Video Screencast Help
Protect Your POS Environment Against Retail Data Breaches. Learn More.
Archiving and eDiscovery Community Blog

How to combine 0 Day archiving with 15 day shortcutting

Created: 30 Sep 2012 • Updated: 29 May 2014
Rob.Wilcox's picture
0 0 Votes
Login to vote

 

This is a question that I saw on Twitter the other day. The request is:

 

How can we combine 0 Day archiving with 15 day shortcutting?

 

So I am assuming that this is in relation to Microsoft Exchange mailbox archiving, and as we know, Enterprise Vault doesn't have 'Archive now, shortcut later', for Exchange Archiving. There is a way to achieve this goal. Let me explain how....

 

First of all 0 day archiving gives me the impression that everything needs to be archived.. not just what's left at the end of the first day. Literally everything to be archived. The way to achieve that in Exchange terms is to enable journalling. I am not going to explain in detail what that does in a short article like this, but essentially what Exchange then does is create a guaranteed copy of every message sent or received and put it in a journal mailbox. Recent versions of Exchange allow you to build rules around that 'copying' such as 'only outbound messages' or 'only messages between these groups of people' and so on. For us, let's decide that the first step is to enable Exchange journalling .. and that will result in a journal mailbox .. which will start to rapidly fill up.

Enterprise Vault has a journal task, which can archive the items in that journal mailbox, and put them in a journal archive. Many people configure a specific journal vault store, which contains just one (or more) journal archives. End users do not typically have access to that archive, and many people buy things like Discovery Accelerator or Compliance Accelerator to help in searching and gathering information from that archive as part of eDiscovery exercises.

As well as archiving the items from the journal mailbox in to the journal archive, the journal task also deletes the mails in the journal mailbox. So there is no need for any administrative effort to manage this new additional mailbox. (There are also monitoring tools available so that you can be warned of problems with the journal mailbox filling up).

At this point we have achieved the first part of the request .. we are archiving everything '0 day'. There is no impact to users, they are still getting their mails as normal, we're just storing in the archive a side-copy of them.

Shortcutting the items after 15 days really relates to the Exchange Mailbox archiving policy. It is a simple task to setup a 15 day archiving policy which archives the item, and creates a shortcut for it.

Many people think that at this point we are going to end up with duplicate items, or double (pretty much) the amount of storage. We've archived the items at 0 day, and now again at 15 days! Enterprise Vault is cleverer than that though. Even if the mailbox archives and the journal archive are in different Vault Stores, with 'sharing' enabled between the vault stores in the vault store group Enterprise Vault will not create duplicates. Instead a reference is made in SQL to indicate that the item has already been encountered, and a pointer made to where the item truly resides.

Simple!

We have, I think, accomplished the initial request. We are now 0 day archiving everything, and shortcutting end user items at 15 days.