Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

eDiscovery Advice needed

Brass Contributor

Hi

 

I wonder if anyone can offer some advice.  I have been tasked with performing an eDiscovery in relation to a internal subject access request (this is the first time I have had to do this).  The information required is bassically, any mention of the user who made this request accross email, sharepoint etc.

 

Firstly, I have created the case and done 3 x searches.  One with the locations below:

 

exchange,

yammer,

group email,

sfb,

teams messages,

to-do,

sway

forms. 

 

Another with the locations below:

 

SharePoint,

OneDrive Accounts,

O365 Group Sites,

Teams Sites,

Yammer Networks

 

and one for public folders.

 

I have added a condition to cover the date range from when the user started at the company and for keywords I have simply used "users name" AND "user ID".

 

The results I have got back in term of data are huge.  Just the first search mentioned above, including unindexed items is 6.69TB.

 

I understand there are limits in terms of 2GB per export for these sorts of things.  Can anyone advise how they deal with this as this would mean splitting this one search down into 3345 individual searches if my math is correct which obviously isn't very inviting to do or even achievable.

 

Am I doing something wrong here, has anyone had similar experiances and how was this sort of task completed?

 

Any advice will be greatfully received.

 

Many thanks all.

0 Replies