> If anything there should be whole slew of emails documenting this feature and its reasons for existence and who authorized this. Email trails are easy to get

> If anything there should be whole slew of emails documenting this feature and its reasons for existence and who authorized this. Email trails are easy to get rid of. My company rolled out full disk encryption using TPM due to HIPAA concerns. Then we got a new email retention policy of 6 months after which emails were deleted because we were migrating from Lotus Notes to Exchange. We had a local archive option for people who wanted to retain emails older than 6 months. Then we got a hardware refresh where those archives were not automatically migrated to new hardware. Not that the new machines had Lotus Notes anyways. The IT Asset group was instructed to remove Hard drives from old hardware and wipe them because HIPAA. Even if they hadn't wiped the drives, they weren't documenting which drive came from which machine when they binned them so you wouldn't be able to decrypt the drive because TPM. Also they were removing asset tags from decommissioned machines as they prepared them for the reseller. 12 months later they reevaluated the email retention policy and decided to increate it 24 months. Emails? What emails.