Sherpa Software

As email administrators, one of our information management challenges is to monitor the activity on the Exchange server and implement policies to control email data storage. Unfortunately that is just a portion of the ESI data that might be relevant to your company. A recent study conducted by a litigation support firm determined that only 57% of U.S. and 39% of UK corporations have mechanisms to preserve potentially relevant data when litigation or a regulatory investigation is anticipated. Since preserving email server data is comparatively easy – we suspect that a large percentage of the data that is not preserved resides in PST files. 

We talk to dozens of email administrators and almost universally they tell us that their Outlook users have not idea that they are creating PST file data when they see this helpful window pop up on their desktop:

Even though the box clearly identifies the location of the PST file – desktop users oftern push the Yes without reading the text – or worse yet,  they check the ‘Don’t prompt me’ option causing the archive PST to be automatically updated in the future.

If your organization needs to preserve ESI for ediscovery compliance purposes, Sherpa has two PST tools to help you manage the data on user desktops that you may not know about:

• PST Backup Attender is a decentralized product that you can distribute to each desktop using a group policy. Once it installs, the desktop agent will automatically scan the local fixed drives for PST data then enforce a backup (or retention) policy that was installed along with the agent. Backups can be directed at any UNC path in your network (on a scheduled basis) so you begin to build a centralized repository of the PST messages that may be used for disaster recovery or e-discovery purposes.

• Mail Attender also offers a desktop agent component. Once deployed and installed on a workstation the agent scans for PST files then ‘phones home’ to the Mail Attender server it is registered with and reports what it has discovered. Within minutes the desktop PST files show up as email stores in the Mail Attender console and administrators may begin creating rules to move, copy, delete or compress PST data resident on the desktop.

Just because you don't know about PST message data does not mean you cannot manage it! To learn more about either of these Sherpa products, register for a 1/2 hour demo today!

Sherpa Software's professional services arm is picking up some steam. Although all of Sherpa's email management products for Lotus Notes and Microsoft Exchange have been built to be simple to deploy and use with minimal support, there have been occasional requests from customers over the years, for assistance in configuring our products to meet their specific needs or in some cases even help in formulating their requirements. Several instances of this last request has prompted one of our blog authors, Denny Russell, to write a 7-part series on developing email retention policies.

1. Space issues
2. Legal/litigation concerns
3. Federal regulations

1. IT 
2. Legal/HR

• http://www.soxlaw.com/
• http://www.hhs.gov/ocr/privacy/index.html
• http://www.law.cornell.edu/rules/frcp/
• http://www.aiim.com
• compliance laws/rulings

1. Who and what are driving your policy?
2. What data do you need to keep?
3. Data storge and access
4. What to look for in a solution
5. Remember the End-users - How does it affect them?
6. E-discovery and litigation - Are you ready?
7. Key points to remember

Missing emails from an account used by James Oblinger, North Carolina State University's former Chancellor, have landed the university in hot water including a federal grand jury investigation to find whether former North Carolina Gov. Mike Easley used his position to influence the hiring of his wife to a $170,000 a year job at N.C. State.

In response to a subpoena, lawyers for the university have admitted they could not locate six months of Oblinger's email, from January to June 11, 2005. In actuality, the university's IT department has failed to produce these email messages. As a result, the judge could issue a default adverse judgment. In other words, those deciding the case could be instructed to assume the worst; that relevant email messages were destroyed deliberately, whether it was the case or not. Clearly, not a good situation for either the IT department or the university ^[1].

Hearing stories like this should make IT departments think "How would my IT department have faired if this happened at our organization?" The lesson is this: get a records retention policy in place and follow it up with implementing mail archiving software to support the policy.

Naturally, a follow up question would be, "isn't archiving email messages enough?"

However, it depends on what archiving means to you. If archiving means periodically harvesting messages from the users' mail files and storing those for later searches, then no, is not enough. This approach to an email archiving system is too sensitive to user activity. Senders may not save their messages or the recipients may delete or even alter them. As a result, an archive produced in this way will be either incomplete, inaccurate or both. Organizations need a better approach to compliance and email management.

The best solution would be to capture messages in real time, as they are in transit at the Domino server, and before they arrive at the recipients' in-boxes. Through intercepting messages, IT and management can be certain the message is preserved in its original form. Further, the repository of these messages, a.k.a. the journal, could be locked down so that its contents remain unaltered while awaiting ediscovery compliance requests.

Compliance Attender provides this functionality combined with an easy to use interface for maintaining email rules and repositories. Please contact a Sherpa sales representative for a demonstration or download a free trial version to test Compliance Attender for your organization.

^[1] You can read more about this story at The News & Observer. In addition, Ferris Research makes some observations on this case.

IT professionals have a critical role in ensuring the success of email retention, compliance, or e-Discovery software implementations.  The first step is to decide who should be involved in defining your organization’s email policies.  Understand how your business is affected by various government and industry standards, and then take the time to carefully think out your policy, documenting each step.

Read the full article

• What are your responsibilities with this data? 
• How quickly do you need to produce this data when your compliance and email policy is questioned?
• Who needs access to this data?
• Can you ensure the integrity of the data?

• Do your answers change?
• Would you trust your data being stored in a cloud?

Managing an organization's email server archive can seem like a night time hike over rocky ground. There are frequently conflicting requirements and policies ready to trip you up (storage constraints, e-discovery demands, legal compliance, user access, etc.) Even the terminology can be confusing. For example, what would you say is meant by the term archiving? How is that related to journaling? Do you need either one or are they really just two terms for the same thing?

In this post, we'll consider these questions to help you navigate your organization over some rough terrain. First, some definitions.

Archiving is the process of moving a message from one data store to another. This is usually a user-centric function being done so a mail user has later access to a message not stored in their main mail file. Often, there is a 1:1 relationship between the primary mail file and the archive. Thus, each user has access their own archive.

Archiving is a kind of agreement between the e-mail administrator and the users being supported. On one hand, the administrator frees up space on expensive, primary server storage while, on the other hand, the user retains access to the moved messages.

Journaling is the process of copying a message from one data store to another. You may have heard the term 'compliance archive' in this context too, but this term clouds the distinction between 'compliance' and 'regular' archiving. Also, while archiving usually happens some time after the message has been sent and received, sometimes months later, journaling is most effective when it happens as early as possible in the message's life.

Journaling is a company-centric management technique and is done to demonstrate compliance and facilitate e-discovery. Unlike archives, typical users generally have little to do with the journaled messages.

Reasons

We can see from the above that archiving and journaling, though similar in some ways, are quite different in their intent and the needs they serve. Still, the question remains, why do you need to worry about archiving and journaling? Here are some reasons:

Archiving

Journaling

Conclusion

It is a challenge to balance all these needs successfully. However, with planning and the right tools, it is possible to smooth the rocky road of email server archive and journal management.

To see the benefits of archiving and journaling in action, be sure to check out Sherpa Software's email archiving systems, compliance software and storage discovery tools by registering for a demonstration today.