Loading ...One of the things we do as analysts is take inquiries from readers, typically either in a half hour call or via an email response. Recently, a good inquiry came in, but there was no contact information to send an answer to, so I thought it would be a good idea to answer it here (with the hope that the answer gets to the person that had the question). The question read, “If we have a corporate email solution that strips attachments from emails and replaces them with download links, what are our e-discovery responsibilities? Do we need to be able to produce the attachment, or just the email with the links?”
This question gets to the heart of email archiving and it’s role in eDiscovery. The goal of archiving is multifold: get email off the production mail server to minimize backup windows and reduce storage costs and create a repository of record for long-term preservation (a single source to search, so to speak, for legal). Archiving solutions provide access to email for end-users in a variety of ways. They might strip attachments and leave behind links to them, or leave behind stubs to them.
When it comes to eDiscovery and a company’s obligation, the attachment is a critical part of the message and needs to be produced with the message. I suppose a company could have a policy whereby it disposes of attachments after a certain amount of time and keeps the message longer, but that wouldn’t make a whole lot of logical sense. The beauty of an email archiving solution is that it keeps the attachments in relation to the message, so when searching for keywords, a message will come back even if the keyword is only found in the attachment (a good archiving solution will, anyhow).
To answer the question, “yes, you do need to produce the attachment, not just the email with the links.” Based on the solution outlined, it should not be difficult to do that; it sounds like the solution mentioned would be able to export out both messages and attachments. It’s a good example of the types of things you want to be sure your archiving solution can do before you buy it. Can it produce attachments? Can it search messages and attachments together? Can it single-instance store attachments while still relating the attachment back to all the emails it is associated with?
(Note: At eDJ, we are not lawyers and do not purport to give any legal advice. Rather, this answer is an opinion based on our experience. It’s important that anyone with a question like this run the options past their legal team for final approval.)
We love taking inquiries, so if you have any, submit them here and we’ll get back to you.
Rather than misusing the term “archiving” wouldn’t it be better to use the term “storage”? Archiving implies that the email has long-term, permanent historical value to an organization. “Email archiving” is nothing more than storage. The majority of emails sent and received do not have long-term historical value to an organization.
I would suggest that looking at http://www.arma.org for more information about records management
February 23, 2011 at 8:59 am
pakurilecz
no profile information available
Thanks for the comment. With the advances in archiving, I don’t necessarily think that archiving is just for the long-term storage of email for preservation. Archives are much more than just long-term storage. They can provide for user access and other types of search/access. When I think of the term storage, I immediately think of the underlying media, which may or may not be built for easy access to the information. One of the challenges in this industry is that terms have different meanings to different folks, so your point is well-taken. Thanks!
February 23, 2011 at 11:30 am
Barry Murphy
Member Type: Other | Role: Consultant | Size: Solo | Years of Experience: 15 | Certifications/Licenses: N/A
Barry, I don’t care about the usage of archiving or storage in your article since I know what you mean from the context of the article. I am concerned that one of your readers would think they could get away with producing the email without producing the attachment. I concur with your assessment that a good archiving solution for email should retain and be able to produce the attachment and do it in the most effective way possible from a storage solution (single master, etc.) However, most archiving solutions do not store the context of the email once it passes through the server. For example you and I each receive the same email from pakurilecz. You open it and read it and leave it in your Inbox and later delete it. Most archiving solutions are going to note when you received it and some will note when you opened the email and/or when it was deleted. However, I received the email and I moved it into a folder called “Illegal drug trafficking plans that Barry Murphy and I have put together” and never open it. Nearly all email archiving software will report when I received the email and that I never opened it. Surely the fact that I put it into a folder with such a name could be relevant in a legal matter. The context of what I did with an email typically is only found in the local storage for that email, most often the PST file. Hence, depending upon the matter, simply producing from an email archive that is server based may not be enough to give the complete picture, even with the attachments.
February 23, 2011 at 12:36 pm
K-ManS
Member Type: Corporate | Role: Attorney | Size: Solo | Years of Experience: 20 | Certifications/Licenses: JD, MCSE, OS/2, CNA, PCA DE, Others
Good points…there are way to capture context in the archive, e.g. Iron Mountain’s NearPoint using a backup copy to archive off. However, that can drive up the size of the archive significantly, which affects the ability to get the storage benefit. If using the archive as a system of record, it’s not a bad way to go. And, I think you will see all vendors come up with a story that marries archiving and backup (either archiving off a backup copy or being able to discovery across both, which could solve that context problem).
February 25, 2011 at 1:02 pm
Barry Murphy
Member Type: Other | Role: Consultant | Size: Solo | Years of Experience: 15 | Certifications/Licenses: N/A
Is it acceptable to withheld part of attachment from an email. I.e. Lets consider an email with 2 attachment so the total number of documents are 3.
i.e.
1) Email (Only the message)
2) Attachment A
3) Attachment B
Out of these three documents Attachment A is privileged, i dont want that to be produced, in this case can i withheld Attachment A and produce only Email + Attachment B.
Your reply is highly anticipated and appreciated.
Thanks
Gsha
July 11, 2011 at 5:30 pm
gsha
no profile information available
This question has been debated in the public forums for many years and always seems to come down to a call by counsel on the specifics of the request and the matter. I have always held the layman’s opinion that the content cannot be separated from the context of the transmittal. That means you cannot pretend that the email was not sent as a whole communication and strip out parts just because you do not want to acknowledge them. The usual compromise is to convert the entire email/attachments to tiff and redact out the privileged portions. Fundamentally, there is an argument that transmission of privileged documents outside of the attorney-client relationship waives privileged. However, I am the last person to tread on the turf only counsel should tread. ASK THE ATTORNEYS. They have to defend/support the decision. We are here to make their decisions reality, not to make legal decisions for them based on what we want the technology to do.
July 13, 2011 at 3:18 am
Greg Buckles
Member Type: Other | Role: Consultant | Size: Solo | Years of Experience: 22 | Certifications/Licenses: court certified expert witness