Exchange 2010: retention of deleted mail for forensics and such

Question

Our organization has a single exchange 2010 server for our ~100 users. I was recently asked to go and do a search for all mail related to some specific key words, and I sorted out how to use Discovery Search Mailbox for multimailbox searches, and it pulled up a ton of hits. But there were seemingly some missing pieces.

If someone deletes an email permanently, does the Exchange server continue to keep up with it in some fashion? If not (by default), is there a configuration or trick to do this? Is 'archiving' what I'm looking for?

Thanks,

Answer 1

By default, messages that are deleted by a mail user will eventually be purged from the system after a number of retention periods.

If what you want is to be able to have access to all e-mail that has ever been sent or received by your exchange org, you need to configure journalling. This will save every mail in a separate journal mailbox that you can then search for HR or legal reasons. See here for more info:

http://technet.microsoft.com/en-us/library/aa998649.aspx

This requires some storage planning, and working with HR/Legal/Management to get your policies straight for e-mail retention.

For a more targeted approach, you can enable a legal hold on particular mailboxes. this assumes prior knowledge that you will need to search those mailboxes at a later time.

Answer 2

I think a better approach is a structured mail archiving/data retention solution that leverages the Exchange database journaling feature. This is especially important if there are legal or compliance reasons for retaining electronic communications.

I use either the free or commercial versions of MailArchiva to handle document retention and long-term archival. All messages are journaled and indexed, and the software provides a full search engine interface for users, administrators and auditors.

Also see: What is a good alternative to email archive appliances for MS Exchange?