eDiscovery Content Search - Query

[BeagleMarauder]

I am currently working on a project whereby we're looking at removing ~5,000 deprecated users but will need to retain their data for compliance purposes. Therefore, we have set up retention policies, and labels to ensure data remains stored for our required timelines. 

To support our retention work, we're implementing an eDiscovery reference model and I need some clarification on the following, please: 

• https://docs.microsoft.com/en-us/microsoft-365/compliance/what-is-stored-in-exo-mailbox?view=o365-wo... suggests that data is stored in users EXOL mailboxes for live data, which makes sense.  
• Yet https://docs.microsoft.com/en-us/microsoft-365/compliance/retention?view=o365-worldwide explains that

  • For SharePoint and OneDrive sites: The copy is retained in the Preservation Hold library.

  • For Exchange mailboxes: The copy is retained in the Recoverable Items folder.

  • For Teams and Yammer messages: The copy is retained in a hidden folder named SubstrateHolds as a subfolder in the Exchange Recoverable Items folder.

So, does eDiscovery also look in the listed data retention storage libraries and folders for information that might be retained for compliance purposes/litigation requirements? Logically this would make sense but I cannot find it documented anywhere. 

Thanks

Thomas. 

[#2 · Accepted solution]

Yes, it will look at all the corresponding repositories for a given workload. In the case of Exchange, the Recoverable Items subtree is part of the mailbox.

[#3]

Thank you Vasil. After posting this question I found the following within the documentation:
> For SharePoint and OneDrive sites: The copy is retained in the Preservation Hold library - The retained versions of these SharePoint and OneDrive documents are not searchable by eDiscovery tools. In the event that a user leaves, their work is not removed from active pages as it is deemed a collaboration platform, if a user deletes a site or page they own prior to leaving it can be reinstated by a Site Administrator who can recover deleted files from Preservation Hold Library (Only Site Administrator can access Preservation Hold Library folder) - Go to SharePoint Online Site for which you want to recover content. Site > Site Contents > Preservation Hold Library. Select the content and download.

> For Exchange mailboxes: The copy is retained in the Recoverable Items folder. The Recoverable Items folder is indexed by Exchange Search and can be discovered by using In-Place eDiscovery or Content Search in the Microsoft 365 compliance centres - Recoverable Items folder

> For Teams and Yammer messages: The copy is retained in a hidden folder named SubstrateHolds as a subfolder in the Exchange Recoverable Items folder.