Legal Considerations of Stub Rehydration

Question; how many attorneys know what an email message “stub” is or that they can be a major risk when responding to an eDiscovery request? Even many IT professionals aren’t aware of the legal implications of mailbox message stubs.  With that in mind, let’s look at a scenario where mailbox message stubs can become an issue in discovery.

Consider the following scenario:

Attorney: Mr. Tolson, does your company utilize an email archive?

Defendant: Yes

Attorney: Did you search it in response to this discovery request?

Defendant: Yes

Attorney: Did you find any potentially responsive data during this search of the email archive?

Defendant: Yes, we found 73 emails in the archive during the time period in question.

Attorney: And how did you export of those emails out of the email archive?

Defendant: Using the archive’s built-in export capability, we exported the 73 emails to a PST file and immediately loaded the PST into our eDiscovery platform for further processing.

Attorney: Does your email archive platform utilize a “stubbing” capability?

Judge: Before you answer that question specifically Mr. Tolson, can you briefly explain to the best of your knowledge what email stubbing actually is?

Defendant:  Absolutely your Honor. One of the many benefits that legacy email archives provide is the ability to manage Exchange mailbox sizes by automatically moving an email message and/or attachment from the user’s Exchange live mailbox to the email archive replacing the actual email message with a stub pointing to the message in the archive. When the end-user clicks on the stub in their mailbox, the system goes and fetches a copy of it from the archive.

This stubbing process is used to reduce the size of a given mailbox to save on storage and also to help increase the performance of the Exchange server. This process is commonly referred to as “stubbing” or “shortcutting”. Over time this stubbing or shortcutting capability creates millions of pointers within live Exchange mailboxes pointing at messages in the legacy archive. One of the main advantages of stubbing is that the end-user usually can’t tell the difference between a stubbed and actual email message.

Attorney: Thank you Mr. Tolson. So to get back to my question, does your email archive system utilize this stubbing capability?

Defendant: Yes, we do.

Attorney: Did any of the 73 emails you copied from the archive for your eDiscovery response have stubs associated with them?

Defendant: I don’t really know specifically however or policy is to stub all email after they have aged 2 weeks in the Exchange server so based on the timeframe searched, I would say that all most likely had stubs associated with them.

Attorney: I need a little clarification on this. When you exported the responsive emails from the email archive, did you also recombine the archived emails with their associated email stubs in the live Exchange server?

Defendant: No we did not, why would we, they are just pointers…?

Attorney: I beg to differ. In fact, message stubs can include metadata which could be relevant in a case. Because email stubs look like any other non-stubbed email to an end user, they tend to treat them the same way. For example, an end-user can assign or change the category, assign or change a flag designation, move the stub to the Clutter folder (or another folder), mark the message read or unread, or even assign a retention policy to the stub. These actions, under certain circumstances, could be relevant to the case. If these stubs are not recombined with the associated archived email in a legally defensible manner, you could be accused of Failure to make disclosures or to cooperate in discovery (FRCP Rule 37)…

As you can see from the above example, copying potentially responsive emails from your email archive for an eDiscovery response does not fully address your eDiscovery responsibilities. The discovered party and their legal representatives must ask themselves the following questions:

1. Does the client have an email archive?
2. Is there a possibility that potentially relevant content could be present in the archive?
3. Did the email archive installation include enabling: email stubbing”?
4. If yes, can you recombine the stubs with the archived messages in a legally defensible manner?

Archive2Anywhere uses a proprietary stub management process that recombines the stub with the body and any attachments of the archived email. Archive360’s Stub Rehydration™ process matches up each message stub/shortcut in the live Exchange mailbox with the original archived message in the legacy archive. Next, it performs the in-place restoration (or rehydrating) of the live Exchange message stub/shortcut with the archived message; thus preserving metadat and producing forensically complete messages. This stub/shortcut management process is uniquely able to find and fully reconcile Exchange stubs with the original archived messages, and remove leftover stubs from the Exchange server in a forensically defensible process.

Archive360 is the only technology provider that offers this important, legally defensible, patent pending stub rehydration capability.