ediscovery in sharepoint 2013 - diwug
DESCRIPTION
My presentation about eDiscovery in SharePoint 2013 for the DIWUG (Dutch Information Workers User Group) meeting of 26 February 2014TRANSCRIPT
Who am I?
Maarten Eekels
Top 100 SharePoint Influencers 2014
What is eDiscovery?Electronic discovery is the process to identify, preserve, search, process, and produce electronic content or electronically stored information(ESI) for a legal request or investigation
Identify and Preserve
Search and Process
Review
Produce
eDiscovery process
Processing
Analysis
Information Management Identification Review Production Presentation
Preservation
Collection
Volume
Relevance
eDiscovery Case Lifecycle
5
Create New case
Create eDiscovery Set
Place Legal Hold
Refine Content
Export Content
Release Hold
Close Case
Conceptual architecture
eDiscovery user
eDiscovery case
eDiscovery center
Search Service
Application
File shares SharePoint Exchange Lync
eDiscovery compatibility
Source
Search In-Place Hold Export
On-Premises
Office 365On-
PremisesOffice 365
On-Premises
Office 365
SharePoint 2013 Yes Yes Yes Yes Yes Yes
SharePoint 2010 Yes No No No Yes No
SharePoint 2007 Yes No No No Yes No
Exchange 2013 Yes Yes Yes Yes Yes Yes
Exchange 2010 No No No No No No
Lync 2013 (when archived in Exchange 2013)
Yes Yes Yes Yes Yes Yes
Lync 2010 No No No No No No
Indexed File shares Yes No No No Yes No
SearchUse To Example
AND Find content that contains all of the words or phrases it separates.
risk AND value AND VAR finds content that contains all three words.
OR Find content that contains either of the words or phrases it separates.
risk OR VAR finds all the content that contains either word.
NOT Exclude content that contains the term within a phrase.
Executive NOT Summary finds all the content that contains the phrase Executive, unless the content also contains the term Summary.
( ) Group words or phrases to show the order in which they are applied.
(Risk AND management) OR (VAR or Value-at-risk)
NEAR(n)
Finds words that are near each other, where n equals the number of words apart. If no number is specified, the default distance is 8 words.
Mid NEAR(5) Office finds Mid and Back Office and Mid-Office and Mid, Back, and Front Office
“ “ Search for specific phrases. “risk management” finds the exact phrase
Wildcard (*) Find terms that contain the root word and any additional letters.
risk* finds risk, risks, risked, risking, and risky
In-Place Hold in SharePoint 2013 Enabling and disabling Hold based on timer job Items are placed in a hidden library (Preservation Hold
Library) in the same SharePoint site Lists items, social feeds, documents, and pages are
covered Supports multiple holds, preserved content is cleaned
up after the last hold is released Site collection and farm admins cannot delete the hold
data or site Versions cannot be deleted when the site is on hold Version history is preserved when an item is deleted
In-Place Hold in Exchange 2013 Enabling and disabling Hold based on Exchange Web
Services Items are placed in a hidden folder (DiscoveryHold) in
the Recoverable Items store of a user’s mailbox All edits and deletes are retained Content is always held 30 days after deletion date Supports multiple holds, preserved content is cleaned
up after the last hold is released
Export of the content Documents: Documents are exported from file shares. Documents and
their versions (optional) are exported from SharePoint. Lists: If a list item is included in the query results, the whole list is
exported as a comma-separated values (.csv) file. Pages: SharePoint pages, such as wiki pages or blogs, are exported as
MIME HTML (.mht) files, including styling and mark-up. Exchange objects: Items in an Exchange Server 2013 mailbox, such as
tasks, calendar entries, contacts, email messages and attachments are exported as a.pst file. If Lync conversations are archived in Exchange, those can be discovered and exported, too.
Crawl log errors: To identify content that could not be indexed. An XML manifest that provides an overview of the exported information.
Demo
Important considerations
Identify content Identify the locations that contain content that can be discovered. Is it just SharePoint, Exchange and Lync, or file shares
as well? Does every SharePoint site need to be discoverable?
Permissions Consider the permissions that you have to grant to eDiscovery users. eDiscovery users need access to all discoverable
content, both in SharePoint and Exchange (and file shares if required)
Storage Consider the storage location capacity to hold the litigation content. If content is not changed much, not a lot of additional
storage is required, but if content is changed, a copy of that content is preserved.
Number of eDiscovery centers One for each Search Service Application and one for each Exchange Forest
Performance Several performance considerations of running eDiscovery queries. Adding more sources increases the number and
complexity of queries. Complex queries (with more operators: AND, OR, NEAR) have more impact on performance.
High level configuration
15
Install Exchange Web Services API
Configure Communication Between Servers
Create eDiscovery Center
Grant Permissions
Configure Search
ResourcesElectronic Discovery Reference Modelhttp://www.edrm.net/resources/edrm-stages-explained
eDiscovery in SharePoint Server 2013 and Exchange Server 2013http://technet.microsoft.com/nl-nl/sharepoint/jj650012.aspx
Intro to eDiscovery in SharePoint, Exchange, and Lync 2013http://blogs.office.com/2012/11/08/intro-to-ediscovery-in-sharepoint-exchange-and-lync-2013/
eDiscovery Flow Across SharePoint, Exchange, Lync, and File Shareshttp://www.microsoft.com/en-ie/download/details.aspx?id=39349
Questions?Maarten Eekels@[email protected]