IT tutorials
 
Technology
 

Microsoft Exchange Server 2013 : Preserving information (part 5) - Retrieving discovered content

11/21/2014 3:25:57 AM
- How To Install Windows Server 2012 On VirtualBox
- How To Bypass Torrent Connection Blocking By Your ISP
- How To Install Actual Facebook App On Kindle Fire

Retrieving discovered content

When investigators confirm that a search is correctly focused on the items that are necessary, they can proceed to the final stage in the process: copying items from user mailboxes into a discovery mailbox where the items can be reviewed and dealt with as necessary. When you select Copy Search Results, EAC displays the screen shown in Figure 11.

A screen shot showing the options available when copying items from source mailboxes to a discovery mailbox. The four options are selected so the search will include unsearchable items, perform de-duplication, generate a full log, and send the searcher an email when everything is complete. Another field allows the selection of the discovery mailbox to store the copied items.

Figure 11. Setting parameters to copy items found by a search

The options available are:

  • Include Unsearchable Items. Although a query used with an in-place hold cannot be guaranteed to find matching content in unsearchable items, search and copy can locate matching unsearchable items based on item properties such as Subject. Therefore, you can include unsearchable items when instructing search to copy items from user mailboxes. To hold everything in a mailbox, including any unsearchable items, apply a litigation hold or an in-place hold that doesn’t have an associated query.

  • Enable De-duplication. It is the nature of email systems to have identical items in user mailboxes. For example, a message you send to 14 recipients starts by being discoverable in 15 mailboxes. Gradually, the number of discoverable copies reduces as recipients delete their copy, but a search inevitably turns up multiple copies of items. De-duplication causes the search to retrieve a single copy (the first copy encountered); you depend on the recipient list for the item to understand who actually received it. Apart from the system overhead incurred to copy and store every instance of a message found in the searched mailboxes, providing extra copies of messages drives up the cost of responding to legal discovery actions if the lawyers or other individuals who review the search results are paid on a per-item basis. De-duplication might or might not be acceptable to your legal team. If de-duplication is not used, a search copies every copy of matching items it finds, no matter the number of mailboxes in which the items are located. Exchange 2013 does not support thread compression at this point.

  • Enable Full Logging. The default is to use basic logging when copying items. Full logging generates comprehensive details of what’s been done to fetch items from user mailboxes.

  • Send Me Email When The Copy Is Completed. Copying items located by a search can take an awfully long time (defined as being longer than a coffee break), especially if gigabytes of information have to be retrieved from remote Mailbox servers. Asking Exchange to send you an update to let you know when everything is done is simple good sense and can enable you to do more valuable work in the interim.

Note

In terms of de-duplication, you should remember that because Exchange does not expand the membership of a group into a message header, seeing that a message was delivered to a group doesn’t tell you whether someone received a copy because there’s no way of proving what the membership of the group was at the point when the transport service expanded the group membership and delivered the message.

When you click Copy, EAC updates the search metadata and launches the search and copy operation. Items are copied in the background and, eventually, you receive an email similar to that shown in Figure 12 informing you that the search and copy operation has completed.

This is an example of the kind of text included in the email sent to a searcher after a copy operation is complete. The source mailboxes processed by the search and some statistics, such as the number of items found and the size of the copied items, are displayed.

Figure 12. Email stating that the search and copy operation completed

After notification that the search has finished copying items, you can return to EAC. At this point, the properties of the search shown in the details pane should reveal the number of items the search found. It also has a link you can click to access the discovery mailbox storing the copied items (Figure 13). The link invokes a new Outlook Web App session connected to the discovery mailbox, assuming the user who ran the search also possesses full access permission for the discovery mailbox.

This screen shot focuses on the link EAC provides to open the discovery mailbox used to copy items identified in a search. Clicking the link opens the mailbox with Outlook Web App.

Figure 13. Link to access discovery mailbox

Inside Out Dealing with hybrid deployments

Searches conducted in hybrid deployments are quite likely to include some on-premises and some Office 365 mailboxes in the scope of their query. In this situation, searches are conducted from EAC running in the on-premises organization and using an on-premises discovery mailbox to store the copied results. Any messages found in Office 365 mailboxes are copied across the Internet, using the connections linking the on-premises organization with the Office 365 tenant.

 
Others
 
- Microsoft Exchange Server 2013 : Preserving information (part 4) - Creating a new search - Refining a search
- Microsoft Exchange Server 2013 : Preserving information (part 3) - Creating a new search
- Microsoft Exchange Server 2013 : Preserving information (part 2) - Searching mailbox content, In-place holds
- Microsoft Exchange Server 2013 : Preserving information (part 1) - Putting a mailbox on litigation hold
- Microsoft Exchange Server 2013 : How the Managed Folder Assistant implements retention policies (part 2) - Retention date calculation
- Microsoft Exchange Server 2013 : How the Managed Folder Assistant implements retention policies (part 1) - Behind the scenes with the MFA
- Sharepoint 2013 : Security and Policy - SharePoint Security Groups (part 4) - Assigning New Visitor, Member, and Owner Groups at Site Creation
- Sharepoint 2013 : Security and Policy - SharePoint Security Groups (part 3) - Creating a New Group, Deleting a Group
- Sharepoint 2013 : Security and Policy - SharePoint Security Groups (part 2) - Removing Users from a Group, Group Settings and Permissions
- Sharepoint 2013 : Security and Policy - SharePoint Security Groups - Adding Users to a Group
 
 
Top 10
 
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 2) - Wireframes,Legends
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 1) - Swimlanes
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Formatting and sizing lists
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Adding shapes to lists
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Sizing containers
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 3) - The Other Properties of a Control
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 2) - The Data Properties of a Control
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 1) - The Format Properties of a Control
- Microsoft Access 2010 : Form Properties and Why Should You Use Them - Working with the Properties Window
- Microsoft Visio 2013 : Using the Organization Chart Wizard with new data
programming4us programming4us
 
Popular tags
 
Video Tutorail Microsoft Access Microsoft Excel Microsoft OneNote Microsoft PowerPoint Microsoft Project Microsoft Visio Microsoft Word Active Directory Biztalk Exchange Server Microsoft LynC Server Microsoft Dynamic Sharepoint Sql Server Windows Server 2008 Windows Server 2012 Windows 7 Windows 8 Adobe Indesign Adobe Flash Professional Dreamweaver Adobe Illustrator Adobe After Effects Adobe Photoshop Adobe Fireworks Adobe Flash Catalyst Corel Painter X CorelDRAW X5 CorelDraw 10 QuarkXPress 8 windows Phone 7 windows Phone 8 BlackBerry Android Ipad Iphone iOS
Celebrity Style, Fashion Trends, Beauty and Makeup Tips.