#SP24 - eDiscovery in SharePoint 2013

eDiscovery in SharePoint 2013Maarten EekelsThe Netherlands, CET (UTC+2)

April 16th /17th, 2014

Dutch Information Workers User Group (DIWUG)SharePoint SaturdaySharePoint Connections Amsterdam

Top 100 SharePoint Influencers 2013/2014

Maarten Eekels

Contact

[email protected]

What is eDiscovery?Electronic discovery is the process to identify, preserve, search, process, and produce electronic content or electronically stored information (ESI) for a legal request or investigation

Identify and Preserve

Search and Process

Review

Produce

eDiscovery process

Processing

Analysis

Information Management

Identification Review Production Presentation

Preservation

Collection

Volume

Relevance

eDiscovery Case Lifecycle

5

Create New case

Create eDiscovery Set

Place Legal Hold

Refine Content

Export Content

Release Hold

Close Case

Conceptual architecture

eDiscovery user

eDiscovery case

eDiscovery center

Search Service

ApplicationFile shares

SharePoint Exchange Lync

ExchangeWeb

Services

eDiscovery compatibility

Source

Search In-Place Hold Export

On-Premises

Office 365On-

PremisesOffice 365

On-Premises

Office 365

SharePoint 2013 Yes Yes Yes Yes Yes Yes

SharePoint 2010 Yes No No No Yes No

SharePoint 2007 Yes No No No Yes No

Exchange 2013 Yes Yes Yes Yes Yes Yes

Exchange 2010 No No No No No No

Lync 2013 (when archived in Exchange 2013)

Yes Yes Yes Yes Yes Yes

Lync 2010 No No No No No No

Indexed File shares Yes No No No Yes No

SearchUse To Example

AND Find content that contains all of the words or phrases it separates.

risk AND value AND VAR finds content that contains all three words.

OR Find content that contains either of the words or phrases it separates.

risk OR VAR finds all the content that contains either word.

NOT Exclude content that contains the term within a phrase.

Executive NOT Summary finds all the content that contains the phrase Executive, unless the content also contains the term Summary.

( ) Group words or phrases to show the order in which they are applied.

(Risk AND management) OR (VAR or Value-at-risk)

NEAR(n)

Finds words that are near each other, where n equals the number of words apart. If no number is specified, the default distance is 8 words.

Mid NEAR(5) Office finds Mid and Back Office and Mid-Office and Mid, Back, and Front Office

“ “ Search for specific phrases. “risk management” finds the exact phrase

Wildcard (*) Find terms that contain the root word and any additional letters.

risk* finds risk, risks, risked, risking, and risky

In-Place Hold in SharePoint 2013 Enabling and disabling Hold based on timer job Items are placed in a hidden library (Preservation Hold

Library) in the same SharePoint site Lists items, social feeds, documents, and pages are

covered Supports multiple holds, preserved content is cleaned

up after the last hold is released Site collection and farm admins cannot delete the hold

data or site Versions cannot be deleted when the site is on hold Version history is preserved when an item is deleted

In-Place Hold in Exchange 2013 Enabling and disabling Hold based on Exchange Web

Services Items are placed in a hidden folder (DiscoveryHold) in

the Recoverable Items store of a user’s mailbox All edits and deletes are retained Content is always held 30 days after deletion date Supports multiple holds, preserved content is cleaned

up after the last hold is released

Export of the content Documents: Documents are exported from file shares. Documents and

their versions (optional) are exported from SharePoint. Lists: If a list item is included in the query results, the whole list is

exported as a comma-separated values (.csv) file. Pages: SharePoint pages, such as wiki pages or blogs, are exported as

MIME HTML (.mht) files, including styling and mark-up. Exchange objects: Items in an Exchange Server 2013 mailbox, such as

tasks, calendar entries, contacts, email messages and attachments are exported as a.pst file. If Lync conversations are archived in Exchange, those can be discovered and exported, too.

Crawl log errors: To identify content that could not be indexed. An XML manifest that provides an overview of the exported information.

DEMO

High level configuration

13

Install Exchange Web Services API

Configure Communication Between Servers

Create eDiscovery Center

Grant Permissions

Configure Search

Important considerations

Identify content Identify the locations that contain content that can be discovered. Is it just SharePoint, Exchange and Lync, or file shares

as well? Does every SharePoint site need to be discoverable?

Permissions Consider the permissions that you have to grant to eDiscovery users. eDiscovery users need access to all discoverable

content, both in SharePoint and Exchange (and file shares if required)

Storage Consider the storage location capacity to hold the litigation content. If content is not changed much, not a lot of additional

storage is required, but if content is changed, a copy of that content is preserved.

Number of eDiscovery centers One for each Search Service Application and one for each Exchange Forest

Performance Several performance considerations of running eDiscovery queries. Adding more sources increases the number and

complexity of queries. Complex queries (with more operators: AND, OR, NEAR) have more impact on performance.

ResourcesElectronic Discovery Reference Modelhttp://www.edrm.net/resources/edrm-stages-explained

eDiscovery in SharePoint Server 2013 and Exchange Server 2013http://technet.microsoft.com/nl-nl/sharepoint/jj650012.aspx

Intro to eDiscovery in SharePoint, Exchange, and Lync 2013http://blogs.office.com/2012/11/08/intro-to-ediscovery-in-sharepoint-exchange-and-lync-2013/

eDiscovery Flow Across SharePoint, Exchange, Lync, and File Shareshttp://www.microsoft.com/en-ie/download/details.aspx?id=39349

...the anchor will pick some of them up!

Questions?Post your questions in the chat...

Thank you!