Enterprise Vault: archiving enveloped journal reports.

[zubkoff_s]

Hello everybody.

We encounter some specific issue in our environment: legal team complains that during DA investigations they get from time to time duplicated results, but these results are not similar:

1-st result: standard email (as we get used to see usually)

2-nd result: enveloped email (enveloped journal report, as we see in journal mailbox).

I am pretty sure that some 3-rd party application on our side duplicates journal report somehow, but I don’t understand why EV doesn’t process the second journal report in the similar way as the first one.

We know that by default EV deletes envelop from journal report and archives only original message, and that particular message we see afterwards in archive(DA), but not enveloped message.

What I don’t know personally is how EV recognize that item in journal mailbox must be first unwrapped(deleted envelope) and archived afterwards. Interesting case, if I move manually standard email (not enveloped) to journal mailbox then it will be archived at it is. So, EV knows somehow that there is nothing to delete (envelope isn’t exist). But when EV processed journal reports it recognize and delete journal envelope.

I thought that probably EV uses message classes to distinguish standard email from enveloped journal report, but I found that all journal reports have IPM.Note classe (Email message).

Q1: How does EV recognize that item in journal report is enveloped journal report?

Q2: Any ideas how to create (artificially) double envelope?  I’d like to know how EV processes journal item in this case. Will it remove only first envelope only, or EV will remove envelopes until it find standard message? I am speaking about JOURNAL REPORT [JOURNAL REPORT [MESSAGE]].

Thanks  a lot. 

[zubkoff_s]

BTW, i was trying to do doubled journaling in the following way, (with Exchange):  

"All messages for JournalMailbox1 must be journaled in JournalMailbox2". So, it doesn't work for journal reports, but it works if I send item directly to JournalMailbox1. 

Exchange smarter than I thought. :))

[AndrewB]

did you need anything from us?

[zubkoff_s]

Hi Andrew. 

Yeah, I need. 

I'd be really appreciate if you explain me how EV deletes jounral report (envelope\wrapper) and archives only original email (from attachment)? What does EV use to recognise that journal message is in envelope, and envelope must be deleted first (or during archiving)?

Is it possible to archive enveloped jounral report AS IT IS? 

Thanks. 

[AndrewB]

yes, two things: first, the journal mailbox is configured as a target in EV. second, the journal archiving task performs the archiving.

what reason do you have to archive a journaled email "as is" ?

what you're seeing in terms of duplicates could be that you have the same items archived from the journal and from user mailboxes. you can dedupe within DA or you can just search the journal mailbox (if you know that the users' mailboxes don't have unique items that weren't journaled.)

[zubkoff_s]

Hi. Sorry for the late responce. had not got reminder about acitivities in this thread. 

Unfortunatelly you assumption is wrong. Searching via DA is done in journaling archives only. 

DA brings back 2 results for each search: 

1. Original Email. 

2. Enveloped Email. 

I'd be happy with fully duplicated result even, when I'd have just duplicated items, which is completelly similar. This case much easier for investigation. But I have original email & eveloped email with original email( journal report). 

Looks like my Journal Mailbox has 2 journal reports for the same IM conversation. But why first journal mailbox is processed as usually (remove envelop, archive original item), but the second journal reports is archived as it is? What the difference between reports, or better to say: 

Unfortunatelly it doesn't bring me nearer: 

"...the journal mailbox is configured as a target in EV. second, the journal archiving task performs the archiving."

Q: What missed in the second journal report that EV archives journal report as it is, but not an original email only, as usually? 

or

Q: What does EV use (attirute, class, etc) to determine that envelope exists and must be removed before archiving? 

Thanks.