Perform eDiscovery against specific folders only

%3CLINGO-SUB%20id%3D%22lingo-sub-75600%22%20slang%3D%22en-US%22%3EPerform%20eDiscovery%20against%20specific%20folders%20only%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-75600%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20question%20of%20%22can%20I%20search%20for%20items%20in%20specific%20folder%20only%22%20is%20often%20brough%20up%20when%20using%20eDiscovery%20or%20the%20Search-Mailbox%20cmdlet.%20Well%2C%20finally%20we%20have%20an%20option%20to%20do%20so%2C%20via%20the%20so-called%20targetted%20collections.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20a%20nutshell%2C%20you%20provide%20the%20binary-encoded%20folderId%20and%20use%20it%20as%20you%20would%20use%20any%20other%20search%20property.%20It's%20not%20as%20easy%20as%20it%20sounds%20though%2C%20as%20the%20folderId%20property%20you%20get%20from%20the%20output%20of%20cmdlets%20such%20as%20Get-MailboxFolderStatistics%20is%20not%20suitable%20and%20it%20has%20to%20be%20transformed%20via%20some%20PowerShell%20magic.%20Makes%20me%20wonder%20why%20they%20didnt%20simply%20perform%20this%20conversion%20after%20you%20specify%20the%20id%2C%20but%20anyways.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHere's%20an%20example%20of%20two%20searches%20running%20against%20my%20mailbox%3A%20one%20including%20all%20content%20and%20the%20other%20one%20scoped%20to%20a%20folder.%20You%20can%20see%20that%20the%20results%20returned%20by%20the%20second%20search%20match%20the%20folder%20statistics.%20The%20number%2Fsize%20of%20unindexed%20items%20found%20matches%20across%20the%20searches%2C%20so%20you%20can%20be%20sure%20this%20is%20the%20same%20mailbox%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22eDiscoveryfoldersearch.png%22%20style%3D%22width%3A%20777px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F15464i329A82E00D474A81%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22eDiscoveryfoldersearch.png%22%20alt%3D%22eDiscoveryfoldersearch.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDetails%20are%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2FUse-Content-Search-in-Office-365-for-targeted-collections-e3cbc79c-5e97-43d3-8371-9fbc398cd92e%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2FUse-Content-Search-in-Office-365-for-targeted-collections-e3cbc79c-5e97-43d3-8371-9fbc398cd92e%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-75600%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECompliance%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
MVP

The question of "can I search for items in specific folder only" is often brough up when using eDiscovery or the Search-Mailbox cmdlet. Well, finally we have an option to do so, via the so-called targetted collections.

 

In a nutshell, you provide the binary-encoded folderId and use it as you would use any other search property. It's not as easy as it sounds though, as the folderId property you get from the output of cmdlets such as Get-MailboxFolderStatistics is not suitable and it has to be transformed via some PowerShell magic. Makes me wonder why they didnt simply perform this conversion after you specify the id, but anyways.

 

Here's an example of two searches running against my mailbox: one including all content and the other one scoped to a folder. You can see that the results returned by the second search match the folder statistics. The number/size of unindexed items found matches across the searches, so you can be sure this is the same mailbox :)

eDiscoveryfoldersearch.png

 

Details are here: https://support.office.com/en-us/article/Use-Content-Search-in-Office-365-for-targeted-collections-e...

0 Replies