10 key considerations for email archiving

Ezine

This article can also be found in the Premium Editorial Download "Storage magazine: The top email archiving strategies for storage managers."

Download it now to read this article plus other related content.

  1. How complete is the archive?
    Not all email archiving solutions capture every email, but that might not be desired. In some environments, only messages sent or received from the outside world need to be retained, so an email archive that uses a gateway approach would be acceptable. But many organizations require a more complete set of email messages, so the archive must interact with the mail server to ensure that all messages, both internal and external, are retained.

    Even if an email archiving application captures inside and outside messages, some messages may still fall through the cracks. Archives that "sweep" through the mail system on a scheduled basis can miss messages that are sent, received and deleted between sweeps. Since every message has both a sender and a recipient, both of them would have to delete the message (and potentially empty their trash folder) to hide a message in this way, which is often called a "double delete" scenario. Organizations that are focused on compliance must ensure that their email archive captures every message.



  2. Does it record what people do?
    One step beyond a complete set of messages is an archive that maintains a record of user actions. Some systems are capable of recording whether a user opened, forwarded, flagged or filed an email message, a feature that has proven popular in product

    Requires Free Membership to View

    Login

  1. demonstrations.

    However, "just because a message is marked as 'read' doesn't mean that a user really read it," says Matthew Ushijima, director of IT network operations at Empire Today in Chicago. "Outlook's preview pane can interfere in both positive and negative ways, making this [product feature] not the most reliable data source," he adds.

    Capturing the actions users take regarding their email messages is a difficult technical problem. Traditional archiving products, which commonly use Exchange journaling, must sweep through the mail system using MAPI to periodically examine each message to capture this so-called user-action meta data. MAPI sweeps consume valuable CPU and IO resources, so additional mail servers must be added to handle the load. An alternative approach to archiving, called log shipping, doesn't require these intensive sweeps, but is much less common. Consider whether this kind of user-action information is critical to your archiving needs.



  2. Can the archive ingest an existing mail store or PST files?
    Many organizations would like their email archive to include messages that existed before the archiving application was installed. These messages typically come from the mail system itself, which might include a decade or more of old mail, as well as from offline or user-created archives, like the PST files created by Microsoft's Outlook mail client. Many archiving programs are able to pull in these old messages, but some can't (see "PST indigestion," below).
PST indigestion
Eliminating "Underground Archives" like Microsoft Outlook PST files is a primary goal of many email archiving projects, but one that often proves difficult to attain. It's a simple matter to turn off PST archive support in Outlook, but this must be put off until existing archives are located and ingested. Remind users that the new archive will actually make their mail more available to them; with the company archive they may now be able to access their old messages from Outlook Web Access (OWA) and BlackBerry devices.

But beware when importing old archives that have been out of your control. At the very least, they're incomplete, as users almost certainly selectively saved email, deleting some, keeping others in their inbox and archiving a few. It's also possible for a malicious user to have changed the content of one of these personal offline archives, creating new messages, or deleting or modifying old ones. Therefore, you must consider how reliable this source is from a legal or compliance perspective.

If you're applying a deletion policy to email, consider suspending it, at least temporarily, when it comes to PST imports. If you import old archived mail and then immediately delete it, you'll lose credibility in the eyes of the very users you're trying to help, and possibly raise compliance and legal issues. Give your users enough time to categorize and thus preserve their imported messages, and then educate them about the importance of retention and destruction.

This was first published in June 2008

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.
    Back to top