Outline of Craig Ball's Electronic Discovery Workbook - Native Production of Email

Here's a continuation of my outline of the 2016 edition of Craig Ball's Electronic Discovery Workbook which I last posted about on September 29, 2017.

XI. Native Production of Email A. Databases a. MS Exchange is an email server application that’s a database. b. MS Outlook- an email client application is a database. c. Gmail – SaaS webmail application is a database. d. Lotus Domino, Lotus Notes, Novell Groupwise, Hotmail – all databases. B. Text per a Protocol a. Request for Comment – specifies the form an email should adhere to in order to be compatible with email systems. b. Latest protocol revision is RFC 5322 c. RFC 2045-47, 2049 and 4288-89 – are Multipurpose Internet Mail Extensions (MIMEs) that allow for the exchange of multimedia and foreign languages. d. .eml format often plain text adhering to RFC 5322 and MIME. e. Can convert .eml to .mht extension to open in web browser. f. Mbox - established format for storing multiple RFC 5322 messages in a container format. g. Email in transit format may include the full header information but it lacks metadata acquired upon receipt, such as: i. Folder in which it resides ii. Read / flagged status iii. Time of receipt C. Outlook a. Outlook and Exchange communicate using MAPI, Messaging Application Programming Interface. b. Outlook can serve as the front end for Exchange, Lotus Domino, and webmail services. c. Outlook functions by taking messages apart and using info to populate fields in a database. d. An Outlook email message is actually a report from a database. e. Messages between Outlook and Exchange contain MAPI metadata not present in 5322 messaging. f. No better form of production for Exchange/Outlook messaging than a .pst file. g. No clear native format for Outlook messages. i. .msg contains complete RFC 5322 content and additional metadata, but lacks data saved in a .pst. D. Exchange a. .edb is the format for an Exchange database. i. Holds account data for everyone in a domain. b. Ball has never seen EDB that only contains data for select custodians and was used in discovery. c. One can produce Exchange data in non-native format if attachments produced in native form. E. Gmail a. Keaton v. Hannum, (S.D. Ind. 2013) – court cited Ball noting that Gmail can be downloaded to Outlook and saved as .eml or .msg files, or generated as PDF portfolio. b. Gmail native file format not disclosed by Google. c. IMAP capture to a PST format is a practical alternative. F. Native format of an email a. TIFF format can be sufficient but it costs more to extract text and convert to images than to use near native in production, and TIFF files will be much larger b. Because e-mails and attachments have the unique ability to be encoded entirely in plain text, a load file can carry the complete contents of a message and its contents as RFC 5322-compliant text accompanied by MAPI metadata fields. It’s one of the few instances where it’s possible to furnish a load file that simply and genuinely compensates for most of the shortcomings of TIFF productions. Yet, it’s not done.