Restoring corrupted emails from old archive

[dc281180]

Hi there,

The only requirement which we have recieved, as of current, from our client is that, they need that email data be retained for 6 years. As per current plans, we intend to deploy Enterprise vault for our archiving solution.

My query in this regards is, 

a) if we discover something that had previously been archived, and is now corrupt, how do we restore it.
b) As per archive policy (which has not yet been specified) , I presume we would keep our data active on the EV server for say 30 days. Is there a way that Symantec Enterprise vault, during archiving the email, informs us that, "this email or these emails have not been archived properly".

c) Post 30 days, if we move our archives to NAS at a different location, using our backup solution. During this movement, if an email gets corrupted, and the same email is needed say 6 months down the line, is there a way we could retrieve this email.

Please advise

P.S. I am new to this product, and currently going through various articles in this forum.

Thanks,
Deepak

[WiTSend]

EV is the "final repository" for the data.  Whilst there are processes to migrate older data to tiertery storage, it is still functional and active in EV and accessible to the users.

Typically the data flow is as follows:

1.  Data is archived from the mailbox to EV after nn days (lets say 30).

2.  Archvied data remain in EV for the duration of it's retenttion (lets say 7 years).(you can use the NAS for the vault stores to begin with)

3.  After being archived for xx time (lets say 1 or 2 years) the data is migrated to cheaper storage.

The data in step 3 is still accessible (albeit slower response times) by the users using normal Outlook/EV client means.

Does this answer the question?

[Patti_Rodgers]

If you archive an item and later find out that the archived files (savesets-- the post-archival files) had become corrupt, you would restore them from backup much like you would restore a Word doc on a file server that had become corrupted.  The actual steps to do that will depend on the backup solution. It is critical that the data in EV be backed up on a regular basis for just this reason--- data corruption (which can happen to any type of data) and disaster recovery.

EV has a utility called EVSVR that can check for missing or un-viable files. This utility will generate a report of files which can be pulled from backup and put back in their expected location.  If you are planning to do tiered storage with newer data on New NAS A and older data on Old NAS B, then the process is exactly the same: identify the extent of the problem and run a restore.

Note that EVSVR is a resource-intense utility and can take a long time to run, depending on the job parameters, and is not meant to be used for routine housekeeping.

[dc281180]

Hi @WiTsend and @Patti Rodgers
Thanks for the clear explaination on the archival steps. Things are more clear now :) Much appreciated...

Let me combine my understanding on the basis of your details. Please do confirm if this is correct

1. EV is to be considred as the "final repository" for the data. 
2. If we archive an item, and find out that its corrupted (whilst in archive status), I would get them restored from backup, like we would restore a word document.

This would mean that our backup policy would complement the archival solution. This would mean that since our client wants the data to be retained for 6 years, we should prepare a backup solution, to backup archived data from EV for atleast 6 years.

3. Regarding the utility from EV -> EVSVR,
a) my understanding from the comment is that it can check and scan for missing / corrupted files, while the email/data is in archive status.
b) Once the utility determines that a particular email has corrupted data, in the archive, it gives out a report of the emails which needs to be recovered from the backups.

Thanks again for helping me out..

Regards,

Deepak

[Patti_Rodgers]

EVSVR will not list emails that are missing per se. It will list the EV saveset files that are missing. One saveset doesn't align directly to one email. 

When EV archives a file or a mail item, it takes it from its native format (email message,  sharepoint post item, word doc, whatever) and processes it, storing it in one or several saveset files (also called DVS files as many will have a .dvs extension).  These are also recorded in the SQL database.

EVSVR  will compare the entries in the SQL database to what is on disk, using the saveset file name. So, if there are files missing, your report would list :

F:\EVPartition1\257000000000000~201201210000160000~0.DVS

F:\EVPartition2\257000000000000~201201210000160000~0.DVS

And so forth-- the path and file name of the missing files themselves. You will *not* get a report with sender/recipient/subject/etc. 

Splitting hairs I know but the client's expectations need to be correct.