Product Review: GFI Archiver

Product: GFI Archiver

Product Homepage: click here

Free Trial: click here

Introduction

GFI Software is a developer of IT solutions founded in 1992. Its products include software for filtering spam and viruses from e-mail, monitoring and scanning networks for security purposes, and more.

In this review, we will focus our attention on GFI Archiver 2015 (build 20141117) in an Exchange 2013 environment. GFI Archiver enables companies to archive and manage their email, calendar and file history in one place and provides easy access to the data when they need it. It starts by being an email archiving solution that can archive all internal and external emails into a central Archive Store, but it does much more than that as we will see.

GFI Archiver operations can be classified in three stages:

1. Emails are retrieved from the mail server or from an Outlook client;
2. Those emails are archived in a GFI Archive Store;
3. Users can browse and analyze archived emails through a web interface, mobile interface or Outlook.

An Archive Store is a container that holds archived emails. It consists of several components, such as:

• A database where email metadata and headers are stored;
• A disk location used as an email index;
• A disk location used as storage for email data.

But we are getting ahead of ourselves, so let us start by checking what is required to run GFI Archiver.

Requirements and Installation

To run GFI Archiver we need one of the following Windows Server operating systems:

• Windows SBS 2003 (32-bit);
• Windows SBS 2008 or 2011 (64-bit);
• Windows Server 2003 Standard & Enterprise (32 or 64-bit);
• Windows Server 2008 Standard & Enterprise (32-bit);

• Windows Server 2008 Standard, Enterprise or Datacenter (64-bit);
• Windows Server 2008 R2 Standard or Enterprise (64-bit);
• Windows Server 2012 Standard or Enterprise (64-bit);
• Windows Server 2012 R2 Standard or Enterprise (64-bit).

Servers running on VMware or Hyper-V are fully supported. GFI Archiver can also be installed directly on an Exchange server, but that is only recommended for test/dev environments.

In terms of mail servers, the following are all supported:

• Microsoft Exchange 2003, 2007, 2010, 2013;
• Office 365 (Exchange Online);
• Mail servers supporting IMAP;
• Kerio Connect;
• Google Apps for Business.

Most deployments use a Microsoft SQL Server (2005 or later) database to store archive data. To be more precise, GFI Archiver only stores metadata and email headers in the SQL database, the raw email data is stored encrypted and compressed on disk. SQL Express is also fully supported but it is not included. For evaluation purposes of 25 or less users, GFI Archiver includes a free database called Firebird.

Installing GFI Archiver could not be easier. It follows the traditional wizard-based installation and the only options we need to make are to decide if we want to use Active Directory or not (some organizations do not use AD):

Figure 1

Add a name for the website used for administration:

Figure 2

The wizard even checks for all the required components and installs them if they are not present:

Figure 3

Once GFI Archiver is successfully installed, the Congratulations screen is displayed:

Figure 4

Clicking Configure starts the post install wizard that assists in setting up GFI Archiver:

Figure 5

From here, steps 2 and 3 are the most important ones. Archive Store Settings allows us to configure which type of database to use:

Figure 6

In step 3 we configure the Archiving Method used by GFI Archiver:

Figure 7

• Manual archiving lets users decide which emails to archive. Users can manually archive a single email or a whole folder. This archiving method does not require Exchange, which means that any business using Outlook can manually archive emails irrespective of where their email is hosted;
• All Emails uses the journaling feature of Exchange. Journaled emails are copied (and deleted from Exchange if desired) by GFI Archiver and archived. GFI Archiver can also poll email from any mail server that supports IMAP and Active Directory;
• Rule-Based Archiving is suitable for organizations that do not want to archive everything. Using this option, administrators can selectively archive email based on specific criteria.

Next we need to tell GFI Archiver which journaling mailbox(es) to archive emails from or let it automatically create one:

Figure 8

Once this is done, and if we let it create a journaling mailbox, this will appear in the mailboxes list:

Figure 9

Also, the database where it was created (chosen by us) will be automatically configured to archive everything since we selected the option to archive all emails:

Figure 10

Note that this gets enabled only for the database where the mailbox was created. If we have other DBs, then we need to manually configure them. Alternatively, we can use a journal rule instead.

Administration

Now that GFI Archiver has been installed and an initial configuration performed, it is time to run it. To do so, we use the GFI Archiver icon on our desktop/start menu:

Figure 11

Alternatively, we browse to the URL chosen during installation in the form of: http://<GFI Archiver hostname>/<GFI Archiver virtual folder name>

HOME

Once logged in, we are taken to the Home tab. Its graphical and statistical information provides a real-time overview of the general operational parameters of GFI Archiver, and it helps identify any issues:

Figure 12

In this pane we can see information such as any possible issues related to various components of GFI Archiver, how much disk space we have free on the GFI Archiver server, information about the total number of emails archived and the number of Archive Stores used, a graphical overview of the quantity of emails being archived, and information about GFI Archiver events (if any).

ARCHIVE

In the Archive tab we can view archived items for all the mailboxes that we have access to:

Figure 13

We can also perform several actions such as previewing an email in the preview pane on the right, delete emails from the archive (if the option has been enabled) or switch between email conversations and calendar items.

To view an archived email, we can also double click it to view it in a new window:

Figure 14

Depending on the type of archived item selected, we can view the item’s header, view the conversation thread, edit its labels which allows organizations to categorize items (useful for legal searches for example), save the email to EML or MSG format, download the calendar item, print it and more. From this window we can also easily restore the item to a specific mailbox or forward a copy to an email address:

Figure 15

We can also easily search for archived items. GFI Archiver queries its email index and retrieves any matching item with its respective attachment. Simple Search is an extension of the Quick Search feature that enables us to use the following additional search criteria:

Figure 16

Alternatively, we can use the Advanced Search to use a wider range of search criteria when searching for archived items:

Figure 17

We can also search and view emails (including attachments) using a smart phone! This feature is supported by devices running Android 2.1+, Apple iPhone iOS 4 or Blackberry OS5+:

Figure 18

Figure 19

CONFIGURATION

The Configuration tab enables us to configure every aspect of GFI Archiver:

Figure 20

Unfortunately it is not possible to cover everything, so here is a brief description of some of these options.

Archive Sources

• Archiving Method shows the Archiving Method currently enabled (what we configured in the post-installation wizard);
• Mail Servers to Archive shows the journal mailboxes configured for archiving;
• Archiving Rules, when enabled, allows us to configure rules that determine what gets archived and what does not;
• Archive Restrictions allows us to exclude certain mailboxes from archiving while including only specific ones:

Figure 21

• Archiving Scope define whether incoming, outgoing, or internal emails (or a combination) are archived;
• Mailbox Folder Structure Retrieval enables the replication of the folder structure of the mailboxes within Exchange with GFI Archiver.

Archive

• Archive Stores shows the number of Archive Stores configured and in use;
• Roles and Permissions allows us to assign roles to selected users to grant them the required permissions to access specific functions within GFI Archiver;
• Access Control defines who has access to which mailboxes;
• IMAP Server, when enabled, allows user to retrieve archived emails using supported IMAP email clients.

Policies

• Retention and Spam policies define the lifetime of an archive email within GFI Archiver. Emails matching specific criteria can be deleted immediately or after a specific period of time. For example, for Exchange 2013 environments, GFI Archiver creates a retention policy to not retain any probing emails from Managed Availability:

Figure 22

• File History Retention Policies define the length of time that an archived version of a file is retained in the Archive Store before it is deleted;
• Classification Rules automate the labeling of emails through policies (useful for legal reasons, for example, as already mentioned in the search section).
• Auditing shows and defines whether GFI Archiver Auditing is switched on or not. GFI Archiver database activity auditing uses the tracing capabilities of SQL Server to record all activity affecting the archive databases. Because of this, auditing cannot be enabled on Archive Stores based on GFI Archiver (Firebird) database and file system;
• Email Deletion, when enabled, allows users to permanently delete archived emails from mailboxes they have access to.

Importing Data

By now we have Exchange journaling every email in our Exchange environment and GFI Archiver archiving those same emails. But what about all those emails sent/received before we started journaling and archiving? GFI Archiver has several ways of ingesting historic data.

The first option is to use the Archive Assistant which allows us to import emails and calendar items automatically from users’ mailboxes. The following is the high level steps involved in this, which can be scheduled and made transparent to users:

1. Deploy the Archive Assistant on users’ machines (using a Group Policy for example);
2. Enable the Manual Archiving method (in case we want to allow users to manually archive emails);
3. From the Roles and Permissions area, ensure the user has the relevant permissions to archive (if step 2 is performed);
4. Configure the settings required to automatically import items from users’ mailboxes and delete them from Exchange if desired:

Figure 23

Figure 24

Using this method, the import is automatic and starts when Outlook is running on the client machine. If Outlook is closed during the import operation, it will automatically resume once Outlook is re-opened.

Another available option to administrators is the Import and Export Tool, through which we can extract emails and calendar items from various email databases or PST files and import them into the Archive Stores. For example, to export emails from Exchange mailboxes and import them into GFI Archiver:

1. Launch the Import and Export Tool;
2. Click Import from Microsoft Exchange mailbox:

Figure 25

3. Next, we select the source Exchange version which can be 2003, 2007, 2010, 2013 or Exchange Online, and configure a user with permissions to access the Exchange mailbox to import:

Figure 26

4. Then we choose if we want to export all mailboxes or just one (or more) mailbox. We can also restore individual folders:

Figure 27

5. Next we select to import emails into GFI Archiver, the cut-off time of emails to import and if we want to keep the original folder structure or not:

Figure 28

6. Once we click Next the export/import process starts:

Figure 29

Restoring Mailboxes and Emails

An archiving solution is simply no good if archived emails cannot be recovered. From an administrator perspective, GFI Archiver provides two tools in order to restore emails (excluding the GUI interface that can be used to recover individual emails as we have already seen). The first one, known as the Mailbox Restore tool provides us with the facility to restore emails archived within GFI Archiver Archive Stores to a mailbox in Exchange. These can be all emails from a particular mailbox or those between two given dates:

Figure 30

Assuming all the required permissions are in place, it is as simple as this to recover a vast number of emails from a GFI Archive (the term Restore from Mailbox is a bit misleading here) into an Exchange mailbox.

Using this same tool we can also extract emails from a GFI Archive into a PST file:

Figure 31

Our second option is the Import and Export Tool we already had a look at. This time, however, we use the Export Data from GFI Archiver option instead:

Figure 32

Through this tool, we can connect to a GFI Archiver installation and export an entire mailbox or search for specific emails that we want to recover/export (useful to export a set of emails that match specific search criteria, for example, to provide emails to satisfy a litigation support request):

Figure 33

We can then preview a list of the emails that will be recovered:

Figure 34

From this result list we can also review particular emails to check that they actually contain what we are looking for by double-clicking on the email to open them.

Once we are ready to proceed, we can export all of them in one go using the following options:

• Restore to a specific email address (either as attachments or as the original emails);
• Download to a folder on disk in .eml or .msg format;
• Download to a PST file (requires Outlook installed).

Figure 35

A final window will provide us with some statistics regarding the export process:

Figure 36

Simple as that!

Reports

GFI Archiver provides several amazing reports through its MailInsights reporting feature. These reports, which can be created on demand or scheduled, can help organizations identify business issues, potential security breaches or legal risks by extracting data from archived emails. There are many reports available and, unfortunately, I simply cannot cover them all so here is an overview of some of them:

Communication Flow monitors user/group communication patterns inside and outside the organization:

Figure 37

WebMail Use identifies top users exchanging emails with free web-based email providers such as Gmail, Hotmail and Yahoo!;

Email Responsiveness shows the average time it takes users to reply to internal and external email:

Figure 38

Storage Use shows what is being stored in the archive by everyone or particular users. We can use this report to alert users and to create appropriate retention policies:

Figure 39

Inappropriate Words tracks inappropriate language in email that violates company policy;

Internal Spammers finds out which internal users tend to include too many recipients in the To/CC/BCC fields;

Outside Office Hours returns a list of internal mail accounts with sending activity outside office hours (useful to spot behavior which may need more investigation);

Data Leakage Detection identifies emails with major credit card numbers and US Social Security numbers, or other confidential documents and information;

Job Search identifies sent or received emails that contain resumes, or are addressed to job search sites:

Figure 40

User Traffic shows the number of emails exchanged between selected users or groups and their contacts:

Figure 41

Large Emails report identifies large emails that can be taking up unwanted space in the archive. Email attachments are classified according to specific categories.

End Users

Depending on what GFI Archiver is used for, there might be scenarios where end-users do not have access to an archive. For example, if GFI is only being used to archive everything out of Exchange for legal reasons. In this case, there is nothing else we need to do or configure.

However, it is likely that users will be given access to their archive. In this case, GFI Archiver supports a number of e-mail clients that use IMAP to transfer archived e-mail messages from the Archive Stores to the email client. Users are able to access their archived emails using one of the following supported email clients:

• Android email application;
• Apple Mail;
• iOS5 email application;
• Outlook 2003 or above;
• Outlook 2011 for Mac;
• Mozilla Thunderbird;
• Windows Live Mail.

Outlook Connector

GFI Archiver can also give users access to their old archived emails from within Outlook using Outlook Connector:

Figure 42

This plugin that synchronizes GFI Archiver with Outlook and enables users to see the email messages archived by GFI Archiver. Archived emails are displayed in Outlook in an organized folder structure, identical to that in the user’s mailbox:

Figure 43

When Outlook Connector is installed, it will automatically register itself in Outlook, which will automatically attempt to connect to GFI Archiver using the URL specified during installation. Synchronization with GFI Archiver takes place automatically at a specified time interval, or manually using the Outlook Connector status toolbar. The toolbar displayed in the first screenshot shows the status of synchronization with the GFI Archiver server.

Archive Assistant

The Archive Assistant enables users to manually archive emails, calendar items and files (such as documents or images) from Outlook (if users are allowed to manually archive):

Figure 44

From within Outlook, a user can select an email, a group of emails, calendar item(s) or a folder within Outlook, and use the archive buttons in the toolbar (above) that is installed when Archive Assistant is deployed. The Archive Assistant then initiates a request to synchronize the selected items with GFI Archiver.

Both these plugins can be installed through GPOs or downloaded by users from the GFI Archiver web interface:

Figure 45

Remote Access

Another method or users accessing their archived data, is using the GFI Archiver web user interface:

Figure 46

Using this interface, users can search or navigate their archive, read emails and restore data.

Obviously, for external users to access either the GFI Archiver UI or the Outlook Connector, we need to configure the firewall to allow external access to the internal GFI Archiver URL.

Office 365

GFI Archiver can also be configured to archive email from Exchange Online. This can be done in one of two ways:

• Using a Mail flow – BCC the message to rule – GFI Archiver uses a dedicated mailbox configured in Exchange Online to act as a journaling mailbox and archives all emails copied to this mailbox. This is possible by setting a rule in Exchange Online to BCC all incoming and outgoing emails to this mailbox. GFI Archiver connects to this mailbox to monitor new emails and transfers them to the archive store database;
• Using a Journaling rule and an external journal mailbox – since Exchange Online currently does not support journaling to another Exchange Online mailbox (only to an external recipient), we can set up journaling to an external email account and configure GFI Archiver to connect to that account in order to capture emails for archiving.

While the first option can be used with a “journal” mailbox within Microsoft Office 365 or with an external one, this method does not capture BCC information. On the other hand, the second method captures BCC information but requires an external journal mailbox which must be accessible via IMAP by GFI Archiver.

Configuring GFI Archiver to connect to Office 365 is straightforward and can be done using Exchange Web Services:

Figure 47

After this, the entire process is identical to on-premises archiving.

Final Thoughts

GFI Archiver is without a doubt a great product. Not only does it provide everything most organizations need in terms of archiving capabilities for a variety of systems, as it goes beyond and provides additional features such as useful reports.

MSExchange.org Rating 4.7/5

Learn more about GFI Archiver or download a free trial.