Re: E-Discovery of remote PST files

["Clark, Sean" <Sean.Clark () UCDENVER EDU>]

Dave,

If you can explain the difficulties/limitations inherent with searching PSTs to your legal department, you may be able 
to get them to agree that searching workstations for PSTs -- and then searching within those PSTs -- is beyond the 
scope of what is "reasonable".  If that doesn't work, I would ask legal to define the scope of the search: a list of 
mailboxes (or users), or at least a list of departments, so that you can narrow down your search.

Having said that, I'm not a lawyer -- and I don't play one on TV.
;)

Sean

-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of John 
Lerchey
Sent: Monday, December 08, 2008 1:38 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] E-Discovery of remote PST files

Hi Dave,

The easiest way that I've found to search PSTs is to have them loaded into outlook on a local drive and apply search 
terms provided by counsel.

I haven't seen any automated tools, other than "site solutions" that run on or in conjunction with the mail servers.

John


> All, our legal counsel are trying to comply with a legal request to turn over
> all email communication campus wide regarding an individual over the last
> couple years.  We do not archive messages, and the vast majority of our users
> pull their email via POP3 to Outlook where those messages are stored on their
> local PC.
>
> Are there any tools you can recommend to remotely scan users PST files for
> specific messages, and hopefully pull those messages out, or foward them off
> to the administrator?
>
> Obviously, we will have to come up with other methods for Mac users or those
> using different email clients, but the vast majority are Outlook users... so
> any help there would be greatly appreciated.  It will take forever to visit
> hundreds of PCs.


John K. Lerchey
Coordinator for Incident Response
Information Security Office
Carnegie Mellon University