In the previous blog, Microsoft 265 Advanced eDiscovery: Part 1, we discussed licensing, creating a case, and adding data sources in Advanced eDiscovery. In this week’s blog, we are going to compare and review some more features and limitations in Advanced eDiscovery.
Limits in Office 365 Advanced eDiscovery
At NearZero Discovery, we have not seen limitations in maximum number of the cases in Advance eDiscovery tool, but there are some limitations per case: here you can find a list of Limits in Advanced eDiscovery.
Some of the limitations that we faced in our projects:
- You can not rename or delete collection in a case
- Case and the review sets can be renamed
- If you add OneDrive to the data sources of the collection, you cannot easily remove that data location. Although there is the feature to change the data location, it does not work in some cases
- One of the limitations that may force you to split the case to some parts, is the maximum number of the review sets per case as it is limited to 20. In our experience, this is an important consideration before running out of the maximum number of the review sets
- There are limits that might result in an email message being returned as a partially indexed item in an eDiscovery search in Microsoft 365: Indexing limits for messages as example: The maximum size of an Excel file located on a site or attached to an email message that will be parsed for indexing is 4MB. Any Excel file that’s larger than this limit won’t be parsed, and the file or the email the message with the file attachment will be marked as unindexed.
Review Set
Advanced eDiscovery displays content via several views each. The various views can be used by clicking on any document within a review set. The viewers currently provided are:
- File metadata
- Native view
- Text view
- Annotate view
There are some preloaded default filters and more available to be customized.
To add or remove filters in a review set, select Filters to open the filter panel. It is displayed on a flyout page.
The available filters are organized in four sections: Search, Analytics & predictive coding, IDs and Item properties. You can expand each section and select or deselect filters to add or remove them in the filter set.
When you add a filter, it’s displayed in the filter set.
Close or delete an Advanced eDiscovery case
To close a case:
- On the Advanced eDiscovery page, select the case that you want to close.
- On the Settings tab, under Case Information, click Select.
Note: If the case contains any content locations on hold, those holds will be turned off. After the hold is turned off, a 30-day grace period (called a delay hold) is applied to content locations that were on hold. This gives admins an opportunity to search for or recover content that will be permanently deleted after the delay hold period expires.
Delete a case
You can delete both active and closed Advanced eDiscovery cases. When you delete a case, all components associated with the case, such as the list of custodians, communications, searches, review sets, and export job are deleted. The case is removed from the list of cases on the Advanced eDiscovery page in the Microsoft 365 compliance center. You can’t recover or reopen a deleted case.
Other Lessons Learned
- It is better to decide which data locations will be used before adding data sources.
- You can use both Edge Browser and Google Chrome for Advanced eDiscovery. However, recently, we have seen some issues in downloading exported files within Edge. So, our preference is to use Google Chrome.
- If you have a large project, try to split it in some parts. It may take few days to see the review set data if it is a big collection.
- There is no way to export the list of the data sources in a case.
- When a custodian is added to an Advanced eDiscovery case, any content that was deemed as partially indexed or had indexing errors is re-indexed to make it fully searchable. This re-indexing process is called Advanced indexing. Mostly advanced indexing or re-indexing does not work well, and indexing does not perform perfectly. Sometimes we saw odd dates in the Index date. Messages and documents with partially indexed file types can be returned in search results.
- Certain types of files, such as Bitmap or MP3 files, don’t contain content that can be indexed. As a result, the search indexing servers in Exchange and SharePoint don’t perform full-text indexing on these types of files.
- You often do not get an option to edit the collection even after all the data for review sets are ready. If just the collection fails, you may get the option to edit it.
- You can’t recover or reopen a deleted case. Before you can delete a case, you must first delete all holds associated with the case.
Would you like to learn more about our services? Email [email protected] or call 289-803-9730. We would be happy to share more details about our self-service or fully managed eDiscovery services!
