There has been lot’s of talk in twitterverse and elsewhere on how “backup is used for restore and archive is for e-discovery”, but I beg to differ.
If one were to take the time to review the EDRM (Electronic Discovery Reference Model) and analyze what happens during actual e-discovery processes, one would see that nothing is outside the domain of court discovery requests. Backups have and always will hold discoverable data just as online and user desktop/laptop storage do. In contrast, archives are not necessarily a primary source of discoverable data.
In my view, any data not in archive, by definition is online or on user desktop/laptop storage. Once online, data is most likely being backed up periodically and will show up in backups long before it’s moved to archive. Data deletions and other modifications can often be reconstructed from backups much better than from archive (with the possible exception of records management systems). Also, reconstructing data proliferation, such as who had a copy of what data when, is often crucial to court proceedings and normally, can only be reconstructed from backups.
Archives have a number of purposes but primarily it’s to move data that doesn’t change off company storage and out of its backup stream. Another popular reason for archive is to be used to satisfy compliance regimens that require companies to hold data for periods of time, such as mandated by SEC, HIPPA, SOX, and others. For example, SEC brokerage records must be held long after an account goes inactive, HIPPA health records must be held long after a hospital visit, SOX requires corporate records to be held long after corporate transactions transpire. Such records are more for compliance and/or customer back-history request purposes than e-discovery but here again any data stored by the corporation is discoverable.
So I believe it’s wrong to say that Backup is only for restore and archive is only for discovery. Information, anywhere within a company is discoverable. However, I would venture to say that a majority of e-discovery data comes from backups rather than elsewhere.
Now, as for using backups for restore,…
Ray,
The point about “backup is for recovery, archiving is for discovery” is not that backups can’t be discovered. It is that discovery using backups is hugely painful, time-consuming and expensive and that active archiving is much cheaper and faster. In Toussie vs. County of Suffolk, where the county tried to argue it was too expensive for it to do discovery on backups of its email systems, the final cost was $1000-$2000 per tape — for 470 tapes.
The net: if you have an active archive, your information is accessible and discovery is vastly cheaper. I work for Symantec, and our customers have seen 90-95% cost reductions in eDiscovery cost using Enterprise Vault.
In the Federal Rules Of Civil Procedure, there’s the concept of “accessible”. If you have a searchable archive, then that meets the definition of “accessible” and you do not need to do discovery against backup tapes — they become “inaccessible”. Without an archive, backup tapes become “accessible” because there’s no choice — it’s the only place where the information resides. As the judge wrote in his opinion on the Toussie case “information management policies are not a dark or novel art.”
Happy New Year,
Mathew