ARCHIVING FOR EXCHANGE 2013

Transcription

1 White Paper ARCHIVING FOR EXCHANGE 2013 A Comparison with EMC SourceOne Management Abstract Exchange 2013 is the latest release of Microsoft s flagship application and as such promises to deliver new features for archiving and discovery to the exclusion of 3 rd -party archiving solutions. This paper describes the new archiving and discovery features of Exchange 2013 and compares them to the EMC SourceOne archiving solution. February 2013

2 Copyright 2013 EMC Corporation. All Rights Reserved. EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. The information in this publication is provided as is. EMC Corporation makes no representations or warranties of any kind with respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com. Part Number H

3 Table of Contents Introduction... 4 Exchange 2013 Archiving... 4 Exchange 2013 User Impact... 5 SourceOne Archiving... 5 Exchange 2013 Legal Hold... 6 Sourceone Legal Hold... 6 Exchange 2013 ediscovery... 7 Early Case Assessment... 7 Culling and Preserving... 7 Tag, Review & Export... 7 Authenticity (Chain of Custody)... 8 SourceOne ediscovery... 8 Exchange 2013 Search... 8 SourceOne Search... 9 Conclusion

4 Introduction Organizations today are struggling to manage exponential data growth and its corresponding impact on service performance, user productivity and legal discovery. Beginning with Exchange 2010, Microsoft introduced new features to its flagship application to address these challenges for archiving and discovery. With the release of Exchange 2013, Microsoft continues to enhance and improve key features for archiving and discovery making it unclear if the archiving and discovery features of Exchange 2013 are good enough or if EMC SourceOne on-premise archiving solution is the better solution. This paper will describe the archiving and discovery features of Exchange 2013 and make a comparison with the same offering from EMC SourceOne. Readers will benefit by understanding the capabilities of Exchange 2013 for archiving and discovery so they can decide where EMC SourceOne is necessary for more robust in-house archiving and discovery. Exchange 2013 Archiving With Exchange 2010, Microsoft enhanced the archiving capabilities of its Exchange platform to address rapid mailbox growth as well as the proliferation of PST files sitting on network drives, file systems and local computers. PST are well known for causing a number of problems, including unmanaged content, increased ediscovery costs, inability to apply retention/disposition policies and data loss. To address these issues, Microsoft created the Personal Archive Folder within Exchange A Personal Archive Folder is essentially a second mailbox for a user, allowing an organization to move old or archived to a secondary storage tier for cost savings. Within Exchange 2013, Microsoft re-branded the Personal Archive Folder as In-Place Archiving; however the functionality is identical to Exchange In-Place Archiving is a premium feature and requires an Enterprise CAL license to implement. With Exchange 2010 /2013, Microsoft made a significant change when it removed single instance storage in order to improve system performance. This means two things - all the data that is stored in Exchange Server; even duplicate copies of large attachments, are stored multiple times, significantly increasing the size of Exchange Server over previous versions of Exchange. Moreover, with Microsoft Exchange 2010/2013's Database Availability Group (DAG) high availability function, you are further replicating this duplicative content, unnecessarily consuming storage resources. Exchange storage is an additional concern for Exchange migrations. As you migrate from previous versions of Exchange to Exchange 2010/2013, you need to account for the difference in space (and cost) between the same data in an older version of Exchange and Exchange 2010/2013. It is not uncommon for this to represent a 100% or greater increase in storage requirements. This concern extends into the future as well. Since Exchange 2007, Microsoft has removed the capability of in-place Exchange migration, meaning every future Exchange migration requires a physical 4

5 data move. With the Personal Archive Folder residing on the Exchange Server and the lack of single instancing, this archiving model is a roadway to longer, costlier and more disruptive Exchange migrations in the future. Exchange 2013 User Impact There is a disparity how Exchange 2010/2013 performs between online and offline modes. The Personal Archive (In-place Archiving) is only available when you are online and connected to Exchange. When you are working offline in Outlook s cache mode, the Personal Archive is not cached and consequently unavailable to the user. When online, users get search results from both their primary and personal archive mailboxes, yielding significantly more search results than when they are offline, creating inconsistent results and end user confusion. With SourceOne, Offline Cache provides a seamless end user experience, regardless of whether the end user is online or off-line. IT consumerization and the increasing frequency of BYOD (bring your own device) has led to significant user populations accessing enterprise and data from non- Microsoft operating systems, particularly by Apple. Forrester Research reported in 2012 that 46% of enterprise organizations (greater than 1,000 employees) had issued or deployed Apple Macintosh systems within their environment. Personal Archives are not available for Outlook 2011 for Mac (Entourage) nor are they available for mobile smartphone (ActiveSync not supported). This is a significant user impact given the popularity of non-microsoft devices for communication. SourceOne Archiving SourceOne provides single-instance storage for archived messages and attachments. A message containing a large PowerPoint attachment for example will only be stored once in the archive storage. All other messages that reference that attachment will have pointers to the single instance of the presentation, not a copy of the presentation itself. This results in dramatic storage savings relative to each user storing their own copy of the object. As an example, consider a 5 MB PowerPoint presentation ed to 12 users. In the Microsoft Exchange case, at least 60 MB of storage will be consumed (12 copies of the 5 MB presentation). In contrast, if the customer uses SourceOne archiving, the total storage would be only 5.1 MB (5 MB for the presentation and approximately 100 KB for the 12 8 KB pointers to the presentation. With respect to user access, SourceOne allows users to access their , whether it resides on the Exchange server or in the archive from any device that has a Web browser. This removes the restriction that all access devices be Microsoft Exchange aware. For users whose primary system is a Microsoft Windows PC, the SourceOne offline access cache allows them to have access to their most recently archived data even when they are not connected to the SourceOne archive server. SourceOne administrators set a policy-based limit on the amount (in GB) of data that will be cached on a user s local hard drive. When a user requests access to an archived item, the system first checks the offline cache to determine if the item resides locally. If it does reside locally, the item is retrieved from the cache. If the 5

6 item does not reside locally, a request is made to the SourceOne archive to provide the item. Exchange 2013 Legal Hold Within Exchange 2010, litigation hold capabilities were limited to an indefinite hold on a complete mailbox. This process would hold all mail items in a specific mailbox indefinitely, without the ability to place holds based on timeframe or content, and regardless of whether the content was responsive to the associated legal matter. This process both increases the downstream ediscovery costs as non-responsive data is incorporated into case data, and it also increases organizational risk by unnecessarily holding data that may be responsive to future lawsuits, which potentially could be deleted via a standard retention and disposition policy. Microsoft has added new litigation hold functionality to Exchange 2013 to address the need to preserve data with a more granular approach. A significant enhancement with Exchange 2013 is the ability to enact item-level legal holds based on query language or time, in addition to the indefinite mailbox hold available within Exchange This gives you the ability to enact a much more refined hold request, including the ability to specify a legal hold based upon keywords, start and end dates, sender and recipient addresses and message types. Despite this enhancement, there is a significant gap within the Exchange 2013 legal hold process that renders it inappropriate for a majority of enterprise legal hold requirements. First, you are only able to apply a query-based or time-based legal hold to data that is indexed by Exchange, which is natively limited to 53 file types (compared to the over 400 file types EMC SourceOne is able to index). This limitation renders query-based or time-based litigation holds unusable for a majority of today's organizations, leaving only the basic, indefinite hold function preventing the possibility of data spoliation. Sourceone Legal Hold SourceOne legal holds perform by having the user search the archive for all items that meet specific criteria (additional discussion on search limitations is given below) and then copying those messages deemed potentially relevant to the legal hold folder maintained within SourceOne. This legal hold folder contains copies of the potentially relevant messages and this folder and its contents are outside the operational retention and deletion processes. Data that is placed into the legal hold folder is maintained until all matters with which that data object is associated are deleted. This methodology eliminates the need to change the retention on specific sets of messages within the operational archive and greatly simplifies the process by which messages are retained for the duration of legal matters. SourceOne is able to index and search over 400 different types of files. Included in this set of file types is the ability to index and search the individual items that reside within container files such as ZIP or TAR. This capability allows SourceOne to find 6

7 relevant items that are not part of the body or even a single attachment but those items that are contained multiple levels underneath the parent message. Exchange 2013 ediscovery Exchange 2013 enhances the ediscovery capabilities over prior Exchange versions, adding basic ediscovery functionality such as more advanced search terms and proximity searches (i.e. near ); holding data to an ediscovery mailbox; and even inplace legal hold, assuming that the enterprise has purchased an Enterprise CAL. Exchange 2013 still lags well behind the requirements for an enterprise that is serious about its ediscovery process. Preserving and collecting messages is a key step in the ediscovery process. Done correctly, this preservation step should be taken when litigation is reasonably anticipated, ideally before a lawsuit has actually commenced. Typically there are three important processes to take against this collected data: early case assessment; culling and filtering; and review/tagging (followed by export). Exchange 2013 does not directly support any of these steps. Early Case Assessment Exchange 2013 is very limited in its early case assessment capabilities. While there is some ability to preview messages, this works only for the results generated after a search is run. There is no capability to run a search and then further filter those results based upon custodian, date range, attachment, etc. Message threading also appears to be missing, which is critical to the ECA process. And of course there is no ability to see the messages in context against other content such as from other sources (e.g. PST files), documents collected from file shares, etc. outside of SharePoint and Lync. Culling and Preserving Exchange 2013 also has a very limited ability to cull data. As discussed above, there is no simple method to further refine a result set after a search has been completed. But this is often a necessary function. In most discovery matters, after a collection is complete, further work is necessary against the initial collection set to refine and minimize its volume. For example, an initial collection may have been for 15 custodians within a one year period. Later in the case, a motion or further discovery may result in winnowing that set down to 5 custodians within a two month period. Exchange 2013 does not have a method to directly permit that culling activity against the initial set. Tag, Review & Export There is no support for tagging messages i.e. relevant, privileged, confidential, etc. In many cases, messages may be bulk-tagged (i.e. all messages before 1/1/2008 are now irrelevant and can be tagged in one step) or individually reviewed for tagging. Exchange 2013 does not have support for these tags, nor can messages be distributed among reviewers for this work. 7

8 Authenticity (Chain of Custody) It is not clear exactly how Exchange 2013 will support chain of custody requirements. Insuring that a message does not change is important, but it s often critically important to be able to trace the message back to its original location to insure its authenticity at trial. Exchange 2013 only supports export to a PST file, and while this can apparently be generated with a manifest, there s no automated process to keep these together. Assuming that further work is required on the PST file, as noted above, the messages will no longer show their original location but will all be mixed together as being from a common PST repository. While this may not be an issue for all cases in the cases where it does matter, it will be a critical (missing) component of the ediscovery process. SourceOne ediscovery SourceOne Discovery Manager is the application that performs all the functions of search and legal discovery for SourceOne. Discovery Manager is a Windows desktop application that can be used by General Counsel, legal staff and Administrators. The core capabilities of Discovery Manager are the search of the entire SourceOne archive, as discussed below. In addition to search, Discovery Manager provides a legal workflow, whereby users can delegate search roles, identify and assign custodians to search, define search tags, save search, cull searches and export search results in a variety of industry standard formats. Important, search results are stored in separate legal hold folders to ensure data authenticity and chain of custody. Many organizations experienced with in-house legal discovery have benefited greatly using SourceOne Discovery Manager. Having fast access to all archive content allows organizations to make early assessments regarding a potential law suit, saving the cost of outside legal counsel and potentially avoiding expensive litigation. Exchange 2013 Search For Exchange 2013 search, Microsoft introduced the ability to search the In-Place Archive. In Exchange 2010, the Personal Archive was not included with a mailbox search, which is a major short coming. Now when a mailbox search is performed in Exchange 2013, the mailbox search includes the primary mailbox and the In-place Archive mailbox. But as we previously discussed, a major limitation for Exchange 2013 search remains because Exchange only natively indexes 53 file types. Using Exchange 2010/2013 search you can t prove or be assured that all content was properly searched. Conversely, SourceOne has the ability to index 400 file types and ensures that all content is accessible for search. Moreover, there are a number of gaps within Exchange 2013 that are just now being identified as the product has its final release. For example, the inability to perform ediscovery searches on the Journal mailbox (it only covers the personal archive and primary mailboxes) and the inability to search the bcc field are considerable limitations from an ediscovery search perspective. 8

9 SourceOne Search SourceOne search has access to search the entire SourceOne archive and to meet the requirements of the ediscovery process. For search, SourceOne has none of the limitations of Exchange, most notably the 53 file type limitation, and it searches all data in the archive, whether placed there by journaling or by a historical archive task against the user s mailbox. Furthermore, complex searches such as proximity, wildcard, and Boolean combinations of full-text and metadata are supported. Finally, all address fields and the members of distribution lists are searchable. Conclusion For readers who are familiar with Microsoft Exchange, you are accustomed to the manner which Microsoft introduces new features. The process is one of multiple iterations that span years. The new Exchange capabilities for archiving and discovery are no exception. With the introduction the Personal Archive in Exchange 2010, Microsoft for the first time took aim at the archiving market, a market that they largely ignored in all previous releases. With Exchange 2013, Microsoft introduced further improvements for archiving and discovery, but as we learned in this paper, many important gaps still remain. The decision whether to use Exchange 2013 for archiving and discovery versus adding a 3 rd -party archiving solution such as EMC SourceOne depends on the individual needs of each organization. Organizations with a heavy legal work requirement will likely find the limitations of Exchange 2013, such as 53 file type index, no tagging, no culling, etc. to be show stoppers. While other organizations may decide that the total storage requirements for primary mailboxes plus archiving mailboxes, when you take into account the lack of single instance storage and the DAG replication cost, are too great to preclude keeping old, archived in Exchange. EMC SourceOne is a next generation, in-house archiving solution that supports content from Microsoft Exchange, Microsoft SharePoint and network file shares. SourceOne is a fully integrated solution, whereby all content, no matter of its source, is deduped, indexed and stored in tamperproof archive containers. SourceOne supports all the leading EMC storage solutions including EMC Centera for compliance storage, EMC Data Domain for consolidated backup and archive storage and EMC Atmos for cloud storage. For more information about EMC SourceOne, contact your local EMC Sales representation who can provide you with additional information and can show you how SourceOne can benefit your organization for archiving and discovery. 9