Doing e-Discovery / Message Retention / Legal Recovery in Exchange 2010 - Office 365

Native in the Box (Journaling), Lookup, and Recovery

1 2 3 Page 3
Page 3 of 3

2.  As the individual drills into the folders, messages that match the query will be found in any of a number of folders, such as the Inbox (if the message is still in the user’s Inbox), in a subfolder (if the user dragged/dropped the message into a subfolder), in the Deleted Items folder (if the message was deleted but not yet purged from the Deleted Items folder), in the Recoverable Items \ Deletions (if the message was purged from the user’s Deleted Items folder and is hidden from the user), in the Recoverable Items \ Versions (if the message was edited by the user), in the Archive Mailbox \ folder name (if the message is no longer in the user’s Primary Mailbox and has been dragged/dropped into the user’s personal Archive), etc.  Messages can be in any of a number of folders.

^^ List of messages in the user’s Inbox that matches the search criteria ^^

^^ Version of a specific message in the user’s Inbox that matches the search criteria ^^

^^ List of messages in the user’s Recoverable Items \ Versions folder that shows the same message appears to have been modified / edited that matches the search criteria ^^

^^ View of the original message showing that the original message was edited / modified ^^

^^ Another copy of the same message that was edited as well and ended up in the Versions folder ^^

The content in this search query can be exported to a PST, or it can be left on the server.  Additionally, a specific user account can be created in Exchange or Office 365, and instead of dumping the contents in e-Discovery Step 3 to the default Discovery Search Mailbox, you can dump the search results to a dedicated mailbox that a user can be given logon rights just to that “user account” (which effectively has just the search results from a single search).

There are a number of variations on how information can be queried and reviewed.  This document covered the most common functions, however other variations can be made.

Note: Email retention and deletion policies are specific to messages in a mailbox (either active or inactive mailbox).  Mailboxes can be deleted, databases can be deleted, and information can get corrupt.  Organizations need to protect the root storage of information from data loss that the mail handling policies noted in this document do not address.

Authored by Rand Morimoto (reviewed and edited by Guy Yardeni), Convergent Computing, http://www.cco.com

About the Author

Rand Morimoto is the author of the book “Exchange 2010 Unleashed” and the President of Convergent Computing (CCO), an IT consulting firm in the San Francisco Bay Area.  Dr Morimoto did his doctoral studies in Organization Management and has taught Undergraduate and Master degree courses on cyber-security, business ethics, and business law.  Dr Morimoto was the Internet Security advisor to President Bush (2002-2007), authored the book “Network Security for Government and Corporate Executives,” and frequently participates as an expert witness in legal cases regarding electronic data and information integrity.

Acknowledgementhttp://www.dredlaw.com) for his contribution to this article.  Cary helped me insert in legal terms and terminology in the document so that those who speak that language will hopefully share a common understanding on some of the aspects of my technical content.  Cary is one who is a translator who speaks legal and tech.

I wanted to thank Cary Calderone, a California licensed attorney (

DisclaimerThis document is provided for informational purposes only and the author makes no warranties, either express or implied, in this document.  Information in this document, including URL and other Internet Web site references, is subject to change without notice.  The entire risk of the use or the results from the use of this document remains with the user.

Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.

Copyright © 2011 IDG Communications, Inc.

1 2 3 Page 3
Page 3 of 3