Source: https://techcommunity.microsoft.com/t5/Exchange-Team-Blog/In-Place-eDiscovery-and-In-Place-Hold-in-the-New-Exchange-Part-I/ba-p/598792
Timestamp: 2019-10-23 15:43:11
Document Index: 738313781

Matched Legal Cases: ['art%20', 'art%20', 'art%20', 'art%20', 'art%20', 'art%20', 'art%20']

In-Place eDiscovery and In-Place Hold in the New Exchange - Part I - Microsoft Tech Community - 598792
%3CLINGO-SUB%20id%3D%22lingo-sub-598792%22%20slang%3D%22en-US%22%3EIn-Place%20eDiscovery%20and%20In-Place%20Hold%20in%20the%20New%20Exchange%20-%20Part%20I%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-598792%22%20slang%3D%22en-US%22%3E%3CP%3E%3C%2FP%3E%3CP%3EWhen%20faced%20with%20eDiscovery%20requests%2C%20organizations%20need%20to%20be%20able%20to%20preserve%20email%20records%2C%20search%20relevant%20records%20and%20produce%20them%20for%20review.%3C%2FP%3E%0A%3CP%3EIn%20Exchange%20Server%202010%20and%20Office%20365%2C%20%3CA%20class%3D%22bold%22%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fee861123.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3ELitigation%20Hold%3C%2FA%3Emakes%20it%20possible%20to%20preserve%20mailbox%20items.%20When%20a%20user%20or%20a%20process%20attempts%20to%20delete%20an%20item%20permanently%2C%20it%20is%20removed%20from%20the%20user%E2%80%99s%20view%20to%20an%20inaccessible%20location%20in%20the%20mailbox.%20Additionally%2C%20when%20a%20user%20or%20a%20process%20modifies%20an%20item%2C%20a%20%3CSPAN%20class%3D%22newterm%22%3ECopy-on-write%3C%2FSPAN%3E(COW)%20is%20performed%20and%20a%20copy%20of%20the%20original%20item%20is%20saved%20right%20before%20the%20changed%20version%20is%20committed%2C%20preserving%20original%20content.%20The%20process%20is%20repeated%20for%20every%20change%2C%20preserving%20a%20copy%20of%20all%20subsequent%20versions.%3C%2FP%3E%0A%3CP%3EUsing%20%3CA%20class%3D%22bold%22%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fdd335072.aspx%23DiscoveryManagement%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EMulti-Mailbox%20Search%3C%2FA%3E%2C%20also%20new%20in%20Exchange%202010%2C%20delegated%20legal%2C%20human%20resources%20or%20IT%20personnel%20(referred%20to%20as%20%3CSPAN%20class%3D%22newterm%22%3Ediscovery%20managers%3C%2FSPAN%3Ebecause%20they%20need%20to%20be%20assigned%20%3CA%20class%3D%22bold%22%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fdd351080.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EDiscovery%20Management%3C%2FA%3Epermissions)%20can%20search%20mailbox%20content%20across%20their%20entire%20Exchange%202010%20organization.%20Messages%20returned%20from%20a%20search%20can%20be%20copied%20to%20a%20Discovery%20mailbox%2C%20which%20is%20a%20special%20type%20of%20mailbox%20with%20higher%20mailbox%20quotas%20and%20no%20capability%20to%20send%20or%20receive%20messages.%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1764789859%22%20id%3D%22toc-hId-1791629626%22%3EWhat's%20New%20in%20In-Place%20eDiscovery%20%26amp%3B%20Hold%20in%20Exchange%202013%3C%2FH2%3E%0A%3CP%3ESince%20the%20release%20of%20Exchange%202010%20and%20Office%20365%2C%20we%20have%20received%20a%20lot%20of%20feedback%20from%20organizations%20of%20all%20sizes%20about%20the%20messaging%20policy%20%26amp%3B%20compliance%20features%2C%20including%20archiving%2C%20eDiscovery%20%26amp%3B%20hold.%20When%20planning%20the%20evolution%20of%20compliance%20features%2C%20we%E2%80%99ve%20kept%20your%20feedback%20front%20and%20center.%20Let%E2%80%99s%20take%20a%20look%20at%20what%20has%20changed.%3C%2FP%3E%0A%3CUL%20class%3D%22arrowlist%22%3E%0A%3CLI%3E%3CSPAN%20class%3D%22bold%22%3EA%20new%20name%3C%2FSPAN%3EIn%20the%20new%20Exchange%2C%20Multi-Mailbox%20Search%20is%20known%20as%20In-Place%20eDiscovery.%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%20class%3D%22bold%22%3EA%20new%20search%20engine%3C%2FSPAN%3EIn-Place%20eDiscovery%20still%20uses%20the%20search%20indexes%20generated%20by%20Exchange%20Search%2C%20but%20under%20the%20hood%20Exchange%20Search%20has%20been%20retooled%20to%20use%20Microsoft%20Search%20Foundation.%20The%20content%20indexing%20function%20was%20previously%20performed%20by%20Windows%20Search.%20Microsoft%20Search%20Foundation%20is%20a%20rich%20search%20platform%20that%20comes%20with%20significantly%20improved%20indexing%20and%20querying%20performance%20and%20improved%20search%20functionality.%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%20class%3D%22bold%22%3EA%20new%20way%20to%20preserve%3C%2FSPAN%3EIn%20the%20new%20Exchange%2C%20you%20can%20use%20In-Place%20Hold%20to%20place%20searched%20content%20on%20hold.%20In-Place%20Hold%20is%20integrated%20with%20In-Place%20eDiscovery%2C%20allowing%20you%20to%20simultaneously%20search%20and%20hold%20content%20using%20the%20same%20easy-to-use%20interface.%20Integrating%20hold%20with%20eDiscovery%20allows%20you%20to%20be%20very%20specific%20as%20to%20what%20you%20hold%20using%20a%20query.%20Reducing%20the%20volume%20of%20data%20you%20preserve%20lowers%20the%20cost%20of%20reviewing%20the%20data%20later.%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%20class%3D%22bold%22%3EA%20new%20UI%3C%2FSPAN%3EThe%20new%20Exchange%20sports%20a%20brand%20new%2C%20unified%20web-based%20admin%20tool%2C%20the%20%3CA%20class%3D%22bold%22%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fb%2Fexchange%2Farchive%2F2012%2F08%2F09%2Fmanaging-the-new-exchange.aspx%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3EExchange%20Administration%20Center%3C%2FA%3E(EAC).%20Discovery%20Managers%20use%20the%20new%20In-Place%20eDiscovery%20%26amp%3B%20Hold%20wizard%20to%20perform%20eDiscovery%20searches.%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%20class%3D%22bold%22%3EKeyword%20statistics%3C%2FSPAN%3EAfter%20you%20create%20an%20In-Place%20eDiscovery%20search%2C%20you%20can%20get%20detailed%20keyword%20statistics%20showing%20you%20the%20number%20of%20items%20matched%20for%20each%20keyword.%20You%20can%20use%20this%20information%20to%20determine%20if%20the%20query%20has%20returned%20the%20number%20of%20messages%20you%20estimated.%20Depending%20on%20whether%20a%20query%20is%20too%20broad%20or%20too%20narrow%2C%20the%20search%20may%20return%20too%20many%20or%20too%20few%20messages.%20Use%20this%20information%20to%20fine-tune%20your%20query.%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%20class%3D%22bold%22%3EeDiscovery%20Search%20Preview%3C%2FSPAN%3EAfter%20you%E2%80%99ve%20created%20an%20eDiscovery%20search%2C%20you%20can%20quickly%20preview%20search%20results.%20Messages%20returned%20from%20each%20source%20mailbox%20are%20displayed%20in%20search%20preview.%20Being%20able%20to%20quickly%20preview%20messages%20allows%20you%20to%20ensure%20your%20query%20returns%20the%20content%20you%E2%80%99re%20searching%20and%20further%20fine-tune%20your%20query.%3C%2FLI%3E%0A%3CLI%3E%3CP%3E%3CSPAN%20class%3D%22bold%22%3EIntegration%20with%20the%20New%20SharePoint%3C%2FSPAN%3EExchange%20offers%20an%20integrated%20eDiscovery%20%26amp%3B%20Hold%20experience%20with%20the%20new%20SharePoint.%20Using%20the%20%3CSPAN%20class%3D%22bold%22%3EeDiscovery%20Center%3C%2FSPAN%3E%2C%20you%20can%20search%20and%20hold%20in-place%20all%20content%20related%20to%20a%20case%20-%E2%80%93%20SharePoint%20web%20sites%2C%20documents%2C%20file%20shares%20indexed%20by%20SharePoint%2C%20mailbox%20content%20in%20Exchange%20and%20archived%20Lync%20content%20from%20a%20single%20location.%20You%20can%20export%20content%20associated%20with%20case%2C%20including%20files%2C%20lists%2C%20web%20pages%20and%20Exchange%20mailbox%20content.%20Mailbox%20content%20is%20exported%20as%20a%20.PST%20file.%20An%20XML%20manifest%20that%20complies%20with%20the%20Electronic%20Discovery%20Reference%20Model%20(EDRM)%20specification%20provides%20an%20overview%20of%20the%20exported%20information.%3C%2FP%3E%0A%3CP%3ETo%20search%20Exchange%20content%2C%20SharePoint%20uses%20Exchange%E2%80%99s%20Federated%20Search%20API.%20Regardless%20of%20whether%20you%20search%20Exchange%20content%20from%20the%20%3CACRONYM%20title%3D%22Exchange%20Administration%20Center%22%3EEAC%3C%2FACRONYM%3Eor%20using%20SharePoint%2C%20the%20same%20search%20results%20are%20returned.%20The%20new%20SharePoint%20and%20Exchange%20both%20use%20the%20same%20underlying%20indexing%20and%20querying%20engine%20%E2%80%93%20Microsoft%20Search%20Foundation%2C%20which%20allows%20you%20to%20use%20the%20same%20search%20query%20for%20both%20SharePoint%20and%20Exchange%20content.%3C%2FP%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CH2%20id%3D%22toc-hId--787367102%22%20id%3D%22toc-hId--760527335%22%3EPerforming%20an%20In-Place%20eDiscovery%20search%3C%2FH2%3E%0A%3CP%3ELet%E2%80%99s%20take%20a%20look%20at%20how%20one%20discovery%20manager%20performs%20an%20In-Place%20eDiscovery%20search.%3C%2FP%3E%0A%3CP%3ERobin%20works%20on%20the%20legal%20team%20at%20marketing%20firm%20Contoso.%20Contoso%20receives%20a%20request%20from%20a%20company%20called%20Tailspin%20Toys%20to%20assist%20with%20a%20marketing%20campaign%20for%20a%20new%20toy%20they%20are%20producing.%20Contoso%20is%20known%20for%20doing%20great%20toy%20marketing%20campaigns%20since%20they%20do%20a%20lot%20of%20work%20in%20the%20toy%20industry.%20This%20is%20great%20for%20business%20but%20they%20also%20have%20to%20be%20careful%20because%20many%20of%20the%20toy%20companies%20with%20which%20they%20work%20are%20competitors.%20Contoso%20just%20finished%20a%20highly%20successful%20marketing%20campaign%20with%20another%20toy%20company%20called%20Wingtip%20Toys%20and%20Robin%20wants%20to%20ensure%20that%20there's%20no%20confidential%20information%20that%20may%20accidentally%20get%20past%20from%20one%20customer%20to%20another%20through%20his%20team.%20To%20that%20end%2C%20Robin%20wants%20to%20search%20through%20her%20company's%20email%20and%20documents%20with%20the%20help%20of%20her%20legal%20team%20to%20make%20sure%20there%20are%20no%20potential%20issues.%3C%2FP%3E%0A%3CP%3ETo%20use%20In-Place%20eDiscovery%2C%20a%20user%20must%20be%20%3CA%20title%3D%22See%20'Add%20a%20User%20to%20the%20Discovery%20Management%20Role%20Group'%20in%20Exchange%202013%20Preview%20documenation%22%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fdd298059%2528v%3Dexchg.150%2529.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Edelegated%20the%20Discovery%20Management%20role%20group%3C%2FA%3E.%20You%20can%20delegate%20the%20role%20to%20authorized%20legal%2C%20compliance%20management%20or%20human%20resources%20personnel.%20Robin%20is%20one%20of%20those%20legal%20team%20members.%20This%20ability%20to%20have%20scoped%20roles%20in%20the%20new%20Exchange%202013%20allows%20IT%20Pros%20to%20delegate%20compliance%20responsibilities%20to%20folks%20like%20Robin%20without%20giving%20them%20full%20access%20to%20all%20Exchange%20server%20functionality.%3C%2FP%3E%0A%3CP%3ERobin%20starts%20by%20navigating%20to%20the%20Exchange%20Administration%20center%20Center.%20The%20%3CACRONYM%20title%3D%22Exchange%20Administration%20Center%22%3EEAC%3C%2FACRONYM%3E%E2%80%99s%20%3CSPAN%20class%3D%22UI%22%3ECompliance%20Management%3C%2FSPAN%3Etab%20is%20where%20you%20can%20manage%20compliance%20features%20in%20the%20new%20Exchange.%20Because%20Robin%20doesn%E2%80%99t%20have%20any%20other%20Exchange%20administrator%20roles%2C%20she%20only%20sees%20the%20interface%20relevant%20to%20the%20Discovery%20Management%20role%20group.%20On%20the%20compliance%20management%20tab%2C%20she%20can%20only%20see%20%3CSPAN%20class%3D%22UI%22%3EIn-Place%20eDiscovery%20%26amp%3B%20Hold%3C%2FSPAN%3E.%3C%2FP%3E%0A%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2FTNBlogsFS%2Fprod.evol.blogs.technet.com%2FCommunityServer.Blogs.Components.WeblogFiles%2F00%2F00%2F00%2F31%2F06%2Fpostimages%2F2577.In-PlaceeDiscovery-Fig1.png%22%20alt%3D%22%22%20%2F%3E%20%3CBR%20%2F%3E%3CSPAN%20class%3D%22caption%22%3E%3CSPAN%20class%3D%22bold%22%3EFigure%201%3A%3C%2FSPAN%3EIn-Place%20eDiscovery%20and%20Hold%20tab%20is%20accessible%20to%20users%20with%20delegated%20Discovery%20Management%20permissions%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EShe%20clicks%20on%20the%20%3CSPAN%20class%3D%22UI%22%3EAdd%3C%2FSPAN%3Ebutton%20to%20start%20the%20%3CSPAN%20class%3D%22UI%22%3ENew%20new%20In-Place%20eDiscovery%20%26amp%3B%20Hold%3C%2FSPAN%3Ewizard%20and%20enters%20a%20name%20and%20an%20optional%20description%20for%20the%20search.%3C%2FP%3E%0A%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2FTNBlogsFS%2Fprod.evol.blogs.technet.com%2FCommunityServer.Blogs.Components.WeblogFiles%2F00%2F00%2F00%2F31%2F06%2Fpostimages%2F5126.In-PlaceeDiscovery-Fig2.png%22%20alt%3D%22%22%20%2F%3E%20%3CBR%20%2F%3E%3CSPAN%20class%3D%22caption%22%3E%3CSPAN%20class%3D%22bold%22%3EFigure%202%3A%3C%2FSPAN%3ECreate%20an%20In-Place%20eDiscovery%20search%20using%20the%20new%20In-Place%20eDiscovery%20%26amp%3B%20Hold%20wizard%20in%20%3CACRONYM%20title%3D%22Exchange%20Administration%20Center%22%3EEAC%3C%2FACRONYM%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3ERobin%20can%20search%20all%20mailboxes%20in%20the%20Exchange%20organization%20or%20select%20the%20mailboxes%20she%20wants%20to%20search.%3C%2FP%3E%0A%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2FTNBlogsFS%2Fprod.evol.blogs.technet.com%2FCommunityServer.Blogs.Components.WeblogFiles%2F00%2F00%2F00%2F31%2F06%2Fpostimages%2F2816.In-PlaceeDiscovery-Fig3.png%22%20alt%3D%22%22%20%2F%3E%20%3CBR%20%2F%3E%3CSPAN%20class%3D%22caption%22%3E%3CSPAN%20class%3D%22bold%22%3EFigure%203%3A%3C%2FSPAN%3ESpecify%20mailboxes%20(to%20search%20or%20search%20all%20mailboxes)%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EOn%20the%20%3CSPAN%20class%3D%22UI%22%3ESearch%20query%3C%2FSPAN%3Epage%2C%20Robin%20can%20select%20the%20option%20to%20return%20all%20mailbox%20content%20or%20just%20specific%20content.%20Robin%20wants%20to%20find%20specific%20content%20related%20to%20work%20done%20between%20hers%20team%20members%20and%20WingTip%20Toys.%20She%20has%20the%20option%20to%20perform%20a%20simple%20search%20by%20just%20entering%20in%20a%20few%20key%20words%20or%20more%20complex%20search%20if%20she%20wants%20with%20Boolean%20operators%20like%20ANDs%2C%20ORs%2C%20parenthesis%2C%20etc.%20so%20she%20can%20be%20very%20specific%20as%20to%20what%20she%20is%20looking%20for.%20This%20can%20be%20a%20big%20time%20and%20cost%20savings%20for%20her%20since%20multiple%20gigabyte%20mailboxes%20are%20very%20common%20and%20she%20wants%20to%20reduce%20that%20set%20of%20content%20down%20to%20the%20minimum%20amount%20she%20needs%20to%20look%20at%20to%20find%20what%20she%20wants.%3C%2FP%3E%0A%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2FTNBlogsFS%2Fprod.evol.blogs.technet.com%2FCommunityServer.Blogs.Components.WeblogFiles%2F00%2F00%2F00%2F31%2F06%2Fpostimages%2F1070.In-PlaceeDiscovery-Fig4.png%22%20alt%3D%22%22%20%2F%3E%20%3CBR%20%2F%3E%20%3CSPAN%20class%3D%22caption%22%3E%3CSPAN%20class%3D%22bold%22%3EFigure%204%3A%3C%2FSPAN%3ESpecify%20a%20search%20query%2C%20including%20keywords%2C%20start%20and%20end%20dates%2C%20sender%20and%20recipients%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EIn%20addition%20to%20using%20Boolean%20logic%20she%E2%80%99s%20also%20using%20the%20%3CSPAN%20class%3D%22newterm%22%3Eproximity%3C%2FSPAN%3Eoperator%20(NEAR)%2C%20which%20allows%20her%20to%20find%20words%20that%20are%20close%20to%20each%20other.%20You%20can%20also%20see%20her%20using%20a%20wildcard%20character%20so%20in%20this%20case%20she%20is%20looking%20for%20the%20word%20wingtip%20within%20three%20words%20of%20toy%2C%20toys%2C%20toymaker%20or%20anything%20similar.%3C%2FP%3E%0A%3CP%3EIn%20this%20particular%20case%2C%20Robin%20wants%20to%20look%20for%20these%20keywords%20anywhere%20in%20a%20given%20email%2C%20but%20if%20she%20wants%20to%20be%20more%20specific%2C%20for%20example%20search%20for%20a%20phrase%20only%20in%20the%20message%20subject%2C%20she%20could%20type%20in%20Subject%3A%20and%20then%20her%20phrase%20right%20after%20it.%20Depending%20on%20how%20specific%20she%20wants%20to%20be%2C%20she%20can%20create%20complex%20queries.%20You%20can%20use%20several%20hundred%20keywords%20in%20a%20query.%3C%2FP%3E%0A%3CP%3EShe%20can%20also%20choose%20specific%20types%20of%20messages.%20An%20Exchange%20mailbox%20has%20email%20but%20also%20calendar%20items%2C%20tasks%2C%20notes%20and%20other%20items%20related%20to%20personal%20information%20management.%20The%20new%20Exchange%20allows%20her%20to%20search%20all%20of%20those%20items%20or%20she%20can%20narrow%20the%20query%20down%20to%20specific%20types%20of%20items.%20She%20selects%20email%20and%20also%20meetings%20so%20she%20can%20track%20which%20ones%20of%20her%20employees%20met%20with%20Wingtip%20and%20read%20the%20meeting%20invites%20to%20find%20out%20what%20was%20discussed.%3C%2FP%3E%0A%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2FTNBlogsFS%2Fprod.evol.blogs.technet.com%2FCommunityServer.Blogs.Components.WeblogFiles%2F00%2F00%2F00%2F31%2F06%2Fpostimages%2F4375.In-PlaceeDiscovery-Fig5.png%22%20alt%3D%22%22%20%2F%3E%20%3CBR%20%2F%3E%3CSPAN%20class%3D%22caption%22%3E%3CSPAN%20class%3D%22bold%22%3EFigure%205%3A%3C%2FSPAN%3ESelect%20all%20message%20types%20or%20specify%20the%20message%20types%20to%20search%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EOnce%20Robin%20has%20created%20hers%20query%20to%20define%20what%20content%20is%20important%20to%20her%2C%20she%20has%20a%20few%20options%20in%20terms%20of%20what%20to%20do%20with%20the%20results.%20If%20she%20feels%20it's%20important%20to%20protect%20this%20content%20she%20has%20the%20option%20to%20place%20it%20on%20hold.%20When%20content%20is%20placed%20on%20hold%2C%20Exchange%20automatically%20captures%20any%20attempts%20to%20edit%20or%20delete%20or%20delete%20data%20and%20stores%20those%20items%20in%20a%20hidden%20folder%20in%20the%20mailbox.%20It's%20completely%20invisible%20to%20the%20end-users%20so%20it%20doesn't%20interrupt%20their%20daily%20workflow%2C%20but%20it%20does%20keep%20that%20important%20data%20for%20recovery%20later.%3C%2FP%3E%0A%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2FTNBlogsFS%2Fprod.evol.blogs.technet.com%2FCommunityServer.Blogs.Components.WeblogFiles%2F00%2F00%2F00%2F31%2F06%2Fpostimages%2F6366.In-PlaceeDiscovery-Fig6.png%22%20alt%3D%22%22%20%2F%3E%20%3CBR%20%2F%3E%3CSPAN%20class%3D%22caption%22%3E%3CSPAN%20class%3D%22bold%22%3EFigure%206%3A%3C%2FSPAN%3EPlacing%20search%20results%20on%20an%20In-Place%20Hold%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EWe%20will%20talk%20more%20about%20In-Place%20Hold%20in%20Part%20II%20of%20this%20post.%3C%2FP%3E%0A%3CP%3ERobin%20clicks%20Finish.%20The%20search%20is%20running%20against%20Exchange%202013%20mailboxes%20and%20placing%20items%20on%20hold.%3C%2FP%3E%0A%3CP%3EWhen%20the%20search%20is%20complete%2C%20Robin%20takes%20a%20look%20at%20the%20total%20size%20and%20item%20count%20to%20see%20if%20it%E2%80%99s%20manageable.%20If%20there%20are%20a%20million%20items%2C%20her%20query%20is%20likely%20too%20broad%3B%2C%20if%20there%20are%20no%20items%2C%20it%20may%20be%20too%20narrow.%20If%20she%20wants%20to%20dig%20into%20the%20details%2C%20she%20can%20view%20the%20search%20statistics%20to%20see%20exactly%20how%20each%20keyword%20contributed%20to%20the%20overall%20result%20set.%20That%20lets%20her%20really%20be%20targeted%20about%20the%20way%20she's%20tweaking%20her%20queries%20so%20she%20can%20quickly%20get%20a%20result%20set%20down%20to%20a%20manageable%20size.%3C%2FP%3E%0A%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2FTNBlogsFS%2Fprod.evol.blogs.technet.com%2FCommunityServer.Blogs.Components.WeblogFiles%2F00%2F00%2F00%2F31%2F06%2Fpostimages%2F3365.In-PlaceeDiscovery-Fig7.png%22%20alt%3D%22%22%20%2F%3E%20%3CBR%20%2F%3E%3CSPAN%20class%3D%22caption%22%3E%3CSPAN%20class%3D%22bold%22%3EFigure%207%3A%3C%2FSPAN%3EUse%20search%20estimate%20and%20keyword%20statistics%20to%20fine-tune%20search%20queries%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EOnce%20she%20is%20done%20tweaking%20her%20query%2C%20she%20can%20stop%20the%20search%20and%20discuss%20with%20her%20team%20or%20legal%20counsel%20whether%20the%20query%20is%20correct.%20She%20can%20also%20create%20additional%20eDiscovery%20searches%20and%20use%20different%20query%20parameters.%3C%2FP%3E%0A%3CP%3EShe%20can%20also%20choose%20to%20preview%20messages%20returned%20in%20the%20search.%3C%2FP%3E%0A%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2FTNBlogsFS%2Fprod.evol.blogs.technet.com%2FCommunityServer.Blogs.Components.WeblogFiles%2F00%2F00%2F00%2F31%2F06%2Fpostimages%2F5684.In-PlaceeDiscovery-Fig8.png%22%20alt%3D%22%22%20%2F%3E%20%3CBR%20%2F%3E%3CSPAN%20class%3D%22caption%22%3E%3CSPAN%20class%3D%22bold%22%3EFigure%208%3A%3C%2FSPAN%3EeDiscovery%20Search%20Preview%20to%20preview%20messages%20and%20determine%20query%20effectiveness%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EThe%20%3CSPAN%20class%3D%22UI%22%3EeDiscovery%20Search%20Preview%3C%2FSPAN%3Edisplays%20message%20count%20and%20total%20size%20for%20each%20mailbox%20searched.%20The%20preview%20functionality%20is%20built%20on%20Outlook%20Web%20App%2C%20which%20shows%20the%20message%20in%20its%20native%20format%20without%20any%20changes.%3C%2FP%3E%0A%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2FTNBlogsFS%2Fprod.evol.blogs.technet.com%2FCommunityServer.Blogs.Components.WeblogFiles%2F00%2F00%2F00%2F31%2F06%2Fpostimages%2F1033.In-PlaceeDiscovery-Fig9.png%22%20alt%3D%22%22%20%2F%3E%20%3CBR%20%2F%3E%3CSPAN%20class%3D%22caption%22%3E%3CSPAN%20class%3D%22bold%22%3EFigure%209%3A%3C%2FSPAN%3EeDiscovery%20Search%20Preview%20displays%20live%20message%20preview%20without%20copying%20messages%20to%20a%20Discovery%20mailbox%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3ERobin%20can%20quickly%20scroll%20through%20all%20of%20her%20results%20to%20view%20additional%20items%20that%20came%20back%20with%20her%20search.%20Since%20she%20is%20using%20the%20full-%20fidelity%20Outlook%20Web%20App%20preview%2C%20she%20can%20also%20view%20attachments.%3C%2FP%3E%0A%3CP%3EOnce%20Robin%20has%20previewed%20her%20results%20and%20she's%20happy%20with%20them%2C%20she%20can%20make%20a%20copy%20for%20of%20them%20for%20later%20review%2C%20or%20export%20them%20so%20that%20she%20can%20export%20them%20to%20handoff%20to%20her%20outside%20legal%20counsel.%20To%20do%20that%2C%20she%20simply%20clicks%20on%20the%20%3CSPAN%20class%3D%22UI%22%3ECopy%20search%20results%3C%2FSPAN%3Elink.%3C%2FP%3E%0A%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Flegacyfs%2Fonline%2Fmedia%2FTNBlogsFS%2Fprod.evol.blogs.technet.com%2FCommunityServer.Blogs.Components.WeblogFiles%2F00%2F00%2F00%2F31%2F06%2Fpostimages%2F4274.In-PlaceeDiscovery-Fig10.png%22%20alt%3D%22%22%20%2F%3E%20%3CBR%20%2F%3E%3CSPAN%20class%3D%22caption%22%3E%3CSPAN%20class%3D%22bold%22%3EFigure%2010%3A%3C%2FSPAN%3ECopying%20messages%20returned%20by%20the%20search%20to%20a%20Discovery%20mailbox%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EWhen%20copying%20messages%20to%20a%20discovery%20mailbox%2C%20she%20has%20the%20following%20options%3A%3C%2FP%3E%0A%3CUL%20class%3D%22arrowlist%22%3E%0A%3CLI%3E%3CSPAN%20class%3D%22bold%22%3EInclude%20unsearchable%20items%3C%2FSPAN%3EShe%20can%20choose%20whether%20she%20wants%20to%20include%20%22unsearchable%22%20items%2C%20items%20that%20our%20indexing%20system%20may%20not%20be%20able%20to%20handle%2C%20such%20as%20a%20corrupted%20item%2C%20a%20password-protected%20zip%20attachment%2C%20or%20an%20item%20encrypted%20with%20something%20other%20than%20Information%20Rights%20Management.%20This%20check%20box%20gives%20her%20the%20option%20to%20include%20those%20two%20in%20case%20she%20wants%20to%20review%20them%20manually%20just%20to%20make%20sure%20she's%20doing%20her%20due%20diligence%20and%20not%20missing%20anything.%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%20class%3D%22bold%22%3EEnable%20de-duplication%3C%2FSPAN%3EShe%20also%20has%20the%20option%20to%20enable%20de-duplication.%20As%20you%20know%2C%20it's%20very%20common%20to%20send%20email%20to%20multiple%20people%20at%20once.%20De-duplication%20allows%20her%20to%20reduce%20that%20down%20to%20only%20one%20copy%20so%20there%20are%20fewer%20messages%20to%20review.%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%20class%3D%22bold%22%3EEnable%20full%20logging%3C%2FSPAN%3EShe%20can%20also%20keep%20a%20full%20log%20of%20research%20results%20of%20she%20wants%2C%20which%20includes%20a%20complete%20list%20of%20every%20item%20she%20found.%20This%20is%20especially%20useful%20for%20de-duplication%2C%20since%20if%20you%20duplicate%20you%20only%20keep%20one%20copy%20of%20a%20message%20that%20multiple%20people%20may%20have.%20Later%20on%2C%20you%20she%20may%20have%20a%20need%20to%20know%20if%20one%20person%20had%20it%20in%20his%20inbox%20and%20it%20was%20flagged%20as%20important%2C%20but%20another%20person%20moved%20it%20into%20his%20deleted%20items%20folder%20and%20never%20read%20it.%20All%20that%20information%20is%20in%20that%20log.%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%20class%3D%22bold%22%3EEmail%20notification%3C%2FSPAN%3EShe%20can%20also%20choose%20to%20have%20an%20email%20sent%20to%20her%20when%20the%20copy%20process%20completes.%20If%20search%20results%20return%2020-30%20GB%20of%20data%2C%20it%20can%20take%20a%20while%20to%20copy%20them%20to%20a%20discovery%20mailbox.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EThe%20last%20thing%20Robin%20will%20pick%20is%20the%20Discovery%20mailbox%20into%20which%20she%20wants%20to%20put%20her%20search%20results.%3C%2FP%3E%0A%3CP%3EAfter%20copying%20is%20completed%2C%20Robin%20can%20see%20that%20the%20copy%20operation%20is%20complete%20and%20she%20has%20a%20link%20to%20the%20mailbox%20where%20the%20results%20are%20stored.%20Robin%20can%20now%20navigate%20to%20the%20copy%20of%20her%20search%20results%20to%20view%20them.%20In%20this%20view%2C%20she%20does%20have%20the%20ability%20to%20perform%20a%20review%20on%20her%20items%2C%20she%20can%20tag%20items%20that%20are%20important%2C%20or%20if%20she%20decides%20some%20are%20not%20important%2C%20she%20can%20take%20them%20and%20move%20them%20to%20the%20deleted%20items%20folder%20so%20that%20they%20are%20no%20longer%20in%20her%20view.%3C%2FP%3E%0A%3CP%3EOnce%20that's%20done%2C%20if%20Robin%20needs%20to%20share%20the%20consolidated%20results%20with%20an%20outside%20counsel%2C%20she%20can%20use%20her%20Outlook%20client%20to%20export%20the%20consolidated%20results%20list%20to%20a%20PST%20file.%3C%2FP%3E%0A%3CP%3EWe%E2%80%99ve%20provided%20you%20with%20an%20overview%20of%20the%20In-Place%20eDiscovery%20%26amp%3B%20In-Place%20Hold%20functionality%20in%20the%20new%20Exchange.%20In%20Part%20II%20of%20this%20post%2C%20which%20is%20scheduled%20to%20be%20published%20shortly%2C%20we%20will%20dig%20deeper%20into%20In-Place%20Hold.%3C%2FP%3E%0A%3CP%3EBharat%20Suneja%20and%20Julian%20Zbogar-Smith%3C%2FP%3E%0A%3CP%20class%3D%22note%22%3EGo%20to%20%3CA%20class%3D%22bold%22%20title%3D%22Check%20out%20In-Place%20eDiscovery%20and%20In-Place%20Hold%20in%20the%20New%20Exchange%20%E2%80%93%20Part%20II%22%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fb%2Fexchange%2Farchive%2F2012%2F09%2F28%2Fin-place-ediscovery-and-in-place-hold-in-the-new-exchange-part-ii.aspx%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3EIn-Place%20eDiscovery%20and%20In-Place%20Hold%20in%20the%20New%20Exchange%20%E2%80%93%20Part%20II%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-598792%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECompliance%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%202013%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Emailbox%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Figure 1: In-Place eDiscovery and Hold tab is accessible to users with delegated Discovery Management permissions
She clicks on the Add button to start the New new In-Place eDiscovery & Hold wizard and enters a name and an optional description for the search.
‎09-27-2012 04:09 AM
The new features sound very handy. Thanks for the update!
‎09-27-2012 01:25 PM
The ability to give end users a tool to perform eDiscovery searches without the need for IT is great. But, if the screenshots are not leaving out a query-building UI, then there is a problem. Robin, as an end user, is not going to know the syntax to create the query and will end up calling the Help Desk for help. The Help Desk staff won't know the query syntax either, so the case will be escalated. We then have a situation of senior IT staff having to create all the queries. This is better than IT staff having to perform the search and deliver the results, but the ideal is to provide a tool that the end user is able to intuitively use without assistance.
These look like some very promising changes. I do have two questions: 1) Can you really search ALL mailboxes? We have over 100,000 mailboxes in the cloud. What would be the side effects of running a full on discovery search for all of those? 2) Why is there still no Export to PST feature from the web client? It seems like that would be a slam dunk for you to implement.
@Mike, @Marc K: Thanks for the great feedback!
@Marc K: Query-builder UI is not included, but the syntax (see
Keyword Query Language (KQL) syntax reference) is fairly simple and very similar to the query syntax end-users use to search email in Outlook and Outlook Web App. It consists of key-value pairs and logical operators (AND/OR... etc. and the new NEAR operator).
‎09-28-2012 07:01 PM
@Rachel: Thanks for the feedback re PST export from EAC.
Regarding searching all mailboxes, you can't search a 100,000 mailboxes in the cloud using the EAC. You can use PowerShell or use multiple searches. See:
Exchange 2010 Discovery: Modify the maximum number of mailboxes searched
Search All Mailboxes with Windows PowerShell
‎10-01-2012 04:40 AM
"You can also see her using a wildcard character so in this case she is looking for the word wingtip within three words of toy, toys, toymaker or anything similar."
Great post but I can't seem to find the Wildcard in the query displayed in the figure. Though I could be missing something else.
‎10-01-2012 06:22 AM
@ASHigginbotham: Thanks for catching that - the screenshot has been updated.