Internals of eDiscovery for Office 365, Exchange, and Sharepoint

Editor's Notes

• #11: In-place hold helps you protect content that is important for legal events.
• #18: The Deletions folder replaces the ptagDeletedOnFlag view that was displayed when a user accessed the Recover Deleted Items tool.  When a user soft deletes or performs an Outlook hard delete against an item, the item is moved to the Recoverable Items\Deletions folder.  When the user accesses Outlook/OWA Recover Deleted Items, the RPC Client Access service translates the request and returns the Recoverable Items\Deletions folder view. At this point you may be thinking, how is this any different than in previous versions of Exchange?  With short-term preservation deleted items will still be moved into the Recoverable Items folder structure.   However, the data cannot be purged until deletion timestamp is past the deleted item retention window.  Even if the end user attempts to purge the data, the data is retained.  Consider this example by a malicious user: User sends or receives a message that is legally incriminating. User deletes the message.  The message is moved to the Deleted Items folder. The user empties the deleted items folder. The user accesses the Recover Deleted Items functionality in Outlook or OWA. The user then selects the item and deletes the item.  At this point the user believes he has removed the incriminating evidence.  And this is a key strength in this work flow as the end user's actions are not interrupted or prevented; in other words, the end user's work flow is not impaired with single item recovery enabled. However, the message was not purged from the mailbox store.  Instead the message was moved from the Recoverable Items\Deletions folder to the Recoverable Items\Purges folder.  All store hard-deleted items end up in this folder when single item recovery is enabled.  The Recoverable Items\Purges folder is not visible to the end user, meaning that they do not see data retained in this folder in the Recover Deleted Items tool. When the message deletion timestamp has exceeded the deleted item retention window, Records Management will purge the item. Not only does short term preservation prevent purging of data before the deleted item retention window has expired, but it also enables versioning functionality.  Essentially when an item is changed, a copy-on-write is performed to preserve the original version of the item.  The original item is placed in the Recoverable Items\Versions folder.  This folder is not exposed to the end user.   What triggers a copy-on-write? For messages and posts (IPM.Note* and IPM.Post*), copy-on-write will capture changes in the subject, body, attachments, senders/recipients, and sent/received dates. For other types of items, copy-on-write will occur for any change to the item except for moves between folders and read/unread status changes.\ Drafts will be exempt from copy-on-write to prevent excessive copies when drafts are auto-saved.  The data stored in the Recoverable Items\Versions folder is indexed and discoverable by compliance officers.
• #20: Conversation history will be client side archiving If user is on hold, then data will be stored in exchange With Exchange 2010, management of data was completely separate from the data stored in Lync. Lync data was stored in SQL and queries were executed to get discovery data. With Exchange 2013, the ability for you to have Lync archive all user content into Exchange user mailboxes. There is no longer a need to have a SQL database for management of compliance data. From an on-premises admin standpoint this enables you to have a unified storage model that is completely based on mailboxes. This now enables compliance officers to no longer have to manage and use two different experiences for managing Lync and Exchange data. We capture all Lync data – meetings, IM, whiteboards, transcripts, attachments, etc. All of that gets stored in the user mailbox when the mailbox is on hold.
• #21: I have a user who is currently on hold in Exchange. Tis user participates in a meeting via Lync. The Exchange and Lync services share the attributes in code so both are aware of the fact that the user is on hold. Lync on the server side will capture the conversation or anything associated with the user’s participation in the meeting. Lync will package that up as a transcript and write that into the user’s mailbox, specifically into the Recoverable Items\Purges folder. This folder is indexed and available for discovery. Lync uses EWS to write the data. When the user is on hold, all conversation archiving happens from the server side, not from the client side. This is to ensure that there’s no repudiation of the data. By doing server side, any Lync data is preserved regardless of modality.
• #37: The in-place approach helps you reduce costs by only retaining copies of content that changes. By leveraging the search systems of SharePoint and Exchange, you can run up to date queries any time, and we support all different types of SharePoint, Exchange, and Lync content to help you meet your eDiscovery needs.