Performing an In-Place eDiscovery search
Move the Mailbox to Cloud and Put the Mailbox for litigation hold,
If your organization is involved in a legal action, you may have to take steps to preserve relevant data, such as e-mail messages, that may be used as evidence. In situations like this, you may have to retain all e-mail sent and received by specific people or retain all e-mail sent and received in your organization for a specific time period. Putting mailboxes on litigation hold is the first step in meeting these types of litigation requirements. Typically, a discovery manager, lawyer, or other authorized official in your organization puts mailboxes on litigation hold.
When a user deletes messages from their Deleted Items folder or uses Shift+Delete to permanently delete a mailbox item, the deleted items are copied to a hidden folder in the user's mailbox. This folder is called Recoverable Items and was known as the dumpster in previous versions of Microsoft Exchange. Permanently deleted items are copied to a subfolder called Deletions in the Recoverable Items folder.
Items in the Recoverable Items folder are retained for 14 days by default and then purged by Microsoft Exchange. When a mailbox is put on litigation hold, the Recoverable Items folder isn't purged and items in this folder are retained indefinitely. Alternatively, an administrator can configure how long litigation hold is applied to a mailbox. Litigation hold doesn't affect users' day-to-day e-mail workflow, so users can continue to modify and delete mailbox items as they normally would.
Users can manually purge items from the Recoverable Items folder.
•In Microsoft Outlook 2010 Click the Folder tab, select Recover Deleted Items > Purge Selected Items.
•In Outlook Web App Deleted Items > Recover Deleted Items > Purge Selected Items.
Items that are manually purged from the Recoverable Items folder are moved to a subfolder called Purges. If the user's mailbox is put on litigation hold, Microsoft Exchange retains items in the Purges folder while the mailbox is on litigation hold.
Now we will search the Mails from the mailbox which is put on litigation hold
Let’s take a look at how one discovery manager performs an In-Place eDiscovery search.
To use In-Place eDiscovery, a user must be delegated the Discovery Management role group. You can delegate the role to authorized legal, compliance management or human resources personnel. This ability to have scoped roles in the new Exchange online allows IT Pros to delegate compliance responsibilities to folks without giving them full access to all Exchange online functionality.
Use the following steps to perform an In-Place eDiscovery search,
Step2. On the right side of the portal you will be able Admin tab click on arrow to find exchange, click on Exchange to find Exchange Admin center
Step3. On Exchange Admin Center you can find In-Place EDiscovery & hold Click on that
Step4. You will find below wizard,
Now we will perform the Search for the mailbox which is on litigation hold,
Step5. Click on Plus Sign to search for the Mails from the Mailbox, Specify the Name and description, And Click Next
Step6. Specify the mailbox to Search and click next,
Step7. In the below wizard you need to filter, based on your criteria, And Click Next.
Once we created our query to define what content is important to us, we have a few options in terms of what to do with the results. If we feel it's important to protect this content we have the option to place it on hold. When content is placed on hold, Exchange automatically captures any attempts to edit or delete or delete data and stores those items in a hidden folder in the mailbox. It's completely invisible to the end-users so it doesn't interrupt their daily workflow, but it does keep that important data for recovery later.
Step8. Select In-place hold settings and click on finish
Step9. After clicking on finish it will save your search,
Step10. Now you can see the search query as below, to find the mails which you are searching for, Click on Preview Search results,
Step11. After clicking on Preview Search Results you can find all the mails which you searched for.
