Posted on: October 20, 2017in Blog
How to Use the eDiscovery PST Export Tool in Office 365 E3
If a company currently uses a cloud-based email solution, or are entertaining the idea of switching over to one in the near future, both inside and outside counsel should be aware of the system’s built-in preservation and collection capabilities and how to operate them.
One of the most popular cloud-based email solutions is Office 365, and while Microsoft has recently released an E5 subscription - many corporations still utilize the E3 version. Use these tips for your workflows for keyword searching and implementing in-place holds in Office 365 E3.
Collecting Emails from Microsoft Office 365 E3
A few conditions need to be met before in-place eDiscovery searches and holds can take place in Office 365.
- First, the client must maintain an Office 365 Enterprise E3 (or higher) subscription.
- The user account performing the collection must have an active mailbox associated with it, and it must be added to the “Discovery Management” role group.
- Finally, the “Mailbox Import Export” role must be added to the Discovery Management role group. When these conditions have been met, searches and exports can be performed.
Log into Office 365 from a web browser (use Internet Explorer for best results) and navigate to the “Compliance Management” section of the Exchange Admin Center. Create a new in-place hold with a recognizable name and description.
Watch this on-demand webinar to learn how Office 365 is changing the eDiscovery landscape and how to better manage your data both inside, and outside, the O365 platform using X1 technology. DOWNLOAD NOW →
From this point, all mailboxes on the domain can be searched, or specific accounts can be targeted. Once the scope of the search is determined, filtering criteria may be selected. Office 365 allows for filtering based on keywords, dates, and the From/To/CC/BCC fields. If the results of the search are required to be placed on hold, they may be placed on hold indefinitely or for a number of days relative to the received date on a given item. Note that a hold is “in-place,” meaning the items placed on hold will remain in their original location in a mailbox and cannot be deleted. The search will save, and then statistics about a given search can be previewed before export.
Using the eDiscovery PST Export Tool
Results of Office 365 searches can be exported using the “eDiscovery PST Export Tool.” A destination for the exported data must be chosen, and the option to export unsearchable items will be presented. According to Microsoft, “unsearchable items are mailbox items that can’t be indexed by Exchange Search or that have been only partially indexed.” An unsearchable item is typically a file, which can’t be indexed, attached to an email message.
The need to export unsearchable items depends on how a search was run. If a search includes all content from a given mailbox (instead of choosing to filter by keywords, date, or senders/recipients), unsearchable items will be included by default. The same is true if filtering is applied only by date and/or senders/recipients (meaning that no keyword filtering was applied).
It is only necessary to include unsearchable items if keyword filtering was employed when creating a search.The eDiscovery PST Export Tool will also present the option to “Enable Deduplication.” Selecting this option has been known to trigger a bug in the export process wherein all messages are exported to the root of the PST instead of creating the proper folder structure. It is advised that this option not be selected. If desired, it is possible to initiate multiple instances of the eDiscovery PST Export Tool.
Email Collection from Office 365 E5
It is also important to note the Microsoft is released new eDiscovery solutions within the Microsoft Unified Compliance Center. The Enterprise E3 license is a great tool to handle eDiscovery matters - but if you're looking for more robust features, you may want to consider upgrading to the E5 license. These solutions include the integration of the Equivio platform which enables advanced analytic and discovery features within Microsoft Office 365. This allows corporations to reduce the volume of dataset to reduce costs and ease the process of document review. The Advanced eDiscovery Center in E5 allows for CSV files with your data to be exported to be ready to load into the review platform of your choice.
As cloud-based systems become more complex and offer more features, understanding how to use them effectively and efficiently will become even more vital. It's also important to learn how your current tools can be used in conjunction with Office 365 to improve your overall eDiscovery workflow.
This blog was originally published in August, 2016 and has been updated with new information.
D4 Weekly eDiscovery Outlook
Power your eDiscovery intellect with our weekly newsletter.
Posted October 10, 2018
How to Reduce Your Threat of Cyber Attacks in Wake of China Hack Allegations
Posted September 26, 2018
X1 Insight and Collection & RelativityOne Integration: Testing and Proof of Concept
Posted September 19, 2018
D4 used Relativity to pinpoint a single Chinese character with hundreds of thousands of WeChat messages
Posted September 12, 2018
Why You Should Implement Pre-Review Analysis in Your ECA Workflow
Posted September 05, 2018
What is Data Mapping? ESI Basics for eDiscovery
Posted August 29, 2018
ILTACON 2018 Takeaways: 4 Ways to Get Your Lawyers to Use Advanced Technologies
Posted August 22, 2018
Basic eDiscovery Early Case Assessment Checklist
Posted August 15, 2018
Document Review Best Practices: 9 Steps to Prepare Your Workflow
Posted August 10, 2018
Data Reuse in eDiscovery: 4 Questions to Help Start Your Policy
Posted August 03, 2018
Taking a Team Approach to eDiscovery Projects