Part II: eDiscovery Deep Dive
October 27, 2015
Office 365 for the Information
Governance and eDiscovery
Part I: The
Fundamentals of Office
365
What is Office 365 (it’s not just email in the cloud!) but rather an entire ecosystem of applications, tools, and content. This webinar breaks it all down.
• The Office 365 plans available— and why this is important
• The primary system components (Exchange, SharePoint, and Skype for Business)
• Types of data and ESI likely to reside in Office 365
• Overview of the Information Governance and eDiscovery features built into the platform
Three-Part Webinar Series: Office 365 for the Information
Governance and eDiscovery Practitioner
Part II: eDiscovery
Deep Dive
• When: Tuesday, October 27
at 1:00 PM Eastern Time
Can you address some, all, or none of your eDiscovery requirements and needs using the built-in eDiscovery features of Office 365? This webinar will help organizations answer this question.
• Review of type of ESI available for discovery from Office 365
• eDiscovery Center explained: where much of the eDiscovery activity takes place
• Exchange (email) only eDiscovery • Office 365 Compliance Center • Pros and cons of built-in eDiscovery
features
• Guest Speaker: Craig Ball
Part III: Information
Governance and RIM
• When: Tuesday, November
17 at 1:00 PM Eastern Time
Office 365 provides several different approaches to the retention and disposition of data—including full records management capabilities via SharePoint. This webinar will provide an overview of the various options and approaches to managing data residing in Office 365.
• Options for records management in SharePoint and Exchange
• Security and compliance features
– Data loss prevention (DLP) – Mobile device management (MDM) – Information Rights Management (IRM) – Encryption
– Auditing
Housekeeping
• Today’s webinar is being
recorded and will be
available for download
within 1-2 days
• If you experience technical
problems please call
888-447-1119 and press “2”
• To make comments or ask
questions- type and enter
via the “Chat” function
Guest Speaker
Craig Ball, Esq., ESI Special Master and Attorney, Computer
Forensics Examiner, Author and Educator
Craig is a trial lawyer, computer forensic examiner, law professor and
noted authority on electronic evidence. He limits his practice to serving
as a court-appointed special master and consultant in computer
John Collins, JD, Director of Information Governance Solutions, DTI
John Collins, J.D., DTI’s Director of Information Governance Solutions,
has extensive experience assisting clients with a full range of information
governance initiatives, including ESI data mapping, litigation and
electronic discovery readiness, and the development of e-mail
management and records retention policies.
Agenda
• Review: what is Office 365?
• eDiscovery tools in Office 365 viewed from 100k feet
• Some plans do, some plans don’t (include eDiscovery tools)
• Some history
• ESI available for discovery in Office 365
• ESI subject to Office 365’s ediscovery tools
• Exchange-specific eDiscovery tools
– Live demonstration
• SharePoint eDiscovery Center
– Live demonstration
• Compliance Center
What is Office 365?
• Suite of Services/Products
– E-mail, Instant Messaging, Collaboration, File Storage
– Office (Word, Excel, PowerPoint, Access, etc.), Exchange, SharePoint, Skype for Business
• Software as a Service (SaaS)
– Individuals, companies, organizations subscribe to the service for a fixed monthly or annual fee
• Cloud
– Quintessential example of cloud computing
– Hardware, storage, backup and disaster recovery are handled by Microsoft
• Brand
– Microsoft is labeling products and services as “Office 365” or part of Office 365 (Project for Office 365, Dynamics CRM, etc.)
• Juggernaut
– 84% growth in # of seats year-over-year
Office 365: a plan for all
• Office 365 is marketed and sold
to two distinct market
segments:
1.
Home (households, individuals, students)
2.
Business (corporations, government, education,
nonprofit)
100k View of eDiscovery Features in Office 365
• Search across one or more mailboxes
and SharePoint sites
• Preserve Exchange/Outlook, SharePoint,
and Skype for Business content
• “Preview” preserved content
• Collect and export Exchange/Outlook,
SharePoint, and Skype for Business
content
• Coming Soon! Equivio Zoom
– Near-Duplicate Detection
– Thread Analysis
– Relevance ranking
– Themes and Search
Will cover on 11/17!
Not all Office 365 plans include eDiscovery features
Office 365
Enterprise E1
Office 365
Enterprise E3
Office 365
Enterprise E4
Office 365
Enterprise K1
Office 365
Education E1
Office 365
Education E3
Office 365
Education E4
Office 365
Government K1
Office 365
Government E1
Office 365
Government
E3
Office 365
Government
E4
eDiscovery Center (SharePoint Online)
No
No
No
Yes
Yes
Yes
No
Litigation Hold (Exchange Online)
No
No
No
No
Yes
Yes
No
In-Place Hold (Exchange Online)
No
No
No
No
Yes
Yes
No
In-Place eDiscovery (Exchange Online)
No
No
Yes
Yes
Yes
Yes
Yes
Feature
Office 365 Small
Business
Office 365
Small
Business
Premium
Office 365
Midsize
Business
Through the Years: eDiscovery in Exchange
Exchange 4.0 1996 Exchange 5.5 1997 Exchange 2000 2000 Exchange 2003 2003 Exchange 2007 2006 Exchange 2010 Office 365 2010 Exchange 2013 Equivio acquired Office 365 Exchange 2016 First Generation Legal Hold Mailbox Search & Export Second Generation Legal Hold Mailbox Search & Export Third Generation Legal Hold Mailbox Search & ExportC
lo
ud
F
ir
s
t
1996: Exchange IntroducedThrough the Years: eDiscovery in SharePoint
SharePoint Portal Server 2001 SharePoint Team Services 2002 Windows SharePoint Services 2.0 and SharePoint Portal Server 2003 Windows SharePoint Services 3.0 and MOSS 2007 SharePoint Foundation 2010 and SharePoint Server 2010 and SharePoint Enterprise 2010 Office 365 (2010) SharePoint Foundation 2013 and SharePoint Server 2013 Equivio acquired (January 2015) SharePoint 2016Still weak but can put
non-records on hold
C
lo
ud
F
ir
s
t
“Weak” legal hold introduced eDiscovery Center introduced 2001: SharePoint IntroducedWhat kinds of ESI is available for discovery from Office 365?
•Files of all types (Word, PowerPoint, Excel, PDF,
Visio, CAD, audio, video, “Sway,” and more)
•Sites, web pages (blog, wiki, discussions, and
more)
•“App” content (calendar, survey, newsfeed,
announcements)
•E-mail & attachments
•Contacts
•Calendar
•Tasks
•Notes
•Journal
•Instant Messaging chats
•Voice and video call logs
• Word • Excel • PowerPoint • Outlook • OneNote • Access • Publisher
What ESI in Office 365 is subject to the built-in eDiscovery tools?
Exchange Public
Folders
Yes
No
Outlook Web App
“Groups”
(rolling out)
Exchange In-Place eDiscovery & Hold
Exchange In-Place eDiscovery and Hold allows an
individual with appropriate permissions to search one or
more mailboxes and a) place the mailbox on hold, b)
preview the search results, c) export the search results
1 Create search and (optionally) place ESI on hold 2 Preview results Refine/modify search
3
Export 4 Remove hold, delete search One or more mailboxesExchange/Outlook
Boolean, Proximity, Wildcard, date range, metadata PSTSkype for
Business
Email IM Contacts Call Logs Notes Meetings IM Call logs Journal OWA Preview Mode Discovery Search Mailbox Tasks Conversation HistoryEnabling Defensible Legal Hold: Recoverable Items Folder
• Users do not have access to the
recoverable items folder
• eDiscovery search and hold
does have access
File Formats Indexed by Exchange Search in Office 365
Email message .eml Graphics Interchange Format .gif JPEG .jpeg
Microsoft Excel .xls, .xlt, .xlsx, .xlsm, .xlb, .xlc, .xlsb Excel File odbcexcel
Microsoft InfoPath .infopathml Microsoft Office Binder .obt, obd
Microsoft PowerPoint .pptx, .pptm, .ppt, .ppsx, .ppsm, .pps, .ppam, .potm, .pot, .potx Microsoft Publisher .pub
Microsoft Word .doc, .docm, .dotx, .dotm, .dot, .docx Microsoft XML Paper Specification .xps
OneNote .one OpenDocument Presentation .odp OpenDocument Spreadsheet .ods OpenDocument Text .odt Outlook Item .msg Portable Document Format .pdf Rich Text .rtf Text .txt vCalendar .vcs vCard .vcf Visio .vdw, .vsd, .vss, .vst, .vsx, .vtx, .vssx, .vssm, .vsdm, .vstx, .vstm, .vdx Web archive .mhtml Web page .html XML document .xml ZIP archive .zip
AVI .avi Bitmap .bmp MP3 .mp3 MPEG .mpeg PNG .png Microsoft Windows Wave Audio .wav
Items Not Indexed
Include…
SharePoint eDiscovery Center
1 Create case 2 Choose sources 3 Create query/queries 4 Place on hold, preview results refine results 5 Export 6 Remove hold, close case One or more mailboxes Exchange = PST One or more SharePoint sitesSharePoint
Boolean, Proximity, Wildcard, date range, metadata Filter by type of ESI SharePoint = Natives, .mht, .csvEDRM load file, reports
Web
Pages Files Lists App
Data
Web Content
SharePoint eDiscovery Center allows an individual with appropriate permissions to search one or more mailboxes and SharePoint sites and a) place the mailbox(s) and site(s) on hold, b) preview the search
Enabling Defensible Legal Hold: Preservation Hold Library
• A “preservation hold library” is created the
first time a SharePoint site is put under hold.
• Users can continue to work on content
without disruption
• Content on hold-including web pages,
documents, lists, and other items are
preserved as needed (if user edits an item it
prompts preservation)
• Users don’t see the preservation hold library
• To preserve all versions of content in a site
Compliance Center
• Introduced January 2015
• Future primary location of Office 365
eDiscovery features
• Objective is to bring together compliance
related features in a single console
(eDiscovery, MDM, retention, auditing, etc.)
• Currently has a mix of unique and duplicate
features
– Unique:
• Can search across ALL mailboxes and SharePoint sites in a single search
– Duplicate
• eDiscovery link redirects to the SharePoint eDiscovery Center
• Limitations: some features are not fully baked
– Example: search does not have an export or legal hold function (executing these
functions requires use of PowerShell)
Things to know about Office 365 built-in eDiscovery
• When users leave what happens?
– If mailbox is on hold, then user is converted to inactive mailbox and subject to eDiscovery
• Maximum of 10,000 mailboxes may be searched and placed on hold via a single eDiscovery search
• Maximum of 2 eDiscovery searches can run at a time
• Maximum # of keywords in a single eDiscovery search: 500
• Maximum # of items displayed in preview: 200
• 5: maximum # of holds that can be in effect that use scoping (after that all content is put on hold)
• Can take up to 1 hour for legal hold to take effect
• Quota! There is a 100 gigabyte quota on the Recoverable Items folder (can be increased, requires call to
Microsoft)—hold will stop working if the quota is reached
• There are some limits to the # of sources that can be selected in eDiscovery Center
• Keyword statistics do not appear for searches that include 100+ mailboxes
Things to know about Office 365 built-in eDiscovery
• E-mail de-duplication based on hash value calculated using:
– InternetMessageId
– ConversationTopic
– IsSentItems
– BodyTagInfo
• Unsearchable items
– Files and other content that can’t be indexed for various reasons:
• Image files (TIFF, non-search PDF, etc.), MP3 (Unified Messaging!), bitmap • Partially indexed/indexing error
• Large Excel files
• Encrypted using non-Microsoft technology or S/MIME • Password protected
Concluding Thoughts
• Velocity and scope of discovery in Office 365 is a challenge
– New productivity and collaboration features are rolled out constantly—just like Smartphone apps
– New types of ESI (for example, “Sway”) are regularly introduced
– eDiscovery and IG features are in continual development and evolution
• Hybrid
– Many organizations will have a hybrid implementation of Office 365 where some users are in the cloud and some are on-prem (temporarily
or permanently)
• Fast moving area
– Don’t assume your outside lawyers or service providers are up to speed
• There are limitations in the native tools
– Important to know what they are and if/where they might impact your approach to discovery
• For lawyers: the bar for attaining and maintaining the duty of competency is
higher
• For IG professionals: master O365’s IG and eDiscovery features and secure a
Learning about eDiscovery and IG in Office 365
Keeping up with Office 365
DTI Information Governance Services
Consulting
• Records and Information
Management (RIM)
– Assessments
– Policies and schedules – Program implementation
• eDiscovery and Litigation
Readiness
– Assessments
– eDiscovery response planning and implementation
– Process design and implementation
• ESI Data Mapping
– Proactive process to “map-out” an
organization’s IT systems and ESI sources – Proprietary “systems” and risk based
approach
Technology Services
• Defensible disposition and
deletion
– Categorization
– Repository/application retirement – Content audit
– File share and SharePoint cleanup
• Email and archive migration
– Archive retirement – Migrate email to cloud – PST consolidation – Legal hold repository
• Sensitive Data
Retrieval/Remediation
– Targeted identification of PHI, HIPAA, PCI, IP, and other sensitive and critical data types
• Delete • Copy/Move • Audit
Office 365 Consulting,
Training, and
Implementation
• Office 365 Readiness and Strategy
– eDiscovery best practices and workflows
• Office 365 eDiscovery
Outsourcing
– DTI operates eDiscovery features and functions
• Office 365 Email Management and
OneDrive for Business Planning
• Legal Hold Process and Planning
• Training
– Half or full Day workshops and training for law firms and corporations
