Email Recovery? Donít rely on your backup!

Andrew Barnes, Global Marketing Director, KVS

With each passing day we hear of more and more examples where an email has been a critical part of an evidence trail. Have you stopped to think about what the implications would be for your organisation should you be required to produce email as evidence.

Your first reaction will probably be ìItís in the backupî. You may be in for a shock!

In most organisations the primary role of the email backup is to enable an operational recovery in the event of a system failure. The critical word here is ìoperationalî. The IT department will be protecting the operational integrity of the email infrastructure. They will be taking regular backups so that if necessary they can recover an operational system to a specific point in time. Recovery of an email trail across a period of time is a completely different problem.

Let us consider two scenarios

1) Does The Email Exist In Your System? A person in your organisation sends a defamatory email to a competitor and then immediately deletes the copy of the email from the sent box and the deleted items folder. One month later you receive a notice of libel from your competitor citing this email as evidence. You need to see what was actually sent.

2) Can You Find The Emails? Your purchasing department has been negotiating a vital contract and to speed things up a lot of the negotiation takes place via email. The negotiation is concluded over a period of one month. Two years later the contract is in dispute and a court of law asks for all evidence supporting your claims about the contract. Email is a critical part of your case and you need to find all relevant email.


In each of the above scenarios you expect the backup to be your lifeline. However there is a problem Ö

1) Does The Email Exist In Your System? The answer is ìprobably notî. The person concerned wished to cover their tracks. They took steps to delete the email record and as it no longer existed in the email system at the time of the next backup, it was not backed up. To find that email will be very difficult. It may exist in a deleted items cache (on a backup) but given the elapsed time this will in all likelihood have been purged.
2) Can You Find The Emails? The answer is ìit dependsî. Your IT department may well have a policy that says they recycle the backup media. They may well keep the last three monthsí weekly backups, and the last yearsí quarterly backups. Beyond that the backup media is recycled (i.e. overwritten) to save space and reduce cost. Maybe you are fortunate and the IT policy is to keep all tapes, now the problem turns into something akin to finding multiple needles in multiple haystacks (and you have to rebuild each haystack first)!

Both of the above scenarios demonstrate that operational backups of email, whilst a critical part of the IT infrastructure, fall short in the support of business processes.

For the solution to the issues we should look more closely at how terminology often becomes confused. In IT terms the words backup and archive are often used interchangeably, often with significant consequences. For example the UNIX command most closely associated with backup is tar, it is a shortened form for tape archive. But letís look at some definitions

Backup: A spare copy of a file, file system or other resource for use in
the event of failure or loss of the original.

Archive: A place or collection containing records, documents, or other materials of historical interest.

In both of the scenarios shown above, the way out of the problem is to access a collection of (email) records of historical interest, i.e. an archive. Itís time we all more clearly understood that ìbackupî and ìarchiveî are not the same thing. This way we can reduce corporate risk and as a by product decrease the costs and overheads associated with protecting operational systems.

Think about all those daily, weekly, monthly backups. In truth, how much of the information remains unchanged between backups. In the case of email we have historical email (which doesnít change) and new email. The historical email belongs in an archive where it can be preserved for historical access, the new email is part of the operational email system and should be preserved by operational backups. By making this distinction the overheads associated with operational backup can be drastically reduced, and the ability to support business processes regarding corporate record is greatly enhanced.

Backup your operational systems, itís vital, but archive your historical records. Two complementary technologies working together to meet the overall business and IT need.

KVS Inc. is exhibiting at Storage Expo 2003 the UK’s largest dedicated data storage event, delivering the latest data storage products on the market to over 3,000 end users, Olympia London from 15-16 October 2003.