Instant Messaging Systems

Instant messaging (IM) systems are growing in popularity for corporate communication within organizations. Phone conversations, face-to-face interactions, and even emails are being replaced with instant messages between co-workers because of its convenience and high level of availability. With organizations logging and storing these conversations, their exclusion would be as negligent as ignoring a custodian’s email.

How does IM differ from e-mail?

Instant messages are stored very similar to email messages: They both contain a sender and recipient along with a message, but also include several pieces of metadata such as date/time stamps and source/destination IP addresses. In addition, just as e-mails contain attachments, instant message systems allow file transfers and file sharing. The biggest difference between e-mail and IM systems is in the functionality offered, the transmission protocols used, and also the data storage methods.

How do we process IM?

This all depends on the nature of the instant messaging system and how it stores its information. Most often, the messages and their metadata are extracted to an intermediary format such as an access database or comma-delimited text file. Alternatively, if the IM system utilizes a flat-file structure, we may capture fields by analyzing files and directories, capturing native file metadata. Even when performing discovery on multiple IM systems, the results can still be stored in the same indexed database -- alongside e-mail and all other native file types.