Exchange Archiving Tools

View this month's Buyer's Guide

Some email users are pack rats: They hate to throw away old messages. This habit can cause problems for the users and their administrators, but it also provides an important benefit in that those users can dig through their mailboxes to find old messages.

Today, businesses need similar capabilities. A growing number of companies are obligated by legal, contractual, or regulatory requirements to archive email for a period of time and to be able to query the archive on demand. Those requirements are at the heart of the drive to implement email archiving and retention systems.

Extending Exchange
Out of the box, Microsoft Exchange Server has limited support for archiving. You can enable message journaling on individual mailbox databases in Exchange Server 2003 and Exchange 2000 Server. The Exchange Message Categorizer automatically bifurcates messages that are sent to or by users whose mailboxes reside in a journaled database. One copy of the message goes to its original destination, and the other is redirected to an external contact, a mailbox, or a public folder.

At that point, you're on your own, because Exchange offers no reporting, querying, indexing, or compliance features beyond those you get by opening the archive mailbox or public folder with Microsoft Outlook. In fact, Exchange basically just copies the specified items; it's your responsibility to manage them. The products in this Buyer's Guide extend Exchange's built-in functionality by providing additional archiving capabilities. All the products have the same basic purpose: They let you capture messages, keep them for as long as you need to, and manage, search, and report on the archived contents. Look for these fundamental capabilities when purchasing a solution:

• The product should capture inbound and outbound messages, including Cc and Bcc addressees, sent to or from any mailbox in your Exchange organization. Some products rely on Exchange's journaling mechanism; others implement their own. Accordingly, some products (e.g., GFI Software's GFI MailArchiver for Exchange) have to be installed on every Exchange server and others (e.g., EMC's EmailXTender) are installed at the mail gateway or on an additional server.
• The product should provide rule- or criteria-based archiving so that you can include or exclude mailboxes. The filtering criteria might include user or group identity (so, for example, you can archive messages only for C-level executives and directors), absence or presence of specific keywords (e.g., "attorney-client privilege"), and date and time specifications. The more flexible the rule criteria, the better off you'll be in the long run because systems that capture too much or too little email won't help you comply with your regulatory regime.
• The best archiving system in the world is useless if it doesn't retrieve the messages you need to fulfill a regulatory requirement or court order. Keyword searching is vital, as is the ability to search by date range or user. Ideally, you should be able to build arbitrarily complex queries to select precisely the items you need.
• The product must search for and retrieve information quickly. Many regulatory requirements specify explicit retrieval times that you must meet to remain in compliance.
• The product should let you define policies that apply to groups of users. For example, Quest Software's Quest Archive Manager for Exchange lets you set policies that apply archive settings to groups of users. Some products include templates or predefined policies that help you meet specific regulatory requirements; these templates (such as those in VERITAS Software's VERITAS Enterprise Vault's Compliance Accelerator) can greatly ease compliance.
• The product should be able to catalog and track large numbers of messages, preferably by using an interface to a Hierarchical Storage Management (HSM) system.
• The product should include reporting tools that make it easy to track how much email data you've archived, where it's archived, and what it contains.

Due Diligence
Before you select an archival solution, make sure you understand your compliance and archiving requirements. Test candidate systems on the hardware you plan to use to make sure they can keep up with your message volume. Try sample queries and reports, too, to verify that you can find the messages you need when you need them. Don't forget to consider the long-term cost of maintaining the solution; you're likely to have it for a while. Finally, select a solution from a stable company that has a strong history of product support.