Knowledge Base Home

Call Support


Search the Knowledge Base

Skip to end of metadata
Go to start of metadata

Environment

Netmail Archive 5.2+

Synopsis

Overview of how Netmail Archive handles 100% email message retention in Exchange 2013 and O365 without journaling.

Solution

With Netmail, organizations can now guarantee 100% message retention in Exchange 2013 and Exchange Online (O365) without relying on message journaling. This feature works in conjunction with Single Item Recovery in Exchange to prevent any items from being removed from the database before they are archived. By applying both an adequate retention period and storage quota to the Recoverable Items folder in Exchange and running regularly scheduled archiving jobs in Netmail Archive, your organization can ensure that even those items which may have been deleted by users are still archived.

Deletions

Deletion Terminology

The following definitions may be useful for understanding the content within this article:

  • Delete: Describes when an item is deleted from any folder and placed in the Deleted Items default folder.
  • Soft delete: Describes when an item is deleted from the Deleted Items default folder and placed in the Recoverable Items folder (RIF). Additionally describes when a Microsoft Outlook user deletes an item by pressing Shift+Delete, which bypasses the Deleted Items folder and places the item directly in the RIF.
  • Hard delete: Describes when an item is marked to be purged from the mailbox database. This is also known as a store hard delete.

Journaling

Journaling lets you record a copy of, or journal, all email communications in your organization and send them to a dedicated mailbox on an Exchange Server. Journaling is simply a means of recording your users' messages. Netmail Archive can archive from a journal account(s), if desired, to maintain 100% message retention, but journaling has the following shortfalls:

  • Increased CPU/RAM usage on the Exchange Server by about 3-5%.
  • Increased Exchange DB storage requirement to house all the journaled emails.
  • No message meta data, such as if the end user actually read the message.

Recoverable Items Folder (RIF)

To protect from accidental or malicious deletion and to facilitate discovery efforts commonly undertaken before or during litigation or investigations, Microsoft Exchange Server 2010 introduced the Recoverable Items folder. The Recoverable Items folder replaces the feature known as the
dumpster in Exchange Server 2007. The Recoverable Items folder is used by the following Exchange features:

  • Deleted item retention
  • Single item recovery
  • In-Place Hold
  • Litigation Hold
  • Mailbox audit logging
  • Calendar logging

About the Recoverable Items Folder

The RIF contains the following subfolders:

  • Deletions: This subfolder contains all items deleted from the Deleted Items folder. (In Outlook, you can soft delete an item by pressing Shift+Delete.) This subfolder is exposed to users through the Recover Deleted Items feature in Outlook and Outlook Web App.
  • Versions: If In-Place Hold, litigation hold, or single item recovery is enabled, this subfolder contains the original and modified copies of the deleted items. This folder is not visible to end users.
  • Purges: If either litigation hold or single item recovery is enabled, this subfolder contains all items that are hard deleted. This folder isn't visible to end users.
  • DiscoveryHolds: If In-Place Hold is enabled, this subfolder contains all items that meet the hold query parameters and are hard deleted.
  • Audits: If mailbox audit logging is enabled for a mailbox, this subfolder contains the audit log entries. This folder isn't visible to end users.
  • Calendar Logging: This subfolder contains calendar changes that occur within a mailbox. This folder isn't visible to end users.

RIF Workflow

The following diagram explains how deleted messages are handled. For the purposes of maintaining 100% retention in Exchange 2013/O365 through Single Item Recovery, the 'DiscoveryHolds', 'Audits' and 'Calendar Logging' subfolders of the RIF are not important.

Enabling Single Item Recovery

You can configure Single Item Recovery for a mailbox with the "Set-Mailbox" PowerShell Cmdlet. This example enables single item recovery and sets the number of days that deleted items are retained.

Set-Mailbox -Identity "MBX01" -SingleItemRecoveryEnabled $True -RetainDeletedItemsFor 30

To set the for all users you can use:

Get-Mailbox -ResultSize unlimited -Filter {(RecipientTypeDetails -eq 'UserMailbox')} | Set-Mailbox -SingleItemRecoveryEnabled $True -RetainDeletedItemsFor 30

Note: The retention period can be set to any length of time. However, if you want to retain deleted items for longer than 30 days in O365, the mailbox must have an Exchange Online (Plan 2) user license.

Netmail Archive Integration

Key Points

  • RIF archiving with Netmail replaces Journal archiving.
  • A mailbox does not have to be put on Litigation Hold or In-Place Hold. Only Single Item Recovery has to be enabled.
  • A Microsoft E-Cal license is not required for this.
  • Since Single Item Recovery only holds messages for the specified retention period, the Archive job MUST run successfully BEFORE the retention period has expired to ensure 100% retention.
  • Archiving of the RIF is handled in the same way as any other mailbox folder. All its subfolders are archived automatically, with no additional level of granularity required.



Accessing Archived RIF Data

In Netmail Search, the 'Recoverable Items' folder is found under the root folder, and it contains the '\Deletions', '\Versions' and '\Purges' subfolders. The RIF will only be visible to super users.

Notes


References:

Recoverable Items Folder: http://technet.microsoft.com/en-us/library/ee364755

Enable Single Item Recovery for a Mailbox: http://technet.microsoft.com/en-us/library/ee633460(v=exchg.150).aspx

Change how long permanently deleted items are kept for an Exchange Online mailbox: https://technet.microsoft.com/en-us/library/dn163584(v=exchg.150).aspx

Help us improve!
Is this article helpful?
Is it well written?
Is the content complete?

  • No labels