Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

eDiscovery Query - Sharepoint file search

Copper Contributor

Hello Community,

 

I have a query regarding eDiscovery software I'm hoping someone can answer:

 

If an eDiscovery search is carried out specifically to search for particular files within SharePoint, would other files and folders downloaded at the same time as the particular files in question show up, or not, due to the specific nature of the search?

 

Many thanks!

3 Replies
I'm not sure I understand the question, so let's try and clarify it. eDiscovery is generally used for searching content within documents/email, thus it will return all documents matching a certain keyword/query. If you want to limit the results based on location, such as specific SPO site, you can use the method outlined here: https://docs.microsoft.com/en-us/microsoft-365/compliance/use-content-search-for-targeted-collection...
If you are interested in who has accessed/downloaded a specific file, you will need to run a query against the Unified audit log instead.

Hello Vasil,

Many thanks for your reply,

Sorry my question is not clear for you, I will try and explain further.

If you consider the following single file path for example, where each folder goes into the next by clicking on it :
SharePoint > Documents > Folder 1 (containing 2 files 1A, 1B) > Folder 2 (containing 5 files 2A, 2B, 2C, 2D, 2E) > Folder 3 (Containing 3 files 3A, 3B, 3C > Folder 4 (containing 4 files 4A, 4B, 4C, 4D)

If I download from Folder 1 on SharePoint, this will download all of the above into a ZIP file as one single download. If an eDiscovery search was then carried out on Folder 4 to see who had downloaded this, would it show the other files as having been downloaded at the same time, or would you have to carry out a further search for the other files for this to be identified?

I look forward to your reply
Many thanks

For this type of information, you need to run an Audit log search, not eDiscovery. And yes, it will include events for each individual file downloaded as part of the ZIP.