Email Archival and eDiscovery

Zoho eProtect offers hassle-free email archival and eDiscovery. The eDiscovery section in Zoho eProtect provides a complete solution to retain, review, and export the emails related to your organization's internal, external or legal investigations. It empowers the legal teams to manage the holds and investigations.

Email Archival

Email archival is the process of retaining emails in an organization for a specific period in an organized manner based on the policies of the organization. This is done for compliance or other such purposes, based on the organizational policies.

The main purpose of archival policy are the following:

• Archival of email content for a specific period, so that it cannot be permanently deleted before the retention period.
• Deleting the email content permanently after the defined archival period.
• Compliance with industry regulations and internal policies to retain content for a minimum period of time.
• Reduce the risk, in case of any security breach or litigation caused due to deletion of content by employees.

Does your organization require email archival?

Yes, if your company falls under Sarbanes-Oxley, SEC 17a-3/4, NASD 3010, HIPAA or other such regulations, then you will need to have an email archival policy. Moreover, email is the standard, universal and reliable communication mode for businesses - crucial and sometimes confidential too. They are often needed as substantial evidence. So a copy of the communication must be retained to ensure that the organization follows the compliance standards and can respond to any legal issues that arise related to such communications. This ensures that there is no data loss due to the deletion of data by the employees.

eDiscovery

eDiscovery (electronic discovery) refers to a legal process of “discovering” electronic data by identifying, processing, reviewing and producing retained emails which are potentially relevant to litigation. It assures that the legal team can gather and access the required information in a simple interface, without technical dependency or complexity.

Retention Period

Almost every governmental regulation requires "records" to be captured, managed, retained for specific periods of time, and made available to the governmental agency when asked. These records can include hard copy content, email, voicemail, instant messages, and social media.
The considerations for establishing and maintaining your organization’s email archival policy remain the same; they are business needs, legal requirements, organizational culture, approaches to archival policies, litigation holds, automation, and implementation.

Default Retention Period

The default retention period determines the duration for which the emails of all users in the organization will be retained in Zoho eProtect. If you did not configure the retention period at the time of eProtect setup, you can configure it by following these steps:

1. Log in to Zoho eProtect and select eDiscovery in the left pane.

2. From the Retentions section, select either Retain forever or enter the number of days in the Retain for field.

   Note: By default, the retention period is 365 days.
3. Click the Save button.
   

Customizing Retention Period

The Retentions on the eDiscovery menu, displays the default retention policy and the list of custom retention policies defined by administrators. Note that when an email is expired beyond the set retention period, it will be automatically cleaned up or purged, once every 10 days. Just below the default retention policy, you will find an option to create a new custom retention policy. In case there are any special or custom requirements that need certain emails, based on custodians or certain conditional criteria, to be retained for a different period of time, the administrators can define custom retention policies. Custom retention policies can be defined based on various parameters.

To define new custom policies, follow these steps:

1. Log in to Zoho eProtect and select eDiscovery in the left pane. The Retentions section appears.
2. Click Create custom retention policy and provide a name for the custom policy.
3. Select the custodian by either checking All user accounts or Specific user accounts or a Specific department.
   • Add the account names under User mailboxes if you chose Specific user accounts.
   • Select Departments if you chose the Specific department option.
4. Select Retain spam emails also if you want the spam emails to be archived.
5. Select the period for which you want to retain the emails that match the requirements of the custom policy.
6. In the Condition query, provide the conditions based on which you want to define the custom policy for email archival from the granular options provided:
   • Contains - contains text/ email address in the entire email
   • Email subject - subject contains the selected term
   • Content - email content contains
   • From - from email address contains
   • To - To email address contains
   • Cc - Cc email address contains
   • Bcc - Bcc email address contains
   • Reply To - Reply to email address contains
   • Has attachment - Only the emails with attachment
   • Attachment name - Attachment content contains
   • Attachment content - Attachment content contains
   • Only outgoing emails - Include only outgoing emails
7. Choose which emails you wish to archive based on the custom policy - All, Sent or Received.
8. Select either Retain forever or enter the number of days you wish to retain the emails in the Retain for field.
9. Click Preview Results to check whether the condition query provides the expected results.
10. Click Save to save the custom retention policy.

You can create and save multiple custom retention policies for different purposes. Mostly each custom retention policy will differ based on periods of archival and the conditions required for retention.

Investigation

An Investigation or a case is a legal probe against certain email communications or documents. When there is a legal case or a probe or an investigation pertaining to email communication, the organization needs to retain all the related emails until that investigation is completed/ closed. The administrator creates a new Investigation to manage the entire investigation cycle. Sometimes the investigation can be required for internal investigations too.

Follow these steps to create an Investigation in Zoho eProtect:

1. Log in to Zoho eProtect and select eDiscovery in the left pane.
2. Navigate to Investigations to view or create Investigations.
   
3. Click Create Investigation to create a new investigation.
4. Provide the Investigation name and a detailed description of the particular investigation.

You can create single or multiple holds based on different conditions, as required for the investigation. The emails that are placed on hold via investigations will not be deleted even after the expiry of the archival period defined by default or custom retention policy.

Searches

Before you create a Hold, list down the criteria required for the particular investigation. Based on the various criteria, create different search conditions. In case you need to get this reviewed by legal or compliance or admin teams, you can get it reviewed before you create a Hold. Search helps you try various saved search conditions on the data, preview results and validate these searches before creating the Holds.

Create a New Search

To create a search, follow the below instructions:

1. Log in to Zoho eProtect and select eDiscovery in the left pane.
2. Navigate to the Investigations section, select the desired investigation and click New Search.
3. Enter a name for the search.
4. Choose one of the below options to select the users for whom the search needs to be done:
   • All user accounts
   • Specific user accounts
   • Specific department
5. Based on your selection, select the User mailboxes or Select Departments.
6. Select the Include spam emails checkbox if required.
7. Select the date range for which the search must be performed.
8. If required, select tags.
9. Enter the Condition query as per your needs.
10. Select either All, Sent or Received in the Select mail type field.
11. Click Save search. You can also Preview results before saving the search.

You have now successfully created a new search.

Condition Query

Select the condition with which you'd like to perform the search and enter the search key respective to the condition. You can perform a search with multiple conditions, in which case the results returned will match all of the conditions that you have set for the search. In other words, an AND search will be performed.

For example, if you choose the To condition and enter the search key times.com, then choose the Cc condition and enter the search key technews.com, and finally pick the Has attachment condition, the results returned will be emails that have attachments and have been sent to times.com, Cc'd to technews.com. The emails that match all three of the entered conditions will be returned as results of this search.

Administrators can Export or Export & Delete the data matching the search criteria by clicking on the Export search results or Export & Delete button, respectively. On clicking the button, the action will be triggered and gets listed under the respective tabs along with its current status. Once the status shows completed, you can download the file in ZIP or PST format. To know more about the actions, refer to Exports or Export and Deletes.

View / Download an email (EML format)

In order to view or download the content of the emails listed in the Search result, follow the steps given below:

1. Under the Searches tab, provide the Conditional query to filter the emails and click on Preview results to view all the emails that match the query.
2. Click on the email you want to view from the list.
3. To download an email in EML format, follow these steps:
   1. Click on Show Original in the right top corner to view the original message.
   2. Options to Download Content or Copy to clipboard / Show full content are available on top of the message.
   3. Click on Download Content to export an email in .eml format.

Holds

Each Investigation will retain emails based on one or more holds as needed for the Investigation. A Hold retains the email that is required for the investigation, based on a specific set of conditions. Since a single investigation or case may require retaining different sets of emails based on various conditions like the subject, received time, sender, attachments, custodians and so on, there can be multiple Holds created for each Investigation.

Once a Hold is created, the emails retained by the 'Hold' will be retained until the Hold exists. An admin can view the Holds based on the below categories:

• Organization Holds - Holds placed on data at the organization level across all user accounts.
• User Holds - The holds placed over data that are part of specific user accounts get listed here.
• Department Holds - The holds placed over data that are part of specific departments get listed here.

Administrators can Export or Export and Delete the data matching the hold criteria by clicking on the Export search results or Export & Delete button, respectively. On clicking the button, the action will be triggered and gets listed under the respective tabs along with its current status. Once the status shows completed, you can download the file in ZIP or PST format. To know more about the actions, refer to Exports or Export and Deletes.

Exports

The results of a Hold or a Save Search can be exported by the administrator, whenever required. These exports will be listed under the Exports tab with their current status. Please note, it may take some time depending on the file size. Once the status shows completed, you can download the exported file by clicking on the link given.

Export and Deletes

This tab lists the Export & Delete operations performed by the administrator along with the current status of the action. It may take some time to complete this action depending on the file size. Once the exported file is ready for download, the status will be shown as completed. Click on the file to view the details and the download link. The exported file will be cleaned up after 90 days and so, it is recommended to download the file within the said period.

As the Export & Delete action will permanently and irrevocably remove the data from the eDiscovery portal and leaves no copy behind, it is highly recommended to download the file on time promptly. It will also delete emails which are on hold or whose archival period is not yet expired, hence this option needs to be used with caution.

Tags

In a specific investigation, you can choose to tag emails from the search preview or the hold preview. To create a tag and apply it to an email, follow the instructions below:

1. Log in to Zoho eProtect and select eDiscovery on the left pane.
2. Navigate to the Investigations section, and select the relevant investigation.
3. Select the Tags tab.
4. Select the Create Tag option, enter a tag name, pick a color, and click Save.
5. Now, select a saved search or a hold from the Searches or Holds tab.
6. Click the Preview Results option.
7. Select the checkboxes across the emails that you want to tag.
8. Select the Tag as option and choose the relevant tag.
9. These tagged emails can also be viewed from the Tags section. Click on a particular tag and all the emails associated with that tag will be listed.

Filter Rules

Every organization's need for data archival varies according to the industry and its business needs. Some may require storing all emails of the entire organization for compliance purposes, while others may choose to store certain VIP mailboxes or certain client communication emails which were sent to or received from outside the organization. The archival rules also known as Filter Rules act as an ingestion filter for emails to be allowed into eDiscovery for archival. It provides admins with the option to choose the types of emails that they want to archive in the eDiscovery portal such as sent emails or received emails or retain only a specific subset of sent/ received emails and so on.

In order to control what gets stored/retained you can create a custom eDiscovery Ingestion Filter. You can do this in the following ways:

• While setting up your organization, you can select the filter criteria by which only a subset of emails get retained. This filter (EDISCOVERY_FILTER) is a default ingestion filter and it is applied to all user mailboxes.
• To have more fine-grained or granular control on specific filters on certain mailboxes, say group mailboxes or emails from a certain department, etc. you can create Custom Ingestion Filters.

Define the appropriate Retention Rule to ensure you retain the required emails while not filling up your storage with unnecessary emails.

Follow these steps if you have not configured the default ingestion filter: 

1. Log in to Zoho eProtect and select eDiscovery in the left pane.
2. Navigate to Filter Rules.
3. Choose either All emails or Emails based on the conditions below.
4. If you selected Emails based on the conditions below, set the ingestion rule conditions from the below list:
   • Retain all sent emails
   • Retain all sent emails - outside the organization
   • Retain emails sent - only within the organization
   • Alternatively, you can specify selected domains and choose to retain the emails that are sent only to those domains.
   • Retain all received emails
   • Retain emails received - only within the organization
   • Retain emails received from external organization accounts
   • Alternatively, you can specify selected domains and choose to retain the emails that are received from those domains.
   • Exclude spam emails.
5. Click Next. The default ingestion rules are now configured as EDISCOVERY_FILTER.

Custom Ingestion Filter

As an administrator, you will know your organization's goals for archival and can determine what needs to be archived in eDiscovery. To have more fine-grained or granular control on specific filters on certain mailboxes, say group mailboxes or emails from a certain department, etc. you can create custom Ingestion Filters. Follow these steps to add a custom Ingestion Filter:

1. Log in to Zoho eProtect and select eDiscovery on the left pane.
2. Select Filter Rules and Click on Add Filters.
3. Provide a Filter Name.
4. Select either All emails or Emails based on conditions below.
5. If you select All emails, mention the users and click Save.
6. In case you select Emails based on the conditions below, specify all the conditions (all received emails/received from within the organization/received from outside the organization, all sent emails/sent within the organization/sent outside the organization, deleted emails and exclude spam emails). You can also mention specific domain(s) under the All sent emails and All received emails categories.
7. Mention the Associated users it applies to and click Save.

Once the filter is saved, the new custom filter will appear under the list view. Click on the Filter name to view its details or edit permissions, if required. Click on the Associated users tab to view the list of users associated with this filter.

eDiscovery Settings

Enable / Disable eDiscovery

As an administrator, you can customize your eDiscovery portal by clicking on the Settings tab. This section allows you to enable or disable eDiscovery for your organization. In case, you have already enabled eDiscovery and later, due to some unforeseen reason, wish to disable the service, then the emails that get delivered to your organization's user account will no longer be retained, while the older emails will be retained as per the existing archival policy.

Mail Receiving Type

The Mail receiving type defines how Zoho eProtect must receive your organization's emails and process them further. The options available under the mail receiving type differ based on your email provider. Click the preferred mail-receiving method to learn more about it.