Add content to an eDiscovery case and place sources on hold

Content that is part of an eDiscovery case – such as potential evidence for litigation, audits and investigations –can be managed in an eDiscovery Set. Each case can have multiple eDiscovery Sets. You can also filter the source content you include, such as by author or sender, by a date range, or by search keywords.

When a content source is part of a case, you can place it on hold so that a copy is preserved. This includes SharePoint sites, documents, or pages, searchable file shares, and Exchange mailboxes. When items are placed on hold, people can continue to work on them without disruption. Content that is being managed by policies will not expire when it is placed on hold.

After you have defined content sources, you can run queries and export the content to provide to authorities. The exported content includes a load file based on the Electronic Discovery Reference Model standard.

 Note    Once you add content sources or queries to an eDiscovery case, changing the regional settings for the site is not supported.

Create an eDiscovery Set to manage content sources

This procedure creates an eDiscovery Set and adds content sources to it. To also place content on hold, follow the next procedure, Place content sources on hold.

Add and Manage eDiscovery Sources

 Note    To include sources in a case, they must first be indexed by the SharePoint search service. For more information, see the person that manages the sites and Inboxes you want to include.

  1. If your case is not already open, in an eDiscovery Center, click Cases, and then click the case that you want to add content sources to.
  2. .Under eDiscovery Sets, click New Item.
  3. Type a name for the eDiscovery Set, such as Executive Correspondence.
  4. Next to Sources, click Add & Manage Sources.
  5. In the dialog box that appears, under Mailboxes, type the account names or e-mail addresses for the Exchange mailboxes you want to include in the case.
  6. Under Locations, type the URL or file share address for the content you want to use as the source. Any content you include must be indexed by search.
  7. Click Save.
  8. In the box under Filter, type any keywords you want to use to narrow down the source.
  9. To narrow down content by a date range, enter the Start Date and End Date.
  10. To limit results to the author of a document or list item, or to a specific sender of e-mail messages, type the names or e-mail addresses in the Author/Sender box.
  11. To limit results to a specific Exchange domain, type its name in the Domain box.
  12. Click the Apply Filter button.
  13. To verify that you’ve selected the right content, click Preview Results.
  14. Click Save.

 Note    You can add and remove content sources after you create an eDiscovery Set. To see a list of content sources in an eDiscovery Set, click Sources.

Top of Page Top of Page

Place content sources on hold

 Note    To include sources in a case, they must first be indexed by the SharePoint search service. For more information, see the person that manages the sites and Inboxes you want to include.

  1. If your case is not already open, in an eDiscovery Center, click Cases, and then click the case in which you want to place on hold.
  2. .Under eDiscovery Sets, click New Item.
  3. Type a name for the eDiscovery Set, such as Executive Correspondence.
  4. Next to Sources, click Add & Manage Sources.
  5. In the dialog box that appears, under Mailboxes, type the account names or e-mail addresses for the Exchange mailboxes you want to include in the case.
  6. Under Locations, type the URL or file share address for the content you want to use as the source. Any content you include must be indexed by search.
  7. Click Save.
  8. In the box under Filter, type any keywords you want to use to narrow down the source.
  9. To narrow down content by a date range, enter the Start Date and End Date.
  10. To limit results to the author of a document or list item, or to a specific sender of e-mail messages, types the names or e-mail addresses in the Author/Sender box.
  11. To limit results to a specific Exchange domain, type its name in the Domain box.
  12. Click the Apply Filter button.
  13. Click Enable In-Place hold.
  14. To verify that you’ve selected the right content, click Preview Results.
  15. Click Save.

 Note    After you’ve placed content on hold, if you want to see a list of content sources for a case, click Sources.

Remove a hold from content sources

  1. If your case is not already open, in an eDiscovery Center, click Cases, and then click the case in which you want to remove a hold.
  2. Click eDiscovery Sets.
  3. Under Sources, click the name of the source whose hold you want to remove. The address of the location of the name or names of the Exchange mailboxes will be listed.
  4. Click Disable In-Place Hold.

Top of Page Top of Page

Remove an eDiscovery Set from a case.

  1. If your case is not already open, in an eDiscovery Center, click Cases, and then click the case in which you want to remove an eDiscovery Set.
  2. Click to the left of the eDiscovery Set to select it, so that a check mark appears besides its name.
  3. Click the three dots to display the Open Menu.
  4. Click Delete Item.
  5. When prompted whether to send the item to the Recycle Bin, click OK.

Top of Page Top of Page

Learn more about holds

These types of content can be placed on hold as part of a case:

  • Documents
  • Lists (including blogs and wiki content)
  • Pages (including pages that host blogs and wikis)
  • Exchange objects, such as tasks, calendar entries, contacts, email messages and attachments. If Microsoft Lync conversations are archived in Microsoft Exchange, they will be included.
  • Content on file shares that have been crawled by search

When a hold is placed on a SharePoint site, a preservation hold library is created, if one does not already exist. Users can still work with the content, but a copy of the content as it was at the time that you initiated the hold is preserved as users change the content.

Regular users with typical permissions cannot see the library, so they may not even be aware that their content is on hold. Only users with Web application- level permissions, or users who have been granted specific permissions, can view the preservation hold library.

If a user attempts to change or delete content in a site that is on hold, SharePoint first checks whether the content was changed since the hold was applied. If this is the first modification since the hold was applied, SharePoint copies the content to the preservation hold library, and then allows the user to change or delete the original content.

The version of content that is current at the time that the hold was applied is the only version that is preserved. If the content is changed multiple times after the hold is applied, intermediate versions of the content are not preserved, so that storage space is used more efficiently. Most content in a site typically does not change, and content that is not changed is not copied to the preservation hold library.

Find more information about eDiscovery

For more information about eDiscovery cases, see the following articles:

Scenario: eDiscovery in SharePoint Server 2013 and Exchange Server 2013

Plan and manage eDiscovery cases

Searching and using keywords in eDiscovery

Create and run eDiscovery queries

Export eDiscovery content and create reports

Top of Page Top of Page

 
 
Applies to:
SharePoint Online Enterprise (E3 & E4), SharePoint Online operated by 21Vianet - Enterprise (E3 & E4), SharePoint Server 2013 Enterprise