically a litigant would send a "preservation" or "spoilation" letter apprising them of forthcoming litigation and demanding they preserve related evidence. I would not be surprised if Crowdstrike has already received some from this incident.