Doing e-Discovery / Message Retention / Legal Recovery in

The topic has come up many times recently on how organizations can leverage Microsoft Exchange 2010 (on-premise) or Microsoft Office 365 (in the cloud) to retain messages, legally hold and recover messages, and successfully perform eDiscovery tasks as required by legal counsel, by law, and/or as needed.

This document clarifies what’s included “in the box” in Exchange 2010 and Office 365, and goes through the step by step procedures for setting up what is necessary to retain content and detailed procedures on how to query and look up information.

Basic Background
To be able to retrieve information for legal or official purposes, information must be properly retained so that the integrity of the information retrieved is valid. As an example, if the Human Resources department, Legal department, or outside Legal Counsel wants to gather information, it’s not good enough to just go into a user’s mailbox and extract information because the information in a mailbox is considered “fragile.” It is fragile because a user can easily “delete” a key message or the user can even go in using the Microsoft Outlook client and EDIT a message. If someone opens a user’s mailbox, the messages in the Outlook client can be tampered with and are NOT considered valid evidence.

In the past with Exchange 2007, Exchange 2003, or earlier, it required specific technologies and practices to protect the messages from tampering. The old way of doing things was to buy a 3rd party archiving product like Symantec Enterprise Vault, Iron Mountain / Mimosa NearPoint for Exchange, EMC EmailXtender, Zantaz EAS, or the like. The 3rd party tools required a separate server, typically a special agent to be installed on all Exchange servers and clients, and a relatively high expense to manage, maintain, and support the archiving server and services.

With Exchange 2007, Microsoft included email “Journaling” that allowed a copy of any/all emails to be forwarded to a Journaling Server so that while a user’s mailbox content might have been tampered with, the Journaling Server mailbox would have a un-modified version of the content. Legal review of the Journal copy provided assurances that the copy has not been edited.

To Continue Reading: Click Here
----------------------------------------------
Source: networkworld.com
By: Rand Morimoto