The forgotten cost of forensic mail archiving

Information shared between these internal users includes data that could be classified as highly confidential to a company, such as financial information or human resources records and so on. While most organisations have been backing up their mail servers for years, any user that has lost an e-mail will have gone through the painful process of trying to get it retrieved, as well as any associated document attachments.

With the passing of the ECT Act locally, companies are now required to ensure and prove the integrity of an e-mail from both a storage and protection aspect. As a result of this requirement, it is conceivable that in instances where an e-mail is depended on as proof, a negative outcome can be expected due to the lack of evidential weight attached to an e-mail in relation to its integrity (or credibility).

There are various software and hardware options on the market that will archive the solution on normal storage, but any administrator or DBA can access and delete these mails. This has an obvious impact on the integrity of the e-mail as there is often no guarantee that modifications were possible. The added legislative requirement however, together with the obvious operational business need, has shifted the focus from normal archiving, or backups, to forensic archiving.

Forensic mail archiving is very different to these other options, as data is stored in a secure and encrypted format and protected from any user or administrator with access. The media used for the archiving is also important as some organisations use media that is open to the manipulation of the stored data.

An additional method of archiving has emerged, with the archiving being provided as a "hosted" service, where data is stored at an external supplier's site that provides secure storage in addition to cleaning the mail. This solution works well for external mail, but organisations now also need to store internal mail in order to ensure a persistent record of all company communications.

The issue is that, in most cases, internal mail is in a much larger volume than mail received from external sources. This hosted solution means that all internal mail must now also be sent via the data links and, in most cases, places an extra burden on the available bandwidth as this additional requirement (which is that internal mails are archived off site) was never considered.

In areas where bandwidth is not an issue, this type of solution works well, but in South Africa the off site archiving of internal and external mail may become extremely cost prohibitive - although a blessing for bandwidth providers. A number of local companies that have gone this route only later realised that they needed to double their bandwidth usage as their available bandwidth was insufficient. This could make this type of solution very expensive in the long term.

When conducting comparisons between e-mail archiving providers, it is important to bear the following questions in mind. Is it forensic archiving? Will I have to increase my bandwidth allocations? How secure is this solution?

Remember your company information is now stored off site and is no longer under your control. If you do decide to opt for a hosted service, ensure that the proper agreements and controls are in place to protect your data.