Email Archiving and eDiscovery: A Guide to Retention, Search and Legal Hold for Business Email
By Email ExtractorPublished 5 min read
On this page
Why Email Archiving Matters
Email is the most common form of business communication, and it is also the most frequently requested evidence in litigation and regulatory proceedings. Proper archiving serves three purposes: regulatory compliance, litigation readiness and operational efficiency:
Purpose
What it requires
Consequence of failure
Regulatory compliance
Retain emails for required periods by industry; produce on request
Attorneys review documents for relevance and privilege
Archive search and tagging support review workflow
Production
Produce relevant, non-privileged documents to opposing party
Archive exports in standard formats (PST, EML, PDF, EDRM XML)
Legal hold implementation
Step
Action
Importance
Trigger identification
Identify when litigation is reasonably anticipated (demand letter, complaint, investigation notice, internal awareness)
Duty to preserve begins at reasonable anticipation, not filing
Hold notice
Send written notice to custodians (employees whose emails may be relevant)
Document who was notified and when
Archive hold
Apply legal hold in email archive to prevent deletion of relevant emails
Prevent spoliation; override retention policy
Scope definition
Define date range, custodians, keywords, subject matter
Preserve enough without preserving everything
Reminder
Periodic reminders to custodians about preservation obligations
Demonstrate ongoing compliance
Release
Release hold when litigation concludes or preservation no longer required
Resume normal retention policy
Archiving Solutions by Size
Company size
Solution type
Examples
Typical cost
1-50 employees
Cloud email with built-in archiving
Microsoft 365 (E3+; Purview); Google Workspace (Vault)
$20-$35/user/month (includes email + archiving)
50-500 employees
Dedicated cloud archiving
Barracuda; Mimecast; Proofpoint
$3-$10/user/month (archiving add-on)
500-5,000 employees
Enterprise archiving
Veritas Enterprise Vault; Proofpoint; Microsoft Purview
$5-$15/user/month
5,000+ employees
Enterprise archiving with eDiscovery
Relativity; Nuix; Veritas; Microsoft Purview
Custom pricing
Key archiving features to evaluate
Feature
Why it matters
Journal-based capture
Captures all email as sent/received (cannot be deleted by users)
Full-text search
Find emails by content, not just subject or sender
Metadata preservation
Preserve headers, timestamps, attachments, BCC for legal defensibility
Legal hold capability
Freeze emails from deletion when litigation is anticipated
Retention policy management
Automate retention periods by policy; different policies for different groups
Tamper-proof storage
WORM (write once, read many) or equivalent; hash verification
Export formats
PST, EML, PDF, EDRM XML for eDiscovery production
Audit trail
Log all access, search, export, deletion for compliance
Role-based access
Compliance officers search all; managers search their reports; users search their own
Attachment handling
Index and search within attachments (PDF, Word, Excel, images with OCR)
Email Data Management and Archiving
Before implementing archiving, ensure your email data is organised. When consolidating historical email data from multiple sources (Exchange server exports, Google Workspace exports, legacy email system exports, PST files, EML files), you may need to identify unique email addresses across the archive for custodian identification, legal hold scoping, retention policy assignment, and data mapping. Upload exports to Email Extractor to extract and deduplicate email addresses from exported email files (EML, MSG, DOCX reports, CSV logs, and other supported formats). This is particularly useful during eDiscovery custodian identification, where you need a complete list of unique email addresses involved in communications relevant to a legal matter.
