question to product managers regarding backup of deleted items

[mcz]

Hi everybody!

I would like to discuss a topic where I am convinced that not everybody is aware of it (I was also very surprised). I created a ticket and handled everything via case # 03191221. Finally, the answer was that veeam relays on EWS and that's it. So let's describe what happended from the beginning:

My collegue (let's call her Sally) has sent an email to one of our customers. After sending, she deleted it manually and cleared her "recycle bin" - everything has been done via Outlook btw. Two days later she needed that mail and she wasn't able to restore it using the built-in function in outlook so she contacted me. I thought that it would be an easy task because we're having backups. Surprisingly to me, I couldn't find the requested item I was looking for so I doubted if the message has been sent.

By using functions from the o365 exchange admin board I was able to see that the message has been successfully sent at the given time. So now I was 100 % sure that the requested item has been there at least but is not within our backups and not restorable via outlook. I opened a case on veeam and on microsoft side.

Microsoft told me that I could use the content search to restore the item - which I did and here I finally got what I needed but of course this can only be done in a very short timeframe (some weeks I think). As I already mentioned, veeam support told me that the backup-logic fully relays on EWS, which I understand, but in the end we are having some kind of "loopholes" which can bypass compliance etc.

The thing is I cannot do anything to prevent such things in the future. Our backup job runs every hour but of course it will take some minutes until it's finished. Even if I run the job continuously, there would always be a window of some minutes between the last and the next backup job where a user would be able to send a message and delete it immediately to make sure that it's not within the backup. In our case, nobody tried to hide anything but we needed this message for evidence purposes. So if you realize in say a year that you need a certain message which you have sent but has been deleted quite fast after sending, you couldn't.

I know you could also ask why you would ever delete a message and your bin after sending - but that's not something that the admin can control. Users just doint it - doesn't matter why.

In the end I understood why this things can happen but I wasn't expecting it. I always thought that every message/item would be backed up (like often heard in webinars, veeamOn, etc.) and it doesn't matter if it has been deleted already (I thought that there was a recycle bin in the "background").

Is there a chance that these situations could be avoided in the future by working together with Microsoft? What are your thoughts?

Thanks very much!

[Mike Resseler]

Hey Michael,

I'm afraid that it is not possible unless you place a filter before emails that come in. One of the ways to actually achieve this is by placing litigation holds or use the journaling inbox. Journaling inbox does require a mailbox on-premises but holds don't. In that case, no matter what happens, all of those emails (according to your policy) cannot be deleted at all. Veeam Backup for Microsoft Office 365 does have the possibility to backup litigation holds and journaling mailbox also.

Hope it helps.

[Regnor]

In addition to Mike's answer:
Backup should not be used as a solution to compliance objectives. If you need to keep track of your emails because of legal reasons than you should use the right tools; either LegalHold or Journaling, or any kind of 3rd party archiving solution.