|
With each passing day we hear of more and more examples
where an email has been a critical part of an evidence trail. Have you stopped
to think about what the implications would be for your organisation should you
be required to produce email as evidence.
Your first reaction will
probably be "It's in the backup". You may be in for a shock!
In
most organisations the primary role of the email backup is to enable an
operational recovery in the event of a system failure. The critical word here is
"operational". The IT department will be protecting the operational
integrity of the email infrastructure. They will be taking regular backups so
that if necessary they can recover an operational system to a specific point in
time. Recovery of an email trail across a period of time is a completely
different problem.
Let us consider two scenarios
- Does The Email Exist In Your System? A person in your organisation
sends a defamatory email to a competitor and then immediately deletes the copy
of the email from the sent box and the deleted items folder. One month later you
receive a notice of libel from your competitor citing this email as evidence.
You need to see what was actually sent.
- Can You Find The Emails? Your purchasing department has been
negotiating a vital contract and to speed things up a lot of the negotiation
takes place via email. The negotiation is concluded over a period of one month.
Two years later the contract is in dispute and a court of law asks for all
evidence supporting your claims about the contract. Email is a critical part of
your case and you need to find all relevant email.
In each of the above scenarios you expect the backup to be your
lifeline. However there is a problem …
- Does The Email Exist In Your System? The answer is "probably
not". The person concerned wished to cover their tracks. They took steps to
delete the email record and as it no longer existed in the email system at the
time of the next backup, it was not backed up. To find that email will be very
difficult. It may exist in a deleted items cache (on a backup) but given
the elapsed time this will in all likelihood have been purged.
- Can You Find The Emails? The answer is "it depends". Your
IT department may well have a policy that says they recycle the backup media.
They may well keep the last three months' weekly backups, and the last years'
quarterly backups. Beyond that the backup media is recycled (i.e. overwritten)
to save space and reduce cost. Maybe you are fortunate and the IT policy is to
keep all tapes, now the problem turns into something akin to finding multiple
needles in multiple haystacks (and you have to rebuild each haystack first)!
|
|
Both of the above scenarios demonstrate that operational
backups of email, whilst a critical part of the IT infrastructure, fall short in
the support of business processes.
For the solution to the issues we
should look more closely at how terminology often becomes confused. In IT terms
the words backup and archive are often used interchangeably, often with
significant consequences. For example the UNIX command most closely associated
with backup is tar, it is a shortened form for tape archive. But let's
look at some definitions
Backup: A spare copy of a file, file
system or other resource for use in
the event of failure or loss of the
original.
Archive: A place or collection containing records,
documents, or other materials of historical interest.
In both of the
scenarios shown above, the way out of the problem is to access a collection of
(email) records of historical interest, i.e. an archive. It's time we all more
clearly understood that "backup" and "archive" are not the
same thing. This way we can reduce corporate risk and as a by product decrease
the costs and overheads associated with protecting operational systems.
Think about all those daily, weekly, monthly backups. In truth, how
much of the information remains unchanged between backups. In the case of email
we have historical email (which doesn't change) and new email. The historical
email belongs in an archive where it can be preserved for historical access, the
new email is part of the operational email system and should be preserved by
operational backups. By making this distinction the overheads associated with
operational backup can be drastically reduced, and the ability to support
business processes regarding corporate record is greatly enhanced.
Backup your operational systems, it's vital, but archive your
historical records. Two complementary technologies working together to meet the
overall business and IT need.
...KVS
profile |
|
