information governance and ediscovery in office 365 ediscovery deep dive
TRANSCRIPT
Part II: eDiscovery Deep DiveOctober 27, 2015
Office 365 for the Information Governance and eDiscovery
Practitioner
Part I: The Fundamentals of Office
365What is Office 365 (it’s not just email in the cloud!) but rather an entire ecosystem of applications, tools, and content. This webinar breaks it all down.
• The Office 365 plans available—and why this is important
• The primary system components (Exchange, SharePoint, and Skype for Business)
• Types of data and ESI likely to reside in Office 365
• Overview of the Information Governance and eDiscovery features built into the platform
Three-Part Webinar Series: Office 365 for the Information Governance and eDiscovery Practitioner
Part II: eDiscovery Deep Dive
• When: Tuesday, October 27 at 1:00 PM Eastern Time
Can you address some, all, or none of your eDiscovery requirements and needs using the built-in eDiscovery features of Office 365? This webinar will help organizations answer this question.
• Review of type of ESI available for discovery from Office 365
• eDiscovery Center explained: where much of the eDiscovery activity takes place
• Exchange (email) only eDiscovery
• Office 365 Compliance Center
• Pros and cons of built-in eDiscovery features
• Guest Speaker: Craig Ball
Part III: Information Governance and RIM
• When: Tuesday, November 17 at 1:00 PM Eastern Time
Office 365 provides several different approaches to the retention and disposition of data—including full records management capabilities via SharePoint. This webinar will provide an overview of the various options and approaches to managing data residing in Office 365.
• Options for records management in SharePoint and Exchange
• Security and compliance features– Data loss prevention (DLP)
– Mobile device management (MDM)
– Information Rights Management (IRM)
– Encryption
– Auditing
• Guest Speaker: John Holliday
http://dtiglobal.com/news-events/events
Recording
Available!
Housekeeping
• Today’s webinar is being recorded and will be available for download within 1-2 days
• If you experience technical problems please call 888-447-1119 and press “2”
• To make comments or ask questions- type and enter via the “Chat” function
4
Guest Speaker
Craig Ball, Esq., ESI Special Master and Attorney, Computer Forensics Examiner, Author and Educator
Craig is a trial lawyer, computer forensic examiner, law professor and noted authority on electronic evidence. He limits his practice to serving as a court-appointed special master and consultant in computer forensics and electronic discovery.
5
John Collins, JD, Director of Information Governance Solutions, DTI
John Collins, J.D., DTI’s Director of Information Governance Solutions, has extensive experience assisting clients with a full range of information governance initiatives, including ESI data mapping, litigation and electronic discovery readiness, and the development of e-mail management and records retention policies.
6
Agenda
• Review: what is Office 365?• eDiscovery tools in Office 365 viewed from 100k feet• Some plans do, some plans don’t (include eDiscovery tools)• Some history• ESI available for discovery in Office 365• ESI subject to Office 365’s ediscovery tools• Exchange-specific eDiscovery tools
–Live demonstration
• SharePoint eDiscovery Center–Live demonstration
• Compliance Center• Things to know about eDiscovery in Office 365
7
What is Office 365?
• Suite of Services/Products– E-mail, Instant Messaging, Collaboration, File Storage
– Office (Word, Excel, PowerPoint, Access, etc.), Exchange, SharePoint, Skype for Business
• Software as a Service (SaaS)– Individuals, companies, organizations subscribe to the service for a fixed
monthly or annual fee
• Cloud– Quintessential example of cloud computing
– Hardware, storage, backup and disaster recovery are handled by Microsoft
• Brand– Microsoft is labeling products and services as “Office 365” or part of
Office 365 (Project for Office 365, Dynamics CRM, etc.)
• Juggernaut– 84% growth in # of seats year-over-year
– 1 out of every 4 enterprise customers of Microsoft use Office 365
8
Office 365: a plan for all
• Office 365 is marketed and sold to two distinct market segments:1. Home (households, individuals, students)
2. Business (corporations, government, education, nonprofit)
9
100k View of eDiscovery Features in Office 365
• Search across one or more mailboxes and SharePoint sites
• Preserve Exchange/Outlook, SharePoint, and Skype for Business content
• “Preview” preserved content• Collect and export Exchange/Outlook,
SharePoint, and Skype for Business content
• Coming Soon! Equivio Zoom– Near-Duplicate Detection– Thread Analysis– Relevance ranking– Themes and Search
Will cover on 11/17!
10
Not all Office 365 plans include eDiscovery features
Office 365 Enterprise E1
Office 365 Enterprise E3
Office 365 Enterprise E4
Office 365 Enterprise K1
Office 365 Education E1
Office 365 Education E3
Office 365 Education E4
Office 365 Government K1
Office 365 Government E1
Office 365 Government E3
Office 365 Government E4
eDiscovery Center (SharePoint Online) No No No Yes Yes Yes NoLitigation Hold (Exchange Online) No No No No Yes Yes NoIn-Place Hold (Exchange Online) No No No No Yes Yes NoIn-Place eDiscovery (Exchange Online) No No Yes Yes Yes Yes Yes
FeatureOffice 365 Small Business
Office 365 Small Business Premium
Office 365 Midsize Business
Full Office 365 Service Comparison: https://technet.microsoft.com/en-us/office/dn788955.aspx?f=255&MSPPError=-2147217396
11
Through the Years: eDiscovery in Exchange
Exchange 4.01996
Exchange 5.51997
Exchange 20002000
Exchange 20032003
Exchange 20072006
Exchange 2010 Office 3652010
Exchange 2013
Equivio acquired Office 365 Exchange 2016
First Generation Legal Hold
Mailbox Search & Export
Second GenerationLegal Hold
Mailbox Search & Export
Third GenerationLegal Hold
Mailbox Search & Export
Clo
ud F
irst
1996: Exchange Introduced
12
Through the Years: eDiscovery in SharePoint
SharePoint Portal Server 2001
SharePoint Team Services
2002
Windows SharePoint Services 2.0 and SharePoint Portal Server 2003
Windows SharePoint Services 3.0 and MOSS 2007
SharePoint Foundation 2010 and SharePoint Server 2010 and SharePoint Enterprise 2010
Office 365(2010)
SharePoint Foundation 2013 and SharePoint Server 2013
Equivio acquired(January 2015)
SharePoint 2016
Still weak but can put non-records on
hold
Clo
ud F
irst
“Weak” legal hold introduced
eDiscovery Center
introduced
2001: SharePoint Introduced
What kinds of ESI is available for discovery from Office 365?
13
•Files of all types (Word, PowerPoint, Excel, PDF, Visio, CAD, audio, video, “Sway,” and more)
•Sites, web pages (blog, wiki, discussions, and more)
•“App” content (calendar, survey, newsfeed, announcements)
•E-mail & attachments•Contacts•Calendar
•Tasks•Notes
•Journal
•Instant Messaging chats •Voice and video call logs
•Word•Excel•PowerPoint•Outlook•OneNote•Access•Publisher
14
What ESI in Office 365 is subject to the built-in eDiscovery tools?
Exchange Public Folders
Yes No
Outlook Web App “Groups”
(rolling out)
Meeting content, recorded meetings
15
Exchange In-Place eDiscovery & Hold
Exchange In-Place eDiscovery and Hold allows an individual with appropriate permissions to search one or
more mailboxes and a) place the mailbox on hold, b) preview the search results, c) export the search results
1Create search and (optionally)
place ESI on hold
2Preview resultsRefine/modify
search
3Export
4Remove hold, delete search
One or more mailboxes
Exchange/Outlook
Boolean, Proximity,
Wildcard, date range, metadata
PST
Skype for Business
IM
Contacts
Call Logs
Notes
Meetings
IMCall logs
Journal
OWA Preview Mode
Discovery Search Mailbox
Tasks
Conversation History
16
Enabling Defensible Legal Hold: Recoverable Items Folder
• Users do not have access to the recoverable items folder
• eDiscovery search and hold does have access
17
File Formats Indexed by Exchange Search in Office 365
Email message .emlGraphics Interchange Format .gifJPEG .jpegMicrosoft Excel .xls, .xlt, .xlsx, .xlsm, .xlb, .xlc, .xlsbExcel File odbcexcelMicrosoft InfoPath .infopathmlMicrosoft Offi ce Binder .obt, obdMicrosoft PowerPoint .pptx, .pptm, .ppt, .ppsx, .ppsm, .pps, .ppam, .potm, .pot, .potxMicrosoft Publisher .pubMicrosoft Word .doc, .docm, .dotx, .dotm, .dot, .docxMicrosoft XML Paper Specification .xpsOneNote .oneOpenDocument Presentation .odpOpenDocument Spreadsheet .odsOpenDocument Text .odtOutlook Item .msgPortable Document Format .pdfRich Text .rtfText .txtvCalendar .vcsvCard .vcfVisio .vdw, .vsd, .vss, .vst, .vsx, .vtx, .vssx, .vssm, .vsdm, .vstx, .vstm, .vdxWeb archive .mhtmlWeb page .htmlXML document .xmlZIP archive .zip
AVI .aviBitmap .bmpMP3 .mp3MPEG .mpegPNG .png
Microsoft Windows Wave Audio
.wav
Items Not Indexed Include…
19
SharePoint eDiscovery Center
1Create case
2Choose sources
3Create
query/queries
4Place on hold, preview resultsrefine results
5Export
6Remove hold,
close case
One or more mailboxes
Exchange=
PST
One or more SharePoint sites
SharePoint
Boolean, Proximity,
Wildcard, date range, metadata
Filter by type of ESI
SharePoint=
Natives, .mht, .csv
EDRM load file, reports
Web Pages Files Lists
AppData
WebContent
SharePoint eDiscovery Center allows an individual with appropriate permissions to search one or more mailboxes and SharePoint sites and a) place the mailbox(s) and site(s) on hold, b) preview the search
results, c) export the search results
20
Enabling Defensible Legal Hold: Preservation Hold Library
• A “preservation hold library” is created the first time a SharePoint site is put under hold.
• Users can continue to work on content without disruption
• Content on hold-including web pages, documents, lists, and other items are preserved as needed (if user edits an item it prompts preservation)
• Users don’t see the preservation hold library• To preserve all versions of content in a site
versioning must be enabled
21
File Formats Indexed by SharePoint in Office 365
23
Compliance Center
• Introduced January 2015• Future primary location of Office 365 eDiscovery
features• Objective is to bring together compliance related
features in a single console (eDiscovery, MDM, retention, auditing, etc.)
• Currently has a mix of unique and duplicate features– Unique:
• Can search across ALL mailboxes and SharePoint sites in a single search
– Duplicate• eDiscovery link redirects to the SharePoint eDiscovery Center
• Limitations: some features are not fully baked– Example: search does not have an export or legal hold function (executing these
functions requires use of PowerShell)
https://technet.microsoft.com/EN-US/library/dn876574.aspx
24
Things to know about Office 365 built-in eDiscovery
• When users leave what happens?– If mailbox is on hold, then user is converted to inactive mailbox and subject to eDiscovery
• Maximum of 10,000 mailboxes may be searched and placed on hold via a single eDiscovery search• Maximum of 2 eDiscovery searches can run at a time• Maximum # of keywords in a single eDiscovery search: 500• Maximum # of items displayed in preview: 200• 5: maximum # of holds that can be in effect that use scoping (after that all content is put on hold)• Can take up to 1 hour for legal hold to take effect• Quota! There is a 100 gigabyte quota on the Recoverable Items folder (can be increased, requires call to
Microsoft)—hold will stop working if the quota is reached• There are some limits to the # of sources that can be selected in eDiscovery Center• Keyword statistics do not appear for searches that include 100+ mailboxes
25
Things to know about Office 365 built-in eDiscovery
• E-mail de-duplication based on hash value calculated using:– InternetMessageId– ConversationTopic– IsSentItems– BodyTagInfo
• Unsearchable items– Files and other content that can’t be indexed for various reasons:
• Image files (TIFF, non-search PDF, etc.), MP3 (Unified Messaging!), bitmap
• Partially indexed/indexing error
• Large Excel files
• Encrypted using non-Microsoft technology or S/MIME
• Password protected
– Option to include unsearchable items when copying/exporting search results
26
Concluding Thoughts
• Velocity and scope of discovery in Office 365 is a challenge– New productivity and collaboration features are rolled out constantly—just like Smartphone apps– New types of ESI (for example, “Sway”) are regularly introduced– eDiscovery and IG features are in continual development and evolution
• Hybrid– Many organizations will have a hybrid implementation of Office 365 where some users are in the cloud and some are on-prem (temporarily or
permanently)
• Fast moving area– Don’t assume your outside lawyers or service providers are up to speed
• There are limitations in the native tools– Important to know what they are and if/where they might impact your approach to discovery
• For lawyers: the bar for attaining and maintaining the duty of competency is higher
• For IG professionals: master O365’s IG and eDiscovery features and secure a voice at the table with IT
27
Learning about eDiscovery and IG in Office 365
https://technet.microsoft.com/en-us/library/dn532171.aspx
28
Keeping up with Office 365
http://success.office.com/en-us/roadmap/
DTI Information Governance Services
29
Consulting• Records and Information
Management (RIM)– Assessments
– Policies and schedules
– Program implementation
• eDiscovery and Litigation Readiness– Assessments
– eDiscovery response planning and implementation
– Process design and implementation
• ESI Data Mapping– Proactive process to “map-out” an
organization’s IT systems and ESI sources
– Proprietary “systems” and risk based approach
Technology Services• Defensible disposition and
deletion– Categorization
– Repository/application retirement
– Content audit
– File share and SharePoint cleanup
• Email and archive migration– Archive retirement
– Migrate email to cloud
– PST consolidation
– Legal hold repository
• Sensitive Data Retrieval/Remediation– Targeted identification of PHI, HIPAA, PCI, IP,
and other sensitive and critical data types• Delete
• Copy/Move
• Audit
Office 365 Consulting, Training, and
Implementation• Office 365 Readiness and Strategy
– eDiscovery best practices and workflows
• Office 365 eDiscovery Outsourcing– DTI operates eDiscovery features and functions
• Office 365 Email Management and OneDrive for Business Planning
• Legal Hold Process and Planning• Training
– Half or full Day workshops and training for law firms and corporations