Ah, but if you are giving them restores of exchange backups then they
often *are* getting every single email -   it's almost impossible for a
user to delete an email from exchange within one day of receiving it...
First delete goes to your trashcan...   Then that ages out or is emptied
by the user into the dumpster. Then the dumpster ages out over a few
days - typically around a week depending on load and your exchange
admin's  tastes...  So if you give them back daily restores over a
period of time and maiking a not unreasonable assumption that the
investigators are aware of the architecture of exchange datastores these
days then they will have a complete mail trail to hand.



-----Original Message-----
From: EMC NetWorker discussion [mailto:NETWORKER AT LISTSERV.TEMPLE DOT EDU] On
Behalf Of Tim Mooney
Sent: Saturday, 29 March 2008 6:13 AM
To: NETWORKER AT LISTSERV.TEMPLE DOT EDU
Subject: Re: [Networker] Tracking recycled media....

Yes, but you're not getting *all* email, you're getting a small snapshot
of the email, based on one "sample period" (assuming you only do one
backup per day).

I've gotten these types of requests in the past too; I also work in an
"open records" state, so I've probably gotten more "give me all email
that
says..." requests than most.

It's my opinion (and that's all it is) that one needs to use those
situations to remind (or educate) the higher-ups of the shortfalls of
traditional backups.  It's just not possible with traditional backups
to get "all email".  All you get is a sample from one particular period
of the day.

If they really need "all email", then they need something beyond
traditional backups -- maybe email archiving, maybe continuous data
protection, maybe something else entirely.

NOTICE
This e-mail and any attachments are confidential and may contain copyright 
material of Macquarie Group Limited or third parties. If you are not the 
intended recipient of this email you should not read, print, re-transmit, store 
or act in reliance on this e-mail or any attachments, and should destroy all 
copies of them. Macquarie Group Limited does not guarantee the integrity of any 
emails or any attached files. The views or opinions expressed are the author's 
own and may not reflect the views or opinions of Macquarie Group Limited.

To sign off this list, send email to listserv AT listserv.temple DOT edu and 
type "signoff networker" in the body of the email. Please write to 
networker-request AT listserv.temple DOT edu if you have any problems with this 
list. You can access the archives at 
http://listserv.temple.edu/archives/networker.html or
via RSS at http://listserv.temple.edu/cgi-bin/wa?RSS&L=NETWORKER