Email Recovery

What is Email Recovery

Email is the process of recovering the lost emails either due to system crash or any other misshapen, which is untoward in nature.

With each passing day we hear of more and more examples where an email has been a critical part of an evidence trail. Have you stopped to think about what the implications would be for your organisation should you be required to produce email as evidence.

Your first reaction will probably be "It's in the backup". You may be in for a shock!

In most organisations the primary role of the email backup is to enable an operational recovery in the event of a system failure. The critical word here is "operational". The IT department will be protecting the operational integrity of the email infrastructure. They will be taking regular backups so that if necessary they can recover an operational system to a specific point in time. Recovery of an email trail across a period of time is a completely different problem.

Let us consider two scenarios

Does The Email Exist In Your System? A person in your organisation sends a defamatory email to a competitor and then immediately deletes the copy of the email from the sent box and the deleted items folder. One month later you receive a notice of libel from your competitor citing this email as evidence. You need to see what was actually sent.

Can You Find The Emails? Your purchasing department has been negotiating a vital contract and to speed things up a lot of the negotiation takes place via email. The negotiation is concluded over a period of one month. Two years later the contract is in dispute and a court of law asks for all evidence supporting your claims about the contract. Email is a critical part of your case and you need to find all relevant email.

Both of the above scenarios demonstrate that operational backups of email, whilst a critical part of the IT infrastructure, fall short in the support of business processes.

For the solution to the issues we should look more closely at how terminology often becomes confused. In IT terms the words backup and archive are often used interchangeably, often with significant consequences. For example the UNIX command most closely associated with backup is tar, it is a shortened form for tape archive. But let's look at some definitions

Backup: A spare copy of a file, file system or other resource for use in

the event of failure or loss of the original.

Archive: A place or collection containing records, documents, or other materials of historical interest.