Custodial Email Preservation – Email Infestation

Migrated from eDJGroupInc.com. Author: Greg Buckles. Published: 2011-03-29 11:31:17  Email is everywhere. We are seeing a lot of corporate clients making the transition from preservation notices to actual preservation/collection systems. Whether using an email archive, collection appliance or search software with connectors into Exchange, the IT administrators tend to interpret Legal’s custodial preservation request very literally. They still see email in the Mailbox model. When assessing the existing preservation process (if any), I almost always find gaps and unmanaged sources that slipped through the net. Public companies that have been around for more that 3-5 years have gone through M&A activities, RIFs, bankruptcies and other corporate wide reorganizations that leave ESI skeletons in the corporate closet. I have blogged recently about the tendency to create corporate digital landfills, but the recent string of preservation sanction cases has reaffirmed the need to know where your email hides.

When an Exchange or Domino administrator receives a preservation notice containing a list of custodians, they typically export copies of those specific mailboxes and might change their tape rotations to preserve back-ups. If they have an email archive, they may turn off the expiry for those user archives or use specific legal hold functionality to lock them down. If the company archives all email via message journaling, then the admin may have to execute a hold search to find all the custodian email within the big bucket and export or lock it in place. This covers the active communication and management systems that IT is responsible for. This leaves custodians responsible for online and offline PST, OST, NSF or individual MSG files that have been scattered over home drives, laptops, departmental shares and external media. It also ignores any departmental use of public folders, Sharepoint or other impromptu record storage areas. Unique or duplicate copies of custodial email will reside in non-custodial sources as well. This may require global preservation searches across all mailboxes or archives to locate all email within the hold scope. Given employee’s tendencies to hoard and migrate old email, I regularly find email that predates journal and mailbox archives in these ‘custodial closets’ that is missed by preservation/collection efforts.Although courts have recently found corporations liable for custodians destroying potential evidence, I believe that a defined, documented process can meet the reasonable effort required for most civil litigation. A smart and talented bad actor can almost always find a way around rules and systems, but deliberate violation of corporate preservation protocols should transfer the ire of the court and provide some protection for the company. Locating and addressing the myriad locations, formats and copies of email that have managed to infest your infrastructure is a lot like dealing with a pest infestation. The more that you inventory, organize and clean up your electronic house, the easier the pest removal and prevention efforts become. Don’t expect a one-time PST migration to get everything. You will have to document regular reminders and sweeps to catch your email addicts and gently wean them off of their personal security blankets. You can find and manage all these sources/versions to reduce your risk and cost. I would love to hear about the oldest email that you ever found in a hoarder’s stash or the strangest location/format.