Organizations are spending increasing time searching historic email and other electronic messaging records. Those who have been party to a discovery exercise or tried finding important misplaced emails know the level of work and expense that can be involved. Factors that play a part include:
- Retrieving data which has been moved to off-line backup storage. - Usually this requires a new email environment to be created first, into which backup data is loaded to allow searching.
- Particularly for larger organizations, backup records consisting of multiple tapes for multiple time periods for multiple email servers. (Read about how Perot systems testified in front of a UK judge that it would cost them £4.27m to search through five years of emails).
- Data which has not been centrally archived - typically where users have been configured with personal mail stores on their PCs. Retrieval is often hampered in situations where individuals have left the organization.
- Data held in different email systems, (e.g. within a decentralized group of companies or as a result of acquisition).
- Integrity concerns:
- Is the record complete? - Are any messages or individual backup tapes missing?
- Has any data been altered? - At what point do you stop searching for the original?
- Was the backup performed correctly? - Does it actually exist?
- Slow search performance of some email systems, degrading further when attachments are searched as well.
Frequently, time is of the essence when it comes to searching. While there are a growing number of tools available to help with rapid searching of large volumes of data, few systems deal with ensuring that a trusted (forensic) record was captured in the first place or appropriately address matters of data protection. From an evidential standpoint, a document original is often the electronic message itself rather than a subsequent copy or print out. The original electronic version holds vital 'metadata' (data about data) needed for establishing the document's authenticity.