When searching email history, backup and archiving are not the same

We have received three recent requests from clients who were looking for all email history regarding particular subject matter and/or from or to particular users, all within a particular date range.  All of these clients leverage our managed backup solution, and had hoped we could recover this information upon request.

Unfortunately, that’s not how backup systems work.

Our backup system works by creating a base image which is then updated and saved in set pattern.  The default retention periods on the local Network Attached Storage (NAS) unit kept at a client’s site are typically as follows, but keep in mind, a new base image may need to be created at any time, making dailies, weeklies, and monthlies of limited availability:

  • Base image
  • Monthly consolidated (all, back to the time of the base image)
  • Weekly consolidated (for last 90 days)
  • Daily consolidated (for last 15 days)
  • Intra-day incrementals (for last 7 days)

Given the default retention schedule above, we can often access consolidated images within the time periods requested, but any recovery will only account for files in place in that snapshot in time.  If this search is being done for legal discovery, we cannot be sure that all email to or from a particular sender or regarding a particular subject will be present.

For example, if a message was created on May 10th and deleted on May 11th, it obviously wouldn’t be part of the May 1st monthly consolidated image, nor would it be in the June 1st monthly consolidated image.  Therefore, even if the June 1st image was searched, the results could not be considered all-encompassing.

As an example, consider the difference between a camera that takes pictures, vs. one that takes movies.  Imagine a camera is pointed out a window – a picture taken once at the top of every hour will only show what was happening in a particular spot for that one slice of time.  However, a movie camera will record all happenings that occur out the window for the entire hour.  If a bear riding a unicycle passes by at 20 minutes past the top of the hour, it will be captured by the movie camera, but not in either picture.

This is the difference between backup and archiving.  Archiving is like the movie – all sent and received emails would be saved and could be retrieved based on search criteria when legal discovery demands.  The good news is that it’s relatively inexpensive, usually only a few dollars per email user per month.  Unfortunately, it’s sort of like insurance: you have to have it in place BEFORE you need it.