E-mail recovery? Don’t rely on your backup!

Operational backups of e-mail, whilst a critical part of the IT infrastructure, fall short in the support of business processes, says Andrew Barnes.

With each passing day we hear of more and more examples where an e-mail has been a critical part of an evidence trail. Have you stopped to think about what the implications would be for your organisation should you be required to produce e-mail as evidence?

Your first reaction will probably be ‘It’s in the backup’. However, you may be in for a shock!

In most organisations the primary role of the e-mail backup is to enable an operational recovery in the event of a system failure. The critical word here is ‘operational’. The IT department will be protecting the operational integrity of the e-mail infrastructure. They will be taking regular backups so that if necessary they can recover an operational system to a specific point in time. Recovery of an e-mail trail across a period of time is a completely different problem.

Let us consider two scenarios:

1) Does the e-mail exist in your system?
A person in your organisation sends a defamatory e-mail to a competitor and then immediately deletes the copy of the e-mail from the sent box and the deleted items folder. One month later you receive a notice of libel from your competitor citing this e-mail as evidence. You need to see what was actually sent.

2) Can you find the e-mails?
Your purchasing department has been negotiating a vital contract and to speed things up a lot of the negotiation takes place via e-mail. The negotiation is concluded over a period of one month. Two years later the contract is in dispute and a court of law asks for all evidence supporting your claims about the contract. E-mail is a critical part of your case and you need to find all relevant e-mail.

In each of the above scenarios you expect the backup to be your lifeline. However there is a problem:

1) Does The e-mail exist in your system?
The answer is ‘probably not’. The person concerned wished to cover their tracks. They took steps to delete the e-mail record and as it no longer existed in the e-mail system at the time of the next backup, it was not backed up. To find that e-mail will be very difficult. It may exist in a deleted items cache (on a backup) but given the elapsed time this will in all likelihood have been purged.

2) Can you find the e-mails?
The answer is ‘it depends’. Your IT department may well have a policy that says they recycle the backup media. They may well keep the last three months’ weekly backups, and the last years’ quarterly backups. Beyond that the backup media is recycled (i.e. overwritten) to save space and reduce cost. Maybe you are fortunate and the IT policy is to keep all tapes, now the problem turns into something akin to finding multiple needles in multiple haystacks (and you have to rebuild each haystack first)!

Both of the above scenarios demonstrate that operational backups of e-mail, whilst a critical part of the IT infrastructure, fall short in the support of business processes.

For the solution to the issues we should look more closely at how terminology often becomes confused. In IT terms the words backup and archive are often used interchangeably, often with significant consequences. For example the UNIX command most closely associated with backup is tar, it is a shortened form for tape archive. Let’s look at some definitions:

Backup: a spare copy of a file, file system or other resource for use in the event of failure or loss of the original.

Archive: a place or collection containing records, documents, or other materials of historical interest.

In both of the scenarios shown above, the way out of the problem is to access a collection of (e-mail) records of historical interest, i.e. an archive. It’s time we all more clearly understood that ‘backup’ and ‘archive’ are not the same thing. This way we can reduce corporate risk and as a by-product decrease the costs and overheads associated with protecting operational systems.

Think about all those daily, weekly, monthly backups. In truth, how much of the information remains unchanged between backups. In the case of e-mail we have historical e-mail (which doesn’t change) and new e-mail. The historical e-mail belongs in an archive where it can be preserved for historical access, the new e-mail is part of the operational e-mail system and should be preserved by operational backups. By making this distinction the overheads associated with operational backup can be drastically reduced, and the ability to support business processes regarding corporate record is greatly enhanced.

Backup your operational systems, it’s vital, but archive your historical records. Two complementary technologies working together to meet the overall business and IT need.

Andrew Barnes is global marketing director, KVS.

KVS Inc. is exhibiting at Storage Expo 2003 the UK's largest dedicated data storage event, delivering the latest data storage products on the market to over 3,000 end users, Olympia London from 15th-16th October 2003. www.storage-expo.com

•Date: 26th September 2003 •Region: Worldwide •Type: Article •Topic: IT continuity
Rate this article or make a comment - click here