In this article we look at ways to use In-Place E-Discovery in Ms Exchange Server
To make use of the In-Place E-Discovery feature in MS Exchange, a user has to be added to the Discovery management role group. By adding a user to the Discovery Management role group, you enable them to use the In-Place E-Discovery feature, for searching messages across mailboxes. Therefore, before you add a user, you should be sure about their activities. A search can also be performed in Exchange Admin Center (EAC), to enable the non – tech staff for using the feature. You can also make use of the Exchange Management Shell for searching. The usage of the feature has been described below, in detail.
Using In-Place E-Discovery
When you are using the (EAC) for making a search, by using the In-Place E-Discovery and Hold Wizard, you can create an In-place E-discovery, along with using In-Place Hold, for placing the results of search on hold. Once you have created an In-place E-discovery search, a search object will be created in the system mailbox of In-Place E-Discovery. You can the manipulate this object to take multiple actions with your searches, like starting, modifying, removing, etc. After creating a search, you can opt for receiving estimates of search results, like keyword statistics, for determining effectiveness of the query. The search results can be previewed, for viewing message content, knowing the total number of messages that are returned from each source mailbox, and then using these results for fine tuning query.
If the results of the query are as per your satisfaction, you can copy them to Discovery Mailbox, export the contents or a complete Discovery Mailbox to PST file.
Do not forget to specify the given parameters while designing an In-Place E-Discovery search.
Name: The search is identified using the Search name. Everytime results of a search are copied to a Discovery Mailbox, it creates a folder, with the same name and timestamps. This is done to enable unique identification of search results from Discovery mailboxes.
Sources: While searching mailboxes across MS Exchange, you might opt for specifying the mailboxes you would want to search, or search across all mailboxes in the Exchange Organization. You also have the option of searching across public folders. The same search can be used for placing items on hold, but this will require you to specify mailboxes. By specifying a distribution group, you can include those users of the mailbox who are also a part of the group. Group membership is counted only at the time of creating a search, and any changes made later, will not be reflected automatically. Both, the primary as well as the archived mailboxes, belonging to a user, are included in the search. In case you are unable to search a specific mailbox due to data corruption, please perform a recover Exchange application.
Search Query: To reduce the results of your search, you can enter search criteria relevant to the search or simply specify mailboxes, to limit search results. The search criteria should always include the following:
- Keywords
- Start and End dates
- Senders and Recipients
- Message Types
- Attachments
- Unsearchable Items
- Encrypted Items
- De – Duplication
- IRM Protected Items
Author Introduction:
Van Sutton is a data recovery expert in DataNumen, Inc., which is the world leader in data recovery technologies, including repair Outlook pst file damage and bkf recovery software products. For more information visit www.datanumen.com
1