The Email Nobody Could Produce: Rebuilding Evidence Integrity at a 5,000-Mailbox Bank
A regulator asked a 5,000-mailbox bank for eighteen months of email. The bank had the messages but could not prove they were unaltered. Here is what changed.
Composite scenario drawn from typical East African deployments. Institution details are anonymised and figures are representative rather than attributable to a single client.
A request the bank could answer, but not defend
The letter asked for all email correspondence between the bank's trade finance desk and a named counterparty over an eighteen-month window.
The bank's IT team was not worried at first. Mailboxes were retained. Backups existed. Within a week they had produced several thousand messages, exported to PST from a mix of Microsoft 365 and an on-premise Exchange server that still served two departments after an unfinished migration.
The problem arrived with the follow-up question: how could the bank demonstrate that the messages produced were complete, and that none had been altered or deleted in the interim?
It could not. Mailbox retention proves that a copy exists in a mailbox now. It does not prove what was sent at the time, it does not survive a user with delete permissions, and it produces no record of who searched or exported what. Three mailboxes belonged to staff who had left; two had been reassigned. The on-premise half of the estate had no consistent retention policy at all.
Nothing improper had happened. The bank simply had no way to show that.
The distinction that matters
Archiving and journaling are often used interchangeably, and the difference is the whole point.
An archive is a managed copy of what is in a mailbox. Journaling captures messages at the transport layer, as they are sent and received, before any mailbox-level action can touch them. One is a copy of the current state. The other is a record of the event.
For regulatory and litigation purposes, only the second is defensible — and only if the capture itself can be shown to be complete and unaltered.
What was deployed
The bank rolled out Creodata Mail Journaling across both halves of its estate: Microsoft 365 and the remaining on-premise Exchange servers. The platform ran on Azure using Functions, PostgreSQL 16 and Blob Storage, with 5,200 mailboxes activated at go-live through bulk CSV activation with per-row status tracking — which mattered, because previous attempts at estate-wide changes had failed silently on a subset of mailboxes and nobody had noticed for months.
Four controls did the work.
Immutable evidence. Every message is stored as an .eml file with a SHA-256 hash computed at capture. Reconciliation runs verify that the stored object still matches its hash. Production is not a claim that the message is unaltered; it is a demonstration.
A hash-chained audit trail. Every access, search, download and export is written to an append-only, hash-chained log. When counsel asks who looked at what, the answer is a record rather than a recollection — and the chain makes tampering with that record detectable.
Purpose-bound access. Nobody has standing access to the archive. Access is granted against an active compliance matter, with an expiry. Sensitive operations — search, download, export — go through maker-checker approval, so no single administrator can quietly extract correspondence.
PII masking by default. Mailbox names and recipients are masked in the interface, with reveal gated by permission. Investigators can work a matter without incidentally browsing the entire organisation's correspondence.
Legal hold and retention are managed inside the platform, with chain-of-custody documentation generated per matter.
What it changed
The next regulatory request — a smaller one, six weeks later — was answered in under two days, with a chain-of-custody pack attached that documented what was searched, by whom, under what authority, and how integrity was verified.
The operational numbers were less dramatic but more reassuring: at peak the platform handles around a million messages a day without the journaling backlog that had previously built up on the Exchange side, and the estate has a roadmap to 10,000 mailboxes as the bank absorbs an acquisition.
The internal effect was the one the general counsel cared about. Data-leak investigations that had previously stalled — "we think it went out by email but we cannot prove it" — became tractable, because the record of what was sent exists independently of whether the sender still has it.
For institutions in the same position
Three checks are worth running against your own environment this quarter.
Can you prove completeness? Not "do we have the emails" but "can we show that what we produced is everything that matched, and that nothing was removed". If the answer depends on mailbox retention, it is not an answer.
Who can search the archive, and how would you know? Standing administrative access to years of executive correspondence is a risk in itself. If searches are not logged in a tamper-evident way, an investigation into misuse of the archive cannot be conducted.
Is your hybrid estate actually covered? Unfinished migrations are the single most common source of gaps we find. The mailboxes left behind on-premise are usually the older, more senior, more litigation-relevant ones.
Further reading: The Complete Email Journaling Guide · Litigation Hold — Preserve Emails for Legal Cases
Preparing for eDiscovery or a regulatory production? Book a consultation or explore Mail Journaling to see how hash-verified capture and purpose-bound access work in practice.
