Exchange 2010 Litigation Hold

[StevenJackson]

The environment in question is EV 10.4 and Exchange 2010 SP3.

For our mailboxes on litigation hold, the Versions folder in the Exchange dumpster is growing to excessive size especially for mailboxes recently enabled for archiving.  It's my understanding that when the archiving task runs, the items applicable to the policy are actually edited to make a shortcut.  When a mailbox is on litigation hold, editing an item results in a copy kept in the versions folder.  This results in every item archived being also stored in the versions folder of the Exchange dumpster.  We have the ability to purge the versions folders by means of a script.  Our concern is if an item was legitimately edited for whatever purpose, that edit will be lost.  We could use a similar means to export the versions folder then import it into EV to recover space but in theory that will duplicate every item in the user’s archive and the these items may be visible to the user.  All things considered, I believe we have two options while an associate is on legal hold.  Exclude them from archiving (likely they will wonder why archiving has stopped) or we could routinely purge their versions folders but risk deleting a legitimately edited item.  Another thought is to not create shortcuts at all but that removes the seamless aspect of EV in the mailboxes.  Advice is greatly appreciated!

[Rob_Wilcox1]

Have you tried discussing this issue with SYMC Support?

[StevenJackson]

Thank you for your reply Rob.  Yes, we were advised this was a Microsoft issue which I understand but the edits by the archiving task cause the Versions increase.  I'm seeking how other companies are handling this.  Here is an example dumpster of an associate on litigation hold.

contoso.com/Users/Smith, Jim\Recoverable Items  36.00 GB
contoso.com/Users/Smith, Jim\Deletions          5.00 MB
contoso.com/Users/Smith, Jim\Purges             1.00 GB
contoso.com/Users/Smith, Jim\Versions           30.00 GB

Now what do we do with the unnecessary Versions items clogging the database and how do we prevent this from happening in the future?

[WiTSend · Accepted solution]

I handle Legal Hold a different way. 

1.  I capture a copy of their current mailbox into the archives

2.  Disable deletion from the associated archives

3.  If an ongoing case with requirement to capture future emails I add them to a small Exchange Journal policy and use Journal archiving to capture future emails.

I dont' user Exchanges LegalHold processes at all.

[StevenJackson]

Thank you for the reply WiTSend.  I like your process for legal hold which resolves the versioning issue.  Our only concern is that if an email not archived is edited.  With litigation hold, the original is placed into the versions folder.  Perhaps it's not an issue with journaling enabled.

For anyone interested, we used the Search-Mailbox cmdlet with -SearchDumpsterOnly parameter and placed this data into a DiscoveryDatabase.  This data will be exported to PST and then imported into Enterprise Vault for safe keeping.  Meanwhile we're considering our options.

Is there any way to change the shortcut behavior so Exchange does not see it as an "edit".

Is the best practice simply not to use Exchange's litigation hold?

[JesusWept3 · Accepted solution]

Everything EV does will always be an edit
And it really depends on what you are using EV for, Mailbox Management or Compliance?
Compliance should really be accomplished via exchange journaling, but obviously edits won't be caught by Exchange Journaling or what not.

Unfortunately its the way that the product, and actually almost every other archiving product works, especially those dealing with stubs, it a "choose your poison" type of situation unfortunately

[StevenJackson]

Thanks for the reply JesusWept3.  We're intended EV for Mailbox Management to leverage less expensive storage and data deduplication while maintaining our 15k rpm disk for the primary tier.  From a legal perspective, we now have two places to hold and prevent any destruction of mailbox data.  With Exchange Journaling we have the email and meeting transactions but what about other calendar items and contacts?  The archived items in EV and the unarchived items in Exchange are the unaltered versions of messages.