Enterprise Vault Whitepaper Enterprise Vault Non-Technical Overview This document is to provide a non-technical explanation on Symantec Enterprise Vault for use by Management or Legal Council If you have any feedback or questions about this document please email them to
[email protected] stating the document title. This document applies to the following version(s) of Enterprise Vault: All
This document is provided for informational purposes only. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2011 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Enterprise Vault are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners
Enterprise Vault Whitepaper – Non Technical Overview
Document Control Contributors Who
Contribution
Liam Finn
Author
Revision History Version
Date
Changes
A01
10/07/2011
Initial Document Creation
Related Documents Version
Date
Title
Table of Contents Definitions
1
Journal Mailbox
1
Enterprise Vault Journaling
1
Enterprise Vault Public Folder Archiving
1
Enterprise Vault File System Archiving
1
Enterprise Vault Mailbox Archiving
1
Discovery Accelerator
1
Email
1
Retention
1
E-mail Journaling
1
Definition
1
Email Journal Process
2
Email Journal Process for Lotus Domino
2
Envelope Journaling
2
Mailbox Archiving
2
Definition
2 i
Enterprise Vault Whitepaper – Non Technical Overview
Mailbox Archiving Process
2
Scheduled Mailbox Archiving
2
Manual Mailbox Archiving
3
Mailbox Archiving Shortcuts
3
Virtual Vault
3
Public Folder Archiving
3
Definition
3
Public Folder Archiving Process
3
File System Archiving
3
Definition
3
File System Archiving Process
3
File Blocking
4
File Reporting
4
Microsoft SharePoint Archiving
4
Definition
4
SharePoint Archiving Process
4
Legal Discovery (eDiscovery)
4
Definition
4
E-Discovery Process
4
Export
5
Production
5
Legal Hold
5
Appendices APPENDIX A - List of file types that can be indexed
ii
Enterprise Vault Whitepaper – Non Technical Overview
Definitions Journal Mailbox A mailbox that is in its own mail store specifically created to accept all email that is being Journaled from other user mailboxes.
Enterprise Vault Journaling The function that archives email from a “Journal Mailbox”. The Journal mailbox is a central repository for all email accounts being Journaled. See section “Email Journal Process” for details
Enterprise Vault Public Folder Archiving This is the process of archiving all data stored in MS Exchange Public Folders. See “Public Folder Archiving Process” for more details
Enterprise Vault File System Archiving This is the process where files stored on file server or in NAS File storage devices are ingested into the archive. See “File System Archiving Process ” for more details
Enterprise Vault Mailbox Archiving This is the process where Enterprise Vault can archive emails directly from end users mailboxes and store the archived email in a Vault Store for that specific user.
Discovery Accelerator This application is used to perform searches on the data within the archive. See “Legal Discovery” for details.
Email A system for sending and receiving messages electronically over a computer network. E-mail is asynchronous and does not require the receiver of the message to be online at the time the message is sent or received. E-mail also allows a user to distribute messages to large numbers of recipients instantaneously
Retention When data is archived by Enterprise Vault the data is assigned a retention category which states how long the data is to be retained by the archive system after which the data is deleted
E-mail Journaling Definition A function within the server side of email system to send a copy of any e-mail based message that is either transmitted or received to or from a mailbox to another mailbox “Journal Mailbox” 1
Enterprise Vault Whitepaper – Non Technical Overview
Email Journal Process When the journaling option is enabled on a Microsoft Exchange server Mail store, the Exchange message categorizer transmits a copy of all messages sent or received by the Exchange mailbox which is part of the Mail Store to a single journal mailbox in real time. To archive Journaled messages, an Enterprise Vault Exchange Journaling task archives the emails from the Journal mailbox, processes the items according to archiving policies, then passes the items to both the Storage and Indexing services and stores the items in the journal archive. When the messages are processed by the indexing service the email and its attachments are converted to either html or text from which the index is created and written to disk. The storage service prepares the email and it’s attachments to be stored then writes them to the storage medium. Journaling provides a way to capture all incoming and outgoing email bypassing the ability for end users to delete the emails or making which in effect ensures chain of custody tracking and validity of the content.
Email Journal Process for Lotus Domino Journaling of Lotus Domino is very similar to the Journaling of Microsoft Exchange as outlined above.
Envelope Journaling This involves capturing all of the available recipients including Carbon Copy (CC), Blind Carbon Copy (BCC), From and To. It also involves capturing all members of a distribution group and capturing reports including delivery receipts, read receipts and out of the office notifications E-mail Metadata retained in the archive adheres to but not limited to the “STANDARD FOR THE FORMAT OF ARPA INTERNET TEXT MESSAGES,” as published in August, 1982. More familiarly known as RFC 822, this standard describes twenty-five fields that Internet emails may contain. The full text of this RFC may be found at http://www.faqs.org/rfcs/rfc822.html Only messages/attachments that are listed in Appendix A are indexed and its contents searchable Attachments /file types other than those listed in Appendix A are not indexed but are searchable by file name and metadata but not content
Mailbox Archiving Definition A storage area where electronic mail can be delivered it is similar to a post box for regular mail. The content of these mailboxes can be ingested into the archive system for later retrieval by a user
Mailbox Archiving Process Scheduled Mailbox Archiving The Mailbox archiving task which operates on a schedule set by the EV Administrator makes a connection to the user’s mailbox using Messaging Application Programming Interface (MAPI) for Microsoft Exchange and using Enterprise Vault Domino gateway (EVDG) for Lotus Domino. It then analyzes the messages in the mailbox and compares them to the Mailbox Archiving Policies that have been defined by the EV Administrator. Any message matching the Mailbox Archive Policies are then archived in accordance with those policies and in accordance with any retention categories that apply to that user’s mailbox. The same storage and indexing processes as outlined in the Email Journaling Archiving are used in the mailbox archiving process. 2
Enterprise Vault Whitepaper – Non Technical Overview
Manual Mailbox Archiving This is similar to the scheduled mailbox archiving with the exception that this is user initiated instead of being archived on a schedule. The end user selects the emails and using the features added to the email client by Enterprise Vault, they manually initiate archiving. The same storage and indexing processes as outlined in the Email Journaling Archiving is used in the mailbox archiving process. Mailbox archiving can be used to enforce corporate email retention policies by expiring emails from user mailboxes in accordance to corporate policies
Mailbox Archiving Shortcuts Emails that are archived have, depending on Archiving policy settings, the ability to be replaced by a shortcut. These shortcuts can be used like a normal mail item to access the archived item. The shortcut looks like a standard message in the inbox but with a Vault icon associated with it instead of the standard envelope icon. This saves storage space on email servers by archiving the email and replacing the email with a 4k shortcut
Virtual Vault Virtual Vault provides the end user an interface that looks just like an MS Outlook Personal Folder (PST). This gives the user the ability to move messages between their mailbox and archive and vice versa without having to learn a completely new user interface, it can be done via Drag and Drop
Public Folder Archiving Definition A public folder is a folder created to share information with others. Access to the public folder can be restricted so that only a select group of users have access to the folder, or the folder can be made available to all users on the network who uses the same mail client. Public folders can be used to store contacts, calendar items, messages, journal entries, or Outlook Forms.
Public Folder Archiving Process To archive the contents of an Exchange Public Folder the Enterprise Vault Public Folder Archiving task connects to the Exchange server that houses the public folder and lists of any changes made in the public folder since last archive run. It then processes the contents against the Public Folder Archiving policies and archives the necessary items. Depending on the policy settings the ability to replace archived items with shortcuts is available
File System Archiving Definition The ability to archive files from a server so as the files and content are searchable and retrievable from the archive
File System Archiving Process The archiving task accesses the data via shares on the selected file servers or storage device. It compiles a list of all files and checks that list against the FSA archiving policies on the archiving server. 3
Enterprise Vault Whitepaper – Non Technical Overview
Any file found on the file server that meets the FSA archiving policy are then archived and depending on the Archiving requirements may be replaced with a placeholder. Only Items listed in Appendix A are indexed and its contents searchable
File Blocking This is a feature of Enterprise Vault that allows the EV administrator to either warn users about saving files of a specific file extension or block files of a specific extension from being written to the file server. This can be used to prevent the saving of prohibited files to your corporate file servers such as movies, audio and .pst files.
File Reporting Provides reports to the EV Administrator on the files contained on the file servers. These reports provide information to assist the identification of items needing to be archived and also identify any file types that may need to be blocked in the future.
Microsoft SharePoint Archiving Definition SharePoint is a web based application portal that is capable of provisioning websites, documentation management portals, social networking environments and much more Enterprise Vault has the ability to archive the content within the SharePoint environment
SharePoint Archiving Process SharePoint archiving is performed by leveraging the Microsoft webparts API for SharePoint. This provides EV the ability to access files or content stored in the SharePoint Database or stored on file shares referenced from SharePoint. SharePoint archiving also offers shortcutting of items in the SharePoint server which replaces the file on SharePoint. This shortcut looks no different to the end user except that the size of the file will show as 1K instead of the original file size.
Legal Discovery (eDiscovery) Definition The collection, preparation, review and production of electronic documents in litigation discovery. This includes e-mail, attachments, and other data stored on a computer, network, backup or other storage media. eDiscovery includes metadata
E-Discovery Process The Discovery Accelerator user creates a case which is used to organize any searches related to the matter. The user then creates a search specifying the archives they wish to query. On completion of the search the user would then review the results to ensure the returned results are pertinent to the case after which they would accept the search. When the search is accepted the items are added to the case review set which is the list of items that the reviewers can look at. A designated reviewer can then review the items and mark them as required. Items marked as relevant can then be produced or exported into either the original file format as in files from file servers or as PST files when dealing with email messages 4
Enterprise Vault Whitepaper – Non Technical Overview
Export This enables the items to be viewed outside Discovery Accelerator before the review process is complete. Exporting items does not cause the item to be locked so reviewers can continue to work on them.
Production Once an item is produced it is locked in Discovery Accelerator and the marks assigned to the items cannot be changed.
Legal Hold This is the ability to prevent deletion of any items discovered within a case. Only when legal hold is removed from the items can it be deleted from the archive. One item can have multiple holds in place and until all holds are removed the item is retained in the archive
5
APPENDIX A – List of file types that can be Indexed Word Processing Generic Text ANSI Text 7 and 8 bit, ASCII Text 7 and 8 bit, EBCDIC All versions, HTML Through 3.0 (some limitations). IBM FFT All versions, IBM Revisable Form Text All versions, Microsoft Rich Text Format (RTF) All versions, Text Mail (MIME) No specific version, Unicode Text All versions, WML Version 5.2 XML No specific version, DOS Word Processors DEC WPS Plus (DX) Through 4.0, DEC WPS Plus (WPL) Through 4.1, DisplayWrite 2 and 3 (TXT) All versions, DisplayWrite 4 and 5 Through Release 2.0, Enable 3.0, 4.0, and 4.5, First Choice Through 3.0, Framework 3.0, IBM Writing Assistant 1.01, Lotus Manuscript Version 2.0, MASS11 Versions through 8.0, Microsoft Word Versions through 6.0, 1 Clean Content supports Microsoft Office Word, Excel and PowerPoint versions 97 – 2003. Microsoft Works Versions through 2.0, MultiMate Versions through 4.0, Navy DIF All versions, Nota Bene Version 3.0, Novell WordPerfect Versions through 6.1, Office Writer Versions 4.0 through 6.0, PC-File Letter Versions through 5.0, PC-File+ Letter Versions through 3.0, PFS:Write Versions A, B, and C, Professional Write Versions through 2.1, Q&A Version 2.0, Samna Word IV+ Versions through Samna Word, SmartWare II Version 1.02, Sprint Versions through 1.0, Total Word Version 1.2, Volkswriter 3 and 4 Versions through 1.0, Wang PC (IWP) Versions through 2.6, WordMARC Plus Versions through Composer, WordStar Versions through 7.0, WordStar 2000 Versions through 3.0, XyWrite Versions through III Plus, Windows Word Processors Adobe FrameMaker (MIF) Version 6.0, Hangul Version 97, 2002, JustSystems Ichitaro Versions 5.0, 6.0, 8.0–13.0, 2004, JustWrite Versions through 3.0, Legacy Versions through 1.1, Lotus AMI/AMI Professional Versions through 3.1, Lotus Word Pro Millenium Versions 96 through, Edition 9.6, text only, Microsoft Write Versions through 3.0, Microsoft Word Versions through 2007, Microsoft WordPad All versions, Microsoft Works Versions through 4.0, Novell Perfect Works Version 2.0, Novell/Corel WordPerfect Versions through 12.0, X3, OpenOffice Writer (Windows and Linux) Versions 1.1, 2.0, Professional Write Plus Version 1.0, Q&A Write Version 3.0, StarOffice Writer Versions 5.2, 6.x, 7.x, and 8.0, WordStar Version 1.0, Mac Word Processors MacWrite II Version 1.1, Microsoft Word (Mac) 2004 Versions 3.0–4.0, 98, 2001, Microsoft Works (Mac) Versions through 2.0, Novell WordPerfect Versions 1.02 through 3.0, Outside In Technology File Format Listing: Spreadsheets Enable Versions 3.0, 4.0, and 4.5, First Choice Versions through 3.0, Framework Version 3.0, Lotus 1-2-3 (DOS and Windows) Versions through 5.0, Lotus 1-2-3 (OS/2) Versions through 2.0, Lotus 1-23 Charts (DOS and Windows) Versions through 5.0, Lotus 1-2-3 for SmartSuite Versions 97– Millennium 9.6, Lotus Symphony Versions 1.0, 1.1, and 2.0, Microsoft Excel Charts Versions 2.x–7.0, Microsoft Excel (Mac) Versions 3.0–4.0, 98, 2001, 2004, Microsoft Excel (Windows) Versions 2.2 through 2007, Microsoft MultiPlan Version 4.0, Microsoft Works (Windows) Versions through 4.0, Microsoft Works (DOS) Versions through 2.0, Microsoft Works (Mac) Versions through 2.0, Mosaic Twin Version 2.5, Novell Perfect Works Version 2.0, OpenOffice Calc Versions 1.1, 2.0 (text only), PFS: Professional Plan Version 1.0, Quattro Pro (DOS) Versions through 5.0, Quattro Pro (Windows) Versions through 12.0, X3, SmartWare II Version 1.02, StarOffice Calc (text only) Versions 5.2, 6.x, 7.x, and 8.0, SuperCalc 5 Version 4.0, VP Planner 3D Version 1.0, Outside In Technology File Format Listing: Presentations Corel/Novell Presentations Versions through 12.0, X3, Harvard Graphics for DOS Versions 2.x and 3.x, Harvard Graphics (Windows) Windows versions, Freelance (Windows) 9.6 Versions through
Millennium, Freelance for OS/2 Versions through 2.0, Microsoft PowerPoint (Windows) Versions 3.0 through 2007, Microsoft PowerPoint (Mac) 2004 Versions 4.0 through 2001, OpenOffice Impress Versions 1.1, 2.0, StarOffice Impress Versions 5.2, 6.x, 7.x, and 8.0 Graphics Adobe Photoshop (PSD) Version 4.0, Adobe Illustrator Versions through 7.0, 9.0, Adobe FrameMaker graphics (FMV) Vector/raster through 5.0, Adobe Acrobat (PDF) Versions 2.1, 3.0–7.0, Japanese, Ami Draw (SDW) Ami Draw, AutoCAD Drawing 2000i Versions 2.5–2.6, 9.0–14.0,and 2002, AutoCAD Drawing Versions 2004 and 2005 (text), AutoShade Rendering (RND) Version 2.0, Binary Group 3 Fax All versions, Bitmap (BMP, RLE, ICO, CUR,, OS/2 DIB, and WARP) All versions, CALS Raster (GP4) Type I and Type II, Corel Clipart format (CMX) Versions 5 through 6, Corel Draw (CDR) Versions 3.x–8.x, Corel Draw (CDR with TIFF header) Versions 2.x–9.x, Computer Graphics Metafile (CGM) ANSI, CALS NIST version 3.0, Encapsulated PostScript (EPS) TIFF header only, GEM Paint (IMG) No specific version, Graphics Environment Mgr (GEM) Bitmap and vector, Graphics Interchange Format (GIF) No specific version, Hewlett-Packard Graphics Language (HPGL) Version 2, IBM Graphics Data Format (GDF) Version 1.0, IBM Picture Interchange Format (PIF) Version 1.0, Initial Graphics Exchange Spec (IGES) Version 5.1, JFIF (JPEG not in TIFF format) All versions, JPEG (including EXIF) All versions, Kodak Flash Pix (FPX) All versions, Kodak Photo CD (PCD) Version 1.0, Lotus PIC All versions, Lotus Snapshot All versions, Macintosh PICT1 and PICT2 Bitmap only, MacPaint (PNTG) No specific version, Micrografx Draw (DRW) Versions through 4.0, Micrografx Designer (DRW) Versions through 3.1, Micrografx Designer (DSF) Windows 95, version 6.0, Novell PerfectWorks (Draw) Version 2.0, OpenOffice Draw Versions 1.1 2.0 (text only), OS/2 PM Metafile (MET) Version 3.0, Paint Shop Pro 6 (PSP) Windows only, versions 5.0–6.0, PC Paintbrush (PCX and DCX) All versions, Portable Bitmap (PBM) All versions, Portable Graymap (PGM) No specific version, Portable Network Graphics (PNG) Version 1.0, Portable Pixmap (PPM) No specific version, PostScript (PS) Level II, Progressive JPEG No specific version, Sun Raster (SRS) No specific version, Star Office Draw 5.2, 6.x, 7.x, and 8.0 (text only), TIFF Versions through 6, TIFF CCITT Groups 3 and 4 Versions through 6, Truevision TGA (TARGA) Version 2, Visio (preview) Version 4, Visio 2003 Versions 5, 2000, 2002,, WBMP No specific version, Windows Enhanced Metafile (EMF) No specific version. Windows Metafile (WMF) No specific version, WordPerfect Graphics (WPG and WPG2) Versions through 2.0, 7, and 10, X-Windows Bitmap (XBM) x10 compatible, X-Windows Dump (XWD) x10 compatible, X-Windows Pixmap (XPM) x10 compatible Compressed Formats Gzip All versions, LZA Self Extracting Compress All versions, LZH Compress All versions, Microsoft Binder Versions 7.0–97, (conversion supported only on Windows), MIME Text Mail, UUEncode, UNIX Compress, UNIX TAR, ZIP PKWARE versions through 2.04g Database Access Versions through 2.0, dBASE Versions through 5.0, DataEase Version 4.x, dBXL Version 1.3, Enable Versions 3.0, 4.0, and 4.5, First Choice Versions through 3.0, FoxBase Version 2.1, Framework Version 3.0, Microsoft Works (Windows) Versions through 4.0, Microsoft Works (DOS) Versions through 2.0, Microsoft Works (Mac) Versions through 2.0, Paradox (DOS) Versions through 4.0, Paradox (Windows) Versions through 1.0, Personal R:BASE Version 1.0, R:BASE 5000 Versions through 3.1, R:BASE System V Version 1.0, Reflex Version 2.0, Q & A Versions through 2.0, SmartWare II Version 1.02 Other Formats Executable (EXE, DLL), Executable (Windows) NT, EXIF Metadata extraction only, Macromedia Flash Text only, Microsoft Outlook Express (EML) Versions 97–2003, Microsoft Outlook Folder (PST) Versions 97–2007, Microsoft Outlook Form Template (OFT) Versions 97–2003, Microsoft Outlook Message (MSG) All versions, Microsoft Outlook Offline Folder (OST) Versions 97–2003, Microsoft Project Versions 98–2003 (text only), MP3 ID3 metadata only, vCard Version 2.1, Yahoo! Instant Messenger Archive No specific version
About Symantec: Symantec is a global leader in providing storage, security and systems management solutions to help consumers and organizations secure and manage their information-driven world. Our software and services protect against more risks at more points, more completely and efficiently, enabling confidence wherever information is used or stored.
For specific country offices and
Symantec Corporation
contact numbers, please visit our
World Headquarters
Web site: www.symantec.com
350 Ellis Street Mountain View, CA 94043 USA +1 (650) 527 8000 +1 (800) 721 3934
Copyright © 2011 Symantec Corporation. All rights reserved. Symantec and the Symantec logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.
