Email Archiving Mechanisms

When choosing an email archiving solution, it’s important to be mindful of the various mechanisms for capture, how they work, and their various caveats.

• Envelope Journaling: Designed specifically to enable organizations to capture information with the highest possible fidelity and also Microsoft’s only recommended mechanism for reliable and compliant message archiving.
   
• Message Application Programming Interface (MAPI): A Microsoft-designed API best known for communication between Microsoft Outlook and Microsoft Exchange. MAPI can only capture changes on interval and cannot guarantee 100 percent message capture. For this reason, Microsoft does not recommend using MAPI for compliant email archiving.
   
• Event Sink: A piece of code that defines how your mail server should handle certain events (such as inbound our outbound email, for example). Event sinks were deemphasized in Exchange 2007 and removed from Exchange 2010 altogether. As such, leveraging event sinks for compliant email archiving is not recommended by Microsoft.
   
• Log Shipping: Reverse engineers transaction logs from the mail server to reconstruct messages for the archive. This mechanism reduces overhead on Exchange, but causes problems when one attempts to inject data back into Exchange with modified logs. The potential for mailbox data to be corrupted and not supported by Microsoft is high and, as such, Microsoft does not support Exchange servers that are using any type of third-party log shipping solution.

To learn more about Exchange journaling, read this TechNet article from Microsoft.