This blog post is dedicated to my fellow IT admins who are tasked with the daunting task of searching and exporting emails for Discovery requests on a regular basis. As a former Exchange Admin, I can relate to the lack of information from management and the sometimes astronomical demands for email messages from certain people, during a certain timeframe, with these keywords, oh and by the way, don’t look at the messages. Sound familiar?
How do you know you have all the data you need?
For companies who are tasked with email Discovery requests on a regular basis, they should consider an email archiving solution for a number of reasons. Email data is stored in many different locations from an on premise or cloud based Exchange server including public folders, shared mailboxes or archive mailboxes found in Exchange 2010. Other locations include, offline personal folders such as PST file, and for some customers in the corporate email archiving solution. This makes searching and exporting emails for discovery pretty much a time consuming nightmare of impossibilities but management will still make you try. With a properly configured email archiving solution that allows you to ingest PST files, the majority of your email data can be stored in one easily accessible location leaving you in a better situation for email Discovery. All your emails can be accounted for and if necessary you can implement a legal hold to make sure they don’t magically disappear. Now you have a central location to look for all emails making the discovery quest manageable. Once you completed the first step towards good Discovery practices by managing your email data, you can then focus on the impossible details you are expected to return. No problem because with every super email archive there needs to be a super discovery sidekick.
How do you export the data you need and satisfy all the demands?
In most email archiving products there is a search and export feature that can be used for discovery requests, but as we know these requests are unpredictable and no two requests are the same. For this reason it is good to have a solution that will allow you to adjust to these ever changing requests. Some features may include the ability to do multi-threaded searches or prevent the searcher from seeing the results. Sometimes there is a need to restore Exchange databases from backup to retrieve older data for a particular case or internal investigation. Or maybe there is relevant email data locked up in one large or multiple Exchange mailboxes or public folders that you need to get to. Once you find what you are looking for, you need the ability to export to different formats including PST, EML or MSG. Then there is search flexibility that may include searching for Message ID or keywords within attachments, message body, or header information. Finally for companies that still have data stored in multiple locations including their email archive, the ability to search and export from multiple email sources simultaneously is probably a must have.
Even though it is best practice to be prepared for litigation and most eDiscovery solutions require you have the solution prior to the inquiry, many companies find it difficult to budget such a great amount of money for something that hasn’t occurred yet or that is infrequent to them. We understand and this is where Quest can help. For more information check out: https://www.quest.com/products/recovery-manager-for-exchange/