Plan and manage eDiscovery cases

Electronic Discovery, or eDiscovery, is the discovery of content in electronic format for litigation or investigation. This typically requires identifying content spread across laptops, email servers, file servers, and many other sources.

The eDiscovery Center is a SharePoint site collection used to perform electronic discovery actions. In an eDiscovery Center, you can create cases, which are SharePoint sites that allow you to identify, hold, search, and export content from Exchange mailboxes, SharePoint sites, and searchable file shares.


 Notes 

  • Once you add content sources or queries to an eDiscovery case, changing the regional settings for the site is not supported.
  • Adding a large distribution group (of 100 names or larger) as a content source may time out or take a long time to process. Distribution groups of 1,500 or more users cannot be added. The workaround is to identify other ways to find the content involved with the distribution group’s mailbox, such as keywords or the author or sender of the item.
  • In order for content to be discovered, it must be crawled by search. For more information about the default file types that are crawled, see the article Default crawled file name extensions and parsed file types in SharePoint Server 2013.

Planning and creating cases

If you anticipate managing multiple cases in your eDiscovery Center, consider whether you want to define consistent processes for people in your organization to follow.

  • Naming conventions for cases – Could matter if you anticipate a larger number of cases, or different types or classifications of cases, for different departments,
  • Additional data to describe cases
  • Defining and communicating permissions for managing cases.
  • Guidelines on creating queries
  • Standard procedures for communicating when content is placed on hold
  • Standard procedure for retaining and closing cases

Example lifecycle of an eDiscovery case

  • Create the site to manage a case
  • Add sources
  • Place sources on hold
  • Create queries
  • Export case content
  • Close case

Top of Page Top of Page

Create a case

  1. In an eDiscovery Center, click Create new case.
  2. Type a title and description for your case.
  3. In the Web Site Address box, type the last part of the URL you want for the case, such as ContosovsFabrikam.
  4. Under Select a template, make sure that eDiscovery Case is selected.
  5. Under User Permissions, select whether or not to keep the same permissions as the parent site or use unique permissions. If specific people will need access to this case, but not to other cases, you should choose Use unique permissions.

Add sources and place them on hold

  1. In the eDiscovery Center, open the case that you want to add a source to.
  2. Click eDiscovery Sets.
  3. Type a name for the eDiscovery Set, such as Executive Correspondence.
  4. Next to Sources, click Add & Manage Sources.
  5. In the dialog box that appears, under Mailboxes, type the account names or e-mail addresses for the Exchange mailboxes T
  6. Under Locations, type the URL or file share address for the content you want to use as the source. Any content you include must be indexed by search.
  7. Click Save.
  8. In the box under Filter, type any keywords you want to use to narrow down the source.
  9. To narrow down content by a date range, enter the Start Date and End Date.
  10. To limit results to the author of a document or list item, or to a specific sender of e-mail messages, type the names or e-mail addresses in the Author/Sender box.
  11. To limit results to a specific Exchange domain, type its name in the Domain box.
  12. Click the Apply Filter button.
  13. Click Enable In-Place hold.
  14. To verify that you’ve selected the right content, click Preview Results.
  15. Click Save.

For more information, see Add content to an eDiscovery case and place sources on hold.

Top of Page Top of Page

Run queries and export content

Once you have defined your sources, and placed them on hold if necessary, you can run queries to narrow down and extract exactly the content you need for a particular case. SharePoint has some tools that can help you refine your queries.

You export content from a case when you are ready to deliver it to an authority or want to work on it with another legal program. The content is exported in a format that is compatible with the Electronic Discovery Reference Model standard.

Top of Page Top of Page

Close cases

When you close a case, in-place holds will be released for all of its sources, and you will no longer be able to put sources on hold for this case.

  1. Click Settings Settings button, and then click Case Closure.
  2. Click Close this case.

Find more information about eDiscovery

For more information about eDiscovery cases, see the following articles:

Scenario: eDiscovery in SharePoint Server 2013 and Exchange Server 2013

Add content to an eDiscovery case and place sources on hold

Searching and using keywords in eDiscovery

Default crawled file name extensions and parsed file types in SharePoint Server 2013

Overview of crawled and managed properties in SharePoint Server 2013

Create and run eDiscovery queries

Export eDiscovery content and create reports

Top of Page Top of Page

 
 
Applies to:
SharePoint Online Enterprise (E3 & E4), SharePoint Online operated by 21Vianet - Enterprise (E3 & E4), SharePoint Server 2013 Enterprise