Hey all, I have an update from Symantec. I'm actually pretty surprised that there aren't more discussions about this since it seems pretty darn important for compliancy purposes. I'd like to know what form of Journaling others are running.
Here's the clip from Support...
Hello, I am contacting you regarding this open case. Here is information from our backline regarding BCC journaling vs envelope journaling.
In all of my lab tests, the BCC recipient list is available to search as TO: when using JournalBCC registry key and envelope journaling is off. My tests are conducted with Compliance and Discovery searches. CA and DA treat TO; CC: and BCC: as 'TO:' when searching.
Envelope on the other hand, will capture the BCC as Undisclosed recipients and are not searchable as normal TO recipients in Search.asp. They are not searchable in CA DA under any circumstance that I am currently aware of.
You had also asked for further questions be answered:
Using BCC Journaling: If the CEO gets an email from person (internal (using the GAL)) sending out client info to a Distribution List that is sent on the BCC line, when compliance searches the mail of the CEO, they will see the recipients in the body of the message?
1) Yes
Using BCC Journaling: If the CEO gets an email from person (external) sending out client info to a Distribution List that is sent on the BCC line, when compliance searches the mail of the CEO, they will see the DL but will NOT see the recipients in the body of the message because it was an externally created DL. Correct?
2) When they send to an external distribution list, the local exchange server does not know it is a distribution list and will treat it as a regular email address, thus he will only be able to search on the DL and not the people within the DL regardless if it is TO FROM or BCC.
Please let me know if you have any further questions regarding this case "How does EV handle BCC'd messages?"
Thanks,
PM.