Archival and eDiscovery Address Different Challenges

eDiscovery is an end-to-end process starting from the point of identifying all information across an enterprise to processing it for culling and legal hold, and analyzing and reviewing it for pertinence to case matters or litigations or investigations. The process of eDiscovery spans across enterprise data sources, datacenters, remote offices and across data types--in short, it’s a process that needs to work across boundaries for it to be transparent, accurate, complete, effective and exhaustive. eDiscovery is an enterprise wide problem and is required for both active and archive content sources. eDiscovery challenges and requirements are orthogonal to archiving challenges and requirements. Customers need a best of breed approach for solving both eDiscovery and archiving challenges.

Archival is the process of storing non-active or older data in repositories for longer-term online access. The primary goal of archival is to prune data from active content applications for the purposes of cost savings, capacity growth management, performance and efficiency. In the past few years, email archiving has taken a much more dominating position among various archiving applications. Archival is typically done for email content, and to a far lesser extent, file and other content even though archival, in general, includes emails, files, and sometimes includes records management too. In any environment today, archived data is likely only 10-20 percent of the total online data, at best.

Figure 1: eDiscovery and Archival are two different components of the enterprise stack
eDiscovery and costs

eDiscovery solutions address business, legal and IT requirements for meeting legal discovery and forensic investigation challenges. Within corporations eDiscovery users could be wide and broad–ranging: legal and paralegal teams, General Counsel’s office, Security and IT administrator teams. In the past, corporations have typically outsourced the eDiscovery process to legal service providers and law firms. There is a significant change in that eDiscovery paradigm--most corporations are bringing eDiscovery in house to reduce the costs, to gain more control of their eDiscovery process, and to implement and manage Legal Hold defensibly.

Another important reason for corporations to bring eDiscovery in house is for early case assessment in order to make the best possible business decision early in the litigation process--to litigate or not. In many instances, the costs of settlement are less than the costs of eDiscovery using the traditional approach of offloading and sending data to legal service providers. By bringing eDiscovery in house, corporations and business users will have complete, accurate, relevant and timely information up front. And when required, a small relevant subset of the data can be created by analyzing, reviewing and culling down the data to be sent to legal service providers for further detailed or advanced review.

In order to enable corporations with in-house eDiscovery, software needs to be built from the ground up to handle different problems, requirements and characteristics while substantially lowering costs in order to produce a clear ROI. Re-purposing existing products such as archiving products to address eDiscovery challenges is not an optimal approach and obviously will not solve enterprise wide eDiscovery challenges. Archival and eDiscovery serve different purposes--they should co-exist but archival and the search capabilities that come along with it should not be mistaken to serve end-to-end eDiscovery purposes.

Pure-play eDiscovery software products and solutions are meant to address the challenges of proactive information management and reactive eDiscovery. eDiscovery challenges and requirements from customers are about discovery, collection, legal hold, preservation, processing, analysis and review that need to be performed for any litigation matter or offer these functionalities proactively across data that is considered to be prone to litigation. Archives or email archives are one electronically stored information (ESI) data source but there could be data in laptops/desktops, live Exchange servers, data/emails that need to be restored from backup systems/tapes that may or not be in the archives (because they could be purged from archive per policy), file systems, ECMs, HR systems etc. eDiscovery software can be offered on top of archives to make sure archived data is fully discoverable and support eDiscovery requirements.

Electronic discovery for enterprise deployments is a much larger and more complex problem than archiving. For example, consider a typical enterprise consisting of many data centers, remote and branch offices and distributed end users with desktops/laptops etc. It is not practical to archive data at all enterprise locations and for all enterprise data--the cost of doing that is very expensive as one needs to buy more storage and more servers. However, it is very much a reality to have eDiscovery for a legal matter to discover, collect, analyze, review and legally hold data from remote offices, branch offices or end user distributed laptops. eDiscovery software products and solutions are focused on addressing enterprise wide challenges.

Archiving

Archiving and eDiscovery address different problems within corporations. For example, email archiving is focused on making sure emails are moved or archived from Email servers such as Exchange and Lotus. For mail archiving to work, one needs to first create policies and rules using which emails should be moved or archived periodically or at specific time slots. The main reason behind email archiving is to make sure email systems are properly trimmed, tuned and managed to get the best performance out of Exchange, Lotus servers or other email servers.

The products and solutions that solve the archiving problem need to have certain capabilities: mainly, a good repository to store data, de-duplication, compression, backup and indexing capabilities for both metadata and content/text. Also, archives need to provide a good services oriented architecture and interface for any 3rd party products to access, query and extract information from and stream large amounts of data in a short time.

Archives, by definition, require a copy of the original data; this is not only a complex process but it also consumes a substantial amount of storage in the enterprise. Further, it takes time to deploy, consumes significant CPU/servers resources, and as a result, can be deployed only for relatively certain applications like email. Deployment and implementation of archive solutions is akin to undertaking major IT infrastructure changes or deploying ERP applications.

There is another challenge that is brewing in enterprises that have deployed email archives for many years--their archives themselves are growing in size and emails from archives need to be deleted or purged based on policies/rules periodically. For the above mentioned reasons, it’s impossible to archive all content within an enterprise, and hence eDiscovery needs to be conducted separately for archive and active content. eDiscovery needs to reside in a different IT software stack layer in order for it to be all-encompassing and defensible.

Figure 2: eDiscovery Manages Active and Archive Data

Conclusions: Archival and eDiscovery are different problems; they can and should co-exist, but they should be rightfully recognized as fundamentally different problems that need to be solved in very different ways. However, the two solutions can work together well; for example, eDiscovery can work with archives and ECM repositories for legal hold and retention of data for legal matters. This provides a reason for enterprises to integrate eDiscovery products with archive products and leverage the investments made on both fronts to reduce costs, get best of breed solutions, reduce overall risk in eDiscovery, improve efficiency and take control of eDiscovery processed inside enterprises.

Karthik Kannan is vice president of marketing and business development at Kazeon Systems.