If you would like to read the other parts in this article series please go to:
- Exchange 2013 In-Place Hold and In-Place eDiscovery (Part 2)
- Exchange 2013 In-Place Hold and In-Place eDiscovery (Part 3)
Introduction
E-mail has become one of the most important forms of communication for information workers in organizations of all sizes. Messaging stores and mailboxes have become repositories of valuable data. It is important for organizations to formalize messaging policies that dictate the fair use of messaging systems, provide user guidelines for how to act on the policies, and where required, provide details about the types of communication that may not be allowed.
Organizations must also create policies to manage e-mail lifecycle, retain messages for the length of time based on business, legal and regulatory requirements, preserve e-mail records for litigation and investigation purposes, and be prepared to search and provide the required email records to fulfill eDiscovery requests.
Leakage of sensitive information such as intellectual property, business plans or personally identifiable information must also be protected.
The following table provides an overview of the messaging policy and compliance features in Exchange 2013:
Feature | Description |
Messaging Records Management (MRM) | To meet legal or business requirements, organizations include e-mail lifecycle policies as part of their messaging policy. Exchange 2013 includes MRM features that allow administrators to implement organization’s e-mail lifecycle policies. |
MRM can be used to apply uniform retention settings to all messages, or to allow users to classify messages so that they can be retained for a specified duration.
Table 1
Immutability of data is another key feature of any messaging and archiving product and the way Exchange treats immutability is slightly different from other products. Traditionally, immutability was associated with WORM storage that would guarantee that the data could not be tampered with once it was written to disk. In Exchange, this is all done at the software level using the In-Place Archive feature, and is fully independent from the storage used.
Exchange 2013 also introduced improvements to In-Place Hold (previously known as Litigation Hold) and In-Place eDiscovery (previously called Multi-Mailbox Search) in order to help organizations meet their compliance needs. These two features are what we will be covering in this article series, with Rights Management covered in a future article. Note that practically all other topics have already been covered here at MSExchange.org.
In-Place Hold
If an organization is involved in a legal action, it may have to take steps to preserve relevant data, such as e-mail messages, that may be used as evidence. In situations like this, administrators may have to retain all e-mails sent and received by specific people or by the entire organization for a specific period of time. The purpose of In-Place Hold is to address this and preserve mailbox items that need to be held, without having to move them to a separate repository. In-Place Hold prevents the destruction or alteration of evidence which could have a catastrophic impact on the defense or accusation, and could expose the organization to legal and financial risks.
With Exchange 2013, administrators can now easily define policies that specify whether items should be preserved indefinitely, according to their age, or based on keyword contents. Once an item is identified as the target of a hold, Exchange performs copy-on-write operations to preserve both the original item and all changes made to it.
While in Exchange 2010, administrators could only either hold all mailbox data indefinitely or until the hold was removed, in Exchange 2013 In-Place Hold allows administrators to specify what to hold and for how long to hold it for. This allows administrators to create granular hold policies to preserve mailbox items in the following scenarios:
- Indefinite In-Place Hold is similar to litigation hold in Exchange 2010 as it is intended to preserve all mailbox items indefinitely, during which period items are never deleted;
- Query-based In-Place Hold preserves items based on specified query parameters such as keywords, senders and recipients, start and end dates, and also item types such as e-mails, calendar items, etc. After a query-based In-Place Hold is created, all existing and future mailbox items (including e-mails received at a later date) that match the query parameters are preserved. Note that a query-based hold cannot be used to place unsearchable items on hold (items that could not be indexed by Exchange Search);
- Time-based In-Place Hold allows administrators to specify an exact duration of time to hold items for. The duration is calculated from the date a mailbox item is received or created. For example, if a mailbox is placed on a time-based hold with a retention period of 365 days and an e-mail is deleted after 300 days from the date it was received, it is held for an additional 65 days before being permanently deleted;
- Multiple holds – place a user on multiple holds to meet different case requirements. In this scenario, search parameters of all In-Place Holds are applied together using an OR operator. If a mailbox is placed on more than five holds, all items are held until the holds are removed, replicating the indefinite hold behavior until the number of holds on the mailbox is reduced to five or less.
Preserving Lync Content
Exchange 2013, Lync 2013 and SharePoint 2013 provide an integrated preservation and eDiscovery experience that allows administrators to preserve and search items across the different data stores. As such, Exchange 2013 allows the archive of Lync 2013 content in Exchange, removing the requirement of having a separate SQL Server database to store archived Lync content.
When placing a mailbox on In-Place Hold, Lync content (such as instant messaging conversations and files shared in online meetings) are archived in the mailbox. Searching the mailbox using the eDiscovery Center in SharePoint 2013 or In-Place eDiscovery in Exchange 2013, any archived Lync content matching the search query is also returned.
To enable archiving of Lync 2013 content in Exchange 2013, administrators must configure Lync integration with Exchange.
Conclusion
In the first part of this article series, we introduced In-Place Hold and its main differences when compared to Litigation Hold in Exchange 2010. In the next article, we will go through placing mailboxes on In-Place Hold.
If you would like to read the other parts in this article series please go to: