White Paper: Archiving for Exchange 2013

7,495 views
7,083 views

Published on

This paper describes the new archiving and discovery features of Exchange 2013 and compares them to the EMC SourceOne email archiving solution.

Published in: Technology
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
7,495
On SlideShare
0
From Embeds
0
Number of Embeds
4
Actions
Shares
0
Downloads
145
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

White Paper: Archiving for Exchange 2013

  1. 1. White Paper ARCHIVING FOR EXCHANGE 2013 A Comparison with EMC SourceOne Email Management Abstract Exchange 2013 is the latest release of Microsoft’s flagship email application and as such promises to deliver new features for archiving and discovery to the exclusion of 3rd-party email archiving solutions. This paper describes the new archiving and discovery features of Exchange 2013 and compares them to the EMC SourceOne email archiving solution. February 2013
  2. 2. Copyright © 2013 EMC Corporation. All Rights Reserved.EMC believes the information in this publication is accurate as of itspublication date. The information is subject to change without notice.The information in this publication is provided “as is.” EMCCorporation makes no representations or warranties of any kind withrespect to the information in this publication, and specificallydisclaims implied warranties of merchantability or fitness for aparticular purpose.Use, copying, and distribution of any EMC software described in thispublication requires an applicable software license.For the most up-to-date listing of EMC product names, see EMCCorporation Trademarks on EMC.com.Part Number H11545 Archiving for Exchange 2013 2
  3. 3. Table of ContentsIntroduction ............................................................................................................ 4Exchange 2013 Archiving ........................................................................................ 4 Exchange 2013 User Impact ............................................................................................... 5SourceOne Archiving ............................................................................................... 5Exchange 2013 Legal Hold....................................................................................... 6Sourceone Legal Hold .............................................................................................. 6Exchange 2013 eDiscovery ...................................................................................... 7 Early Case Assessment ....................................................................................................... 7 Culling and Preserving ........................................................................................................ 7 Tag, Review & Export .......................................................................................................... 7 Authenticity (Chain of Custody) .......................................................................................... 8SourceOne eDiscovery ............................................................................................. 8Exchange 2013 Search ............................................................................................ 8SourceOne Search ................................................................................................... 9Conclusion .............................................................................................................. 9 Archiving for Exchange 2013 3
  4. 4. IntroductionOrganizations today are struggling to manage exponential email data growth and itscorresponding impact on email service performance, user productivity and legaldiscovery. Beginning with Exchange 2010, Microsoft introduced new features to itsflagship email application to address these challenges for archiving and discovery.With the release of Exchange 2013, Microsoft continues to enhance and improve keyfeatures for archiving and discovery making it unclear if the archiving and discoveryfeatures of Exchange 2013 are “good enough” or if EMC SourceOne on-premise emailarchiving solution is the better solution.This paper will describe the archiving and discovery features of Exchange 2013 andmake a comparison with the same offering from EMC SourceOne. Readers will benefitby understanding the capabilities of Exchange 2013 for archiving and discovery sothey can decide where EMC SourceOne is necessary for more robust in-housearchiving and discovery.Exchange 2013 ArchivingWith Exchange 2010, Microsoft enhanced the archiving capabilities of its Exchangeplatform to address rapid mailbox growth as well as the proliferation of PST filessitting on network drives, file systems and local computers. PST are well known forcausing a number of problems, including unmanaged content, increased eDiscoverycosts, inability to apply retention/disposition policies and data loss.To address these issues, Microsoft created the Personal Archive Folder withinExchange 2010. A Personal Archive Folder is essentially a second mailbox for a user,allowing an organization to move old or archived email to a secondary storage tier forcost savings. Within Exchange 2013, Microsoft re-branded the Personal ArchiveFolder as In-Place Archiving; however the functionality is identical to Exchange 2010.In-Place Archiving is a premium feature and requires an Enterprise CAL license toimplement.With Exchange 2010 /2013, Microsoft made a significant change when it removedsingle instance storage in order to improve system performance. This means twothings - all the data that is stored in Exchange Server; even duplicate copies of largeattachments, are stored multiple times, significantly increasing the size of ExchangeServer over previous versions of Exchange. Moreover, with Microsoft Exchange2010/2013s Database Availability Group (DAG) high availability function, you arefurther replicating this duplicative content, unnecessarily consuming storageresources.Exchange storage is an additional concern for Exchange migrations. As you migratefrom previous versions of Exchange to Exchange 2010/2013, you need to account forthe difference in space (and cost) between the same data in an older version ofExchange and Exchange 2010/2013. It is not uncommon for this to represent a 100%or greater increase in storage requirements. This concern extends into the future aswell. Since Exchange 2007, Microsoft has removed the capability of in-placeExchange migration, meaning every future Exchange migration requires a physical Archiving for Exchange 2013 4
  5. 5. data move. With the Personal Archive Folder residing on the Exchange Server and thelack of single instancing, this archiving model is a roadway to longer, costlier andmore disruptive Exchange migrations in the future.Exchange 2013 User ImpactThere is a disparity how Exchange 2010/2013 performs between online and offlinemodes. The Personal Archive (In-place Archiving) is only available when you areonline and connected to Exchange. When you are working offline in Outlook’s cachemode, the Personal Archive is not cached and consequently unavailable to the user.When online, users get search results from both their primary and personal archivemailboxes, yielding significantly more search results than when they are offline,creating inconsistent results and end user confusion. With SourceOne, Offline Cacheprovides a seamless end user experience, regardless of whether the end user is on-line or off-line.IT consumerization and the increasing frequency of BYOD (bring your own device) hasled to significant user populations accessing enterprise email and data from non-Microsoft operating systems, particularly by Apple. Forrester Research reported in2012 that 46% of enterprise organizations (greater than 1,000 employees) hadissued or deployed Apple Macintosh systems within their environment. PersonalArchives are not available for Outlook 2011 for Mac (Entourage) nor are they availablefor mobile smartphone (ActiveSync not supported). This is a significant user impactgiven the popularity of non-Microsoft devices for communication.SourceOne ArchivingSourceOne provides single-instance storage for archived messages and attachments.A message containing a large PowerPoint attachment for example will only be storedonce in the archive storage. All other messages that reference that attachment willhave “pointers” to the single instance of the presentation, not a copy of thepresentation itself. This results in dramatic storage savings relative to each userstoring their own copy of the object. As an example, consider a 5 MB PowerPointpresentation emailed to 12 users. In the Microsoft Exchange case, at least 60 MB ofstorage will be consumed (12 copies of the 5 MB presentation). In contrast, if thecustomer uses SourceOne Email archiving, the total storage would be only 5.1 MB (5MB for the presentation and approximately 100 KB for the 12 8 KB pointers to thepresentation.With respect to user access, SourceOne allows users to access their email, whether itresides on the Exchange server or in the archive from any device that has a Webbrowser. This removes the restriction that all “email access” devices be MicrosoftExchange aware. For users whose primary system is a Microsoft Windows PC, theSourceOne offline access cache allows them to have access to their most recentlyarchived data even when they are not connected to the SourceOne archive server.SourceOne administrators set a policy-based limit on the amount (in GB) of data thatwill be cached on a user’s local hard drive. When a user requests access to anarchived item, the system first checks the offline cache to determine if the itemresides locally. If it does reside locally, the item is retrieved from the cache. If the Archiving for Exchange 2013 5
  6. 6. item does not reside locally, a request is made to the SourceOne archive to providethe item.Exchange 2013 Legal HoldWithin Exchange 2010, litigation hold capabilities were limited to an indefinite holdon a complete mailbox. This process would hold all mail items in a specific mailboxindefinitely, without the ability to place holds based on timeframe or content, andregardless of whether the content was responsive to the associated legal matter. Thisprocess both increases the downstream eDiscovery costs as non-responsive data isincorporated into case data, and it also increases organizational risk by unnecessarilyholding data that may be responsive to future lawsuits, which potentially could bedeleted via a standard retention and disposition policy.Microsoft has added new litigation hold functionality to Exchange 2013 to addressthe need to preserve data with a more granular approach. A significant enhancementwith Exchange 2013 is the ability to enact item-level legal holds based on querylanguage or time, in addition to the indefinite mailbox hold available within Exchange2010. This gives you the ability to enact a much more refined hold request, includingthe ability to specify a legal hold based upon keywords, start and end dates, senderand recipient addresses and message types.Despite this enhancement, there is a significant gap within the Exchange 2013 legalhold process that renders it inappropriate for a majority of enterprise legal holdrequirements. First, you are only able to apply a query-based or time-based legalhold to data that is indexed by Exchange, which is natively limited to 53 file types(compared to the over 400 file types EMC SourceOne is able to index). This limitationrenders query-based or time-based litigation holds unusable for a majority of todaysorganizations, leaving only the basic, indefinite hold function preventing thepossibility of data spoliation.Sourceone Legal HoldSourceOne legal holds perform by having the user search the archive for all items thatmeet specific criteria (additional discussion on search limitations is given below) andthen copying those messages deemed potentially relevant to the legal hold foldermaintained within SourceOne. This legal hold folder contains copies of the potentiallyrelevant messages and this folder and its contents are outside the operationalretention and deletion processes.Data that is placed into the legal hold folder is maintained until all matters with whichthat data object is associated are deleted. This methodology eliminates the need tochange the retention on specific sets of messages within the operational archive andgreatly simplifies the process by which messages are retained for the duration oflegal matters.SourceOne is able to index and search over 400 different types of files. Included inthis set of file types is the ability to index and search the individual items that residewithin container files such as ZIP or TAR. This capability allows SourceOne to find Archiving for Exchange 2013 6
  7. 7. relevant items that are not part of the body or even a single attachment but thoseitems that are contained multiple levels underneath the parent message.Exchange 2013 eDiscoveryExchange 2013 enhances the eDiscovery capabilities over prior Exchange versions,adding basic eDiscovery functionality such as more advanced search terms andproximity searches (i.e. “near”); holding data to an eDiscovery mailbox; and even in-place legal hold, assuming that the enterprise has purchased an Enterprise CAL.Exchange 2013 still lags well behind the requirements for an enterprise that isserious about its eDiscovery process. Preserving and collecting email messages is akey step in the eDiscovery process. Done correctly, this preservation step should betaken when litigation is “reasonably anticipated”, ideally before a lawsuit hasactually commenced. Typically there are three important processes to take againstthis collected data: early case assessment; culling and filtering; and review/tagging(followed by export). Exchange 2013 does not directly support any of these steps.Early Case AssessmentExchange 2013 is very limited in its early case assessment capabilities. While thereis some ability to preview messages, this works only for the results generated after asearch is run. There is no capability to run a search and then further filter thoseresults based upon custodian, date range, attachment, etc. Message threading alsoappears to be missing, which is critical to the ECA process. And of course there is noability to see the email messages in context against other content such as email fromother sources (e.g. PST files), documents collected from file shares, etc. outside ofSharePoint and Lync.Culling and PreservingExchange 2013 also has a very limited ability to cull data. As discussed above, thereis no simple method to further refine a result set after a search has been completed.But this is often a necessary function. In most discovery matters, after a collection iscomplete, further work is necessary against the initial collection set to refine andminimize its volume. For example, an initial collection may have been for 15custodians within a one year period. Later in the case, a motion or further discoverymay result in winnowing that set down to 5 custodians within a two month period.Exchange 2013 does not have a method to directly permit that culling activity againstthe initial set.Tag, Review & ExportThere is no support for tagging messages – i.e. “relevant”, “privileged”,“confidential”, etc. In many cases, messages may be bulk-tagged (i.e. all messagesbefore 1/1/2008 are now irrelevant and can be tagged in one step) or individuallyreviewed for tagging. Exchange 2013 does not have support for these tags, nor canmessages be distributed among reviewers for this work. Archiving for Exchange 2013 7
  8. 8. Authenticity (Chain of Custody)It is not clear exactly how Exchange 2013 will support “chain of custody”requirements. Insuring that a message does not “change” is important, but it’s oftencritically important to be able to trace the message back to its original location toinsure its authenticity at trial. Exchange 2013 only supports export to a PST file, andwhile this can apparently be generated with a manifest, there’s no automated processto keep these together. Assuming that further work is required on the PST file, asnoted above, the messages will no longer “show” their original location but will all bemixed together as being from a common PST repository. While this may not be anissue for all cases – in the cases where it does matter, it will be a critical (missing)component of the eDiscovery process.SourceOne eDiscoverySourceOne Discovery Manager is the application that performs all the functions ofsearch and legal discovery for SourceOne. Discovery Manager is a Windows desktopapplication that can be used by General Counsel, legal staff and Email Administrators.The core capabilities of Discovery Manager are the search of the entire SourceOnearchive, as discussed below. In addition to search, Discovery Manager provides a legalworkflow, whereby users can delegate search roles, identify and assign custodians tosearch, define search tags, save search, cull searches and export search results in avariety of industry standard formats. Important, search results are stored in separatelegal hold folders to ensure data authenticity and chain of custody.Many organizations experienced with in-house legal discovery have benefited greatlyusing SourceOne Discovery Manager. Having fast access to all archive content allowsorganizations to make early assessments regarding a potential law suit, saving the costof outside legal counsel and potentially avoiding expensive litigation.Exchange 2013 SearchFor Exchange 2013 search, Microsoft introduced the ability to search the In-PlaceArchive. In Exchange 2010, the Personal Archive was not included with a mailboxsearch, which is a major short coming. Now when a mailbox search is performed inExchange 2013, the mailbox search includes the primary mailbox and the In-placeArchive mailbox. But as we previously discussed, a major limitation for Exchange2013 search remains because Exchange only natively indexes 53 file types. UsingExchange 2010/2013 search you can’t prove or be assured that all email content wasproperly searched. Conversely, SourceOne has the ability to index 400 file types andensures that all email content is accessible for search.Moreover, there are a number of gaps within Exchange 2013 that are just now beingidentified as the product has its final release. For example, the inability to performeDiscovery searches on the Journal mailbox (it only covers the personal archive andprimary mailboxes) and the inability to search the bcc field are considerablelimitations from an eDiscovery search perspective. Archiving for Exchange 2013 8
  9. 9. SourceOne SearchSourceOne search has access to search the entire SourceOne archive and to meet therequirements of the eDiscovery process. For search, SourceOne has none of thelimitations of Exchange, most notably the 53 file type limitation, and it searches alldata in the archive, whether placed there by journaling or by a historical archive taskagainst the user’s mailbox. Furthermore, complex searches such as proximity,wildcard, and Boolean combinations of full-text and metadata are supported. Finally,all address fields and the members of distribution lists are searchable.ConclusionFor readers who are familiar with Microsoft Exchange, you are accustomed to themanner which Microsoft introduces new features. The process is one of multipleiterations that span years. The new Exchange capabilities for archiving and discoveryare no exception. With the introduction the Personal Archive in Exchange 2010,Microsoft for the first time took aim at the email archiving market, a market that theylargely ignored in all previous releases. With Exchange 2013, Microsoft introducedfurther improvements for archiving and discovery, but as we learned in this paper,many important gaps still remain.The decision whether to use Exchange 2013 for archiving and discovery versusadding a 3rd-party email archiving solution such as EMC SourceOne depends on theindividual needs of each organization. Organizations with a heavy legal workrequirement will likely find the limitations of Exchange 2013, such as 53 file typeindex, no tagging, no culling, etc. to be “show stoppers”. While other organizationsmay decide that the total storage requirements for primary mailboxes plus archivingmailboxes, when you take into account the lack of single instance storage and theDAG replication cost, are too great to preclude keeping old, archived email inExchange.EMC SourceOne is a next generation, in-house email archiving solution that supportscontent from Microsoft Exchange, Microsoft SharePoint and network file shares.SourceOne is a fully integrated solution, whereby all content, no matter of its source,is deduped, indexed and stored in tamperproof archive containers. SourceOnesupports all the leading EMC storage solutions including EMC Centera for compliancestorage, EMC Data Domain for consolidated backup and archive storage and EMCAtmos for cloud storage.For more information about EMC SourceOne, contact your local EMC Salesrepresentation who can provide you with additional information and can show youhow SourceOne can benefit your organization for archiving and discovery. Archiving for Exchange 2013 9

×