eDiscovery Capabilities in Office 365: An Overview

​Total litigation costs of the Fortune 500 is about $210 billion according to survey conducted by metrocorpcounsel.com.  

Growing risk of Information theft and the ever changing business environment has increased litigation cases significantly.  

In today’s high volume data environment where information could be stored in any of the following environments across the multiple applications, finding the relevant data can be time consuming and costly. 

  • In-house servers  
  • Flash drives  
  • Cloud Servers 
  • Computer backup tapes 
  • Smart phones  
  • Tablets/Laptops

Some of the questions organizations needs to address are:  

  • Is our system is capable enough to provide appropriate data to address litigation case? 
  • Is our system easy to use? Or does it require significant training? 
  • Is these information can be used as legal evidence? 
  • How much efforts does it require to pull all relevant information? 
  • What will be the cost to pull all required information? 

Microsoft has addressed these business challenges by introducing eDiscovery in SharePoint 2013/2016 and Office 365.

What is Office 365 eDiscovery ?

Electronic discovery (eDiscovery) in Office 365 is the process of identifying and delivering electronic information that can be used as evidence in legal cases.  

Office 365 eDiscovery can search for the content across the services which includes  Exchange Online mailboxes, Office 365 groups, SharePoint Online and sites, and Skype for Business conversations. This allows you to identify, hold, and export content found across the applications.  

Here is the some of the key features of O365 eDiscovery which helps organization to reduce the cost and efforts to find relevant data.  

  • The eDiscovery Center, a central SharePoint site used to manage preservation, search, and export of content stored in Exchange and SharePoint across SharePoint farms and Exchange servers. 
  • SharePoint In-Place Hold, which preserves entire SharePoint sites. In-Place Hold protects all documents, pages, and list items within the site but allows users to continue to edit and delete preserved content. 
  • Exchange In-Place Hold, which preserves Exchange mailboxes. In-Place Hold protects all mailbox content through the same UI and APIs used to preserve SharePoint sites. 
  • Query-based preservation allows users to apply query filters to one or more Exchange mailboxes and SharePoint sites and restrict the content that is held. 

How eDiscovery works in Office 365  

From Office 365 Security & Compliance Center you can manage compliance across Office 365, Exchange Online, and SharePoint Online.

In addition, you can manage archive mailboxes, eDiscovery cases, auditing reports, and retention and deletion policies in Exchange Online and SharePoint Online.

Clickable banner to download a free eBook from Kiefer Consulting called the Beginner's Guide to Office 365

How can I setup eDiscovery in Office 365 

Your compliance manager can setup eDiscovery by following 6 steps:

Graphic showing the 6 steps to setting up eDiscovery in Office 365

What features Office 365 eDiscovery Offers?

  • Enhanced case management and access controls: O365 now has dedicated Security & Compliance Center from where you create, manage and control eDiscovery cases. Perhaps, you can also manage who has access to the case, place content sources on hold and associate Compliance Searches with the case.
  • Preserving vital information with Case Management Holds: Preserving information is integral to the eDiscovery process. You can hold information spread across the mailboxes, OneDrive, SharePoint Sites, Office groups using Case Management for investigation purpose. Once you apply hold all the data get preserved in their respective sources until you release the hold. However, it doesn’t prevent users from working on data/documents/emails without any loss in productivity; but behind the scenes, the content is preserved and is available to be searched and exported.
  • More granular search capabilities with Permissions Faster and more enhanced export capabilities:  Using granular search in eDiscovery case, you increase/decrease search scope from small set of data to entire organization. Perhaps, security trimming enables you to only allow searches to be made available to the team of the case. Once you find relevant data for your case you can export it from mailboxes (active or inactive), public folders, OneDrive for Business sites, SharePoint sites and Office 365 groups.
  • Faster and more enhanced export capabilities: Once you have identified data you need, you can export the  data to a local drive. Office 365 eDiscovery allows you to export up to 100 GB of data in a single PST export.
  • The ability to search all mailboxes in the organization and export the results in a single PST export, versus multiple PSTs, helps our customers collect email in an extremely useful format for broad investigations. The Export feature also includes new advantages: it maintains the metadata when SharePoint documents are downloaded, no additional permissions setup is required and two factor authentication is supported. 

Advanced eDiscovery in Office 365  

Microsoft has incorporated Equivio machine learning in O365 eDiscovery to perform predictive coding and text analytics. These capabilities reduce the costs and efforts to perform search and sorting large quantities of data for eDiscovery purposes. 

  • Predictive coding:  Lets you train the system   on what you’re looking for, by allowing you to make decisions (about whether something is relevant or not) on a small set of documents. Advanced eDiscovery then applies that learning (based on your guidance) when analyzing all of the documents in the data set. Based on that learning, Advanced eDiscovery provides a relevance ranking so you can decide which documents to review based on what document are the most likely to be relevant to the case.
  • Near-duplicate detection: Lets you structure your data review more efficiently, so one person reviews a group of similar documents. This helps prevent multiple reviewers from having to view different versions of the same document. 
  • Email threading:  Helps you identify the unique messages in an email thread so you can focus on only the new information in each message. In an email thread, the second message contains the first message. Likewise, later messages contain all the previous messages. Email threading removes the need to review every message in its entirety in an email thread.
  • Export for review applications: You can export data from Advanced eDiscovery and Office 365 after you’ve completed your analysis and reduced the data set. The export package includes a CSV file that contains the properties from the exported content and analytics metadata. This export package can then be imported to an eDiscovery review application. 
  • Themes: Help you get valuable insight about your data beyond just keyword search statistics. Themes help investigations by grouping related documents so you can look at the documents in context. When using themes, you can view the related themes for a set of documents, determine any overlap, and then identify cross-sections of related data.
Advance eDiscovery in Action (YouTube Video) 
Getting started with eDiscovery case management in the Office 365 Security & Compliance Center

If you’d like to learn more about leveraging Office 365 to support e-Discovery, Contact us!


Follow Us

Leave a Comment

Your email address will not be published. Required fields are marked *