Information Governance and ediscovery in office 365 ediscovery deep dive

Part II: eDiscovery Deep DiveOctober 27, 2015

Office 365 for the Information Governance and eDiscovery

Practitioner

Part I: The Fundamentals of Office

365What is Office 365 (it’s not just email in the cloud!) but rather an entire ecosystem of applications, tools, and content. This webinar breaks it all down.

• The Office 365 plans available—and why this is important

• The primary system components (Exchange, SharePoint, and Skype for Business)

• Types of data and ESI likely to reside in Office 365

• Overview of the Information Governance and eDiscovery features built into the platform

Three-Part Webinar Series: Office 365 for the Information Governance and eDiscovery Practitioner

Part II: eDiscovery Deep Dive

• When: Tuesday, October 27 at 1:00 PM Eastern Time

Can you address some, all, or none of your eDiscovery requirements and needs using the built-in eDiscovery features of Office 365? This webinar will help organizations answer this question.

• Review of type of ESI available for discovery from Office 365

• eDiscovery Center explained: where much of the eDiscovery activity takes place

• Exchange (email) only eDiscovery

• Office 365 Compliance Center

• Pros and cons of built-in eDiscovery features

• Guest Speaker: Craig Ball

Part III: Information Governance and RIM

• When: Tuesday, November 17 at 1:00 PM Eastern Time

Office 365 provides several different approaches to the retention and disposition of data—including full records management capabilities via SharePoint. This webinar will provide an overview of the various options and approaches to managing data residing in Office 365.

• Options for records management in SharePoint and Exchange

• Security and compliance features– Data loss prevention (DLP)

– Mobile device management (MDM)

– Information Rights Management (IRM)

– Encryption

– Auditing

• Guest Speaker: John Holliday

http://dtiglobal.com/news-events/events

Recording

Available!

Housekeeping

• Today’s webinar is being recorded and will be available for download within 1-2 days

• If you experience technical problems please call 888-447-1119 and press “2”

• To make comments or ask questions- type and enter via the “Chat” function

4

Guest Speaker

Craig Ball, Esq., ESI Special Master and Attorney, Computer Forensics Examiner, Author and Educator

Craig is a trial lawyer, computer forensic examiner, law professor and noted authority on electronic evidence. He limits his practice to serving as a court-appointed special master and consultant in computer forensics and electronic discovery.

5

John Collins, JD, Director of Information Governance Solutions, DTI

John Collins, J.D., DTI’s Director of Information Governance Solutions, has extensive experience assisting clients with a full range of information governance initiatives, including ESI data mapping, litigation and electronic discovery readiness, and the development of e-mail management and records retention policies.

6

Agenda

• Review: what is Office 365?• eDiscovery tools in Office 365 viewed from 100k feet• Some plans do, some plans don’t (include eDiscovery tools)• Some history• ESI available for discovery in Office 365• ESI subject to Office 365’s ediscovery tools• Exchange-specific eDiscovery tools

–Live demonstration

• SharePoint eDiscovery Center–Live demonstration

• Compliance Center• Things to know about eDiscovery in Office 365

7

What is Office 365?

• Suite of Services/Products– E-mail, Instant Messaging, Collaboration, File Storage

– Office (Word, Excel, PowerPoint, Access, etc.), Exchange, SharePoint, Skype for Business

• Software as a Service (SaaS)– Individuals, companies, organizations subscribe to the service for a fixed

monthly or annual fee

• Cloud– Quintessential example of cloud computing

– Hardware, storage, backup and disaster recovery are handled by Microsoft

• Brand– Microsoft is labeling products and services as “Office 365” or part of

Office 365 (Project for Office 365, Dynamics CRM, etc.)

• Juggernaut– 84% growth in # of seats year-over-year

– 1 out of every 4 enterprise customers of Microsoft use Office 365

8

Office 365: a plan for all

• Office 365 is marketed and sold to two distinct market segments:1. Home (households, individuals, students)

2. Business (corporations, government, education, nonprofit)

9

100k View of eDiscovery Features in Office 365

• Search across one or more mailboxes and SharePoint sites

• Preserve Exchange/Outlook, SharePoint, and Skype for Business content

• “Preview” preserved content• Collect and export Exchange/Outlook,

SharePoint, and Skype for Business content

• Coming Soon! Equivio Zoom– Near-Duplicate Detection– Thread Analysis– Relevance ranking– Themes and Search

Will cover on 11/17!

10

Not all Office 365 plans include eDiscovery features

Office 365 Enterprise E1



Office 365 Enterprise K1

Office 365 Education E1



Office 365 Government K1

Office 365 Government E1



eDiscovery Center (SharePoint Online) No No No Yes Yes Yes NoLitigation Hold (Exchange Online) No No No No Yes Yes NoIn-Place Hold (Exchange Online) No No No No Yes Yes NoIn-Place eDiscovery (Exchange Online) No No Yes Yes Yes Yes Yes

FeatureOffice 365 Small Business

Office 365 Small Business Premium

Office 365 Midsize Business

Full Office 365 Service Comparison: https://technet.microsoft.com/en-us/office/dn788955.aspx?f=255&MSPPError=-2147217396

11

Through the Years: eDiscovery in Exchange

Exchange 4.01996

Exchange 5.51997

Exchange 20002000

Exchange 20032003

Exchange 20072006

Exchange 2010 Office 3652010

Exchange 2013

Equivio acquired Office 365 Exchange 2016

First Generation Legal Hold

Mailbox Search & Export

Second GenerationLegal Hold


Third GenerationLegal Hold


Clo

ud F

irst

1996: Exchange Introduced

12

Through the Years: eDiscovery in SharePoint

SharePoint Portal Server 2001

SharePoint Team Services

2002

Windows SharePoint Services 2.0 and SharePoint Portal Server 2003

Windows SharePoint Services 3.0 and MOSS 2007

SharePoint Foundation 2010 and SharePoint Server 2010 and SharePoint Enterprise 2010

Office 365(2010)

SharePoint Foundation 2013 and SharePoint Server 2013

Equivio acquired(January 2015)

SharePoint 2016

Still weak but can put non-records on

hold

Clo

ud F

irst

“Weak” legal hold introduced

eDiscovery Center

introduced

2001: SharePoint Introduced

What kinds of ESI is available for discovery from Office 365?

13

•Files of all types (Word, PowerPoint, Excel, PDF, Visio, CAD, audio, video, “Sway,” and more)

•Sites, web pages (blog, wiki, discussions, and more)

•“App” content (calendar, survey, newsfeed, announcements)

•E-mail & attachments•Contacts•Calendar

•Tasks•Notes

•Journal

•Instant Messaging chats •Voice and video call logs

•Word•Excel•PowerPoint•Outlook•OneNote•Access•Publisher

14

What ESI in Office 365 is subject to the built-in eDiscovery tools?

Exchange Public Folders

Yes No

Outlook Web App “Groups”

(rolling out)

Meeting content, recorded meetings

15

Exchange In-Place eDiscovery & Hold

Exchange In-Place eDiscovery and Hold allows an individual with appropriate permissions to search one or

more mailboxes and a) place the mailbox on hold, b) preview the search results, c) export the search results

1Create search and (optionally)

place ESI on hold

2Preview resultsRefine/modify

search

3Export

4Remove hold, delete search

One or more mailboxes

Exchange/Outlook

Boolean, Proximity,

Wildcard, date range, metadata

PST

Skype for Business

Email

IM

Contacts

Call Logs

Notes

Meetings

IMCall logs

Journal

OWA Preview Mode

Discovery Search Mailbox

Tasks

Conversation History

16

Enabling Defensible Legal Hold: Recoverable Items Folder

• Users do not have access to the recoverable items folder

• eDiscovery search and hold does have access

17

File Formats Indexed by Exchange Search in Office 365

Email message .emlGraphics Interchange Format .gifJPEG .jpegMicrosoft Excel .xls, .xlt, .xlsx, .xlsm, .xlb, .xlc, .xlsbExcel File odbcexcelMicrosoft InfoPath .infopathmlMicrosoft Offi ce Binder .obt, obdMicrosoft PowerPoint .pptx, .pptm, .ppt, .ppsx, .ppsm, .pps, .ppam, .potm, .pot, .potxMicrosoft Publisher .pubMicrosoft Word .doc, .docm, .dotx, .dotm, .dot, .docxMicrosoft XML Paper Specification .xpsOneNote .oneOpenDocument Presentation .odpOpenDocument Spreadsheet .odsOpenDocument Text .odtOutlook Item .msgPortable Document Format .pdfRich Text .rtfText .txtvCalendar .vcsvCard .vcfVisio .vdw, .vsd, .vss, .vst, .vsx, .vtx, .vssx, .vssm, .vsdm, .vstx, .vstm, .vdxWeb archive .mhtmlWeb page .htmlXML document .xmlZIP archive .zip

AVI .aviBitmap .bmpMP3 .mp3MPEG .mpegPNG .png

Microsoft Windows Wave Audio

.wav

Items Not Indexed Include…

19

SharePoint eDiscovery Center

1Create case

2Choose sources

3Create

query/queries

4Place on hold, preview resultsrefine results

5Export

6Remove hold,

close case

One or more mailboxes

Exchange=

PST

One or more SharePoint sites

SharePoint

Boolean, Proximity,

Wildcard, date range, metadata

Filter by type of ESI

SharePoint=

Natives, .mht, .csv

EDRM load file, reports

Web Pages Files Lists

AppData

WebContent

SharePoint eDiscovery Center allows an individual with appropriate permissions to search one or more mailboxes and SharePoint sites and a) place the mailbox(s) and site(s) on hold, b) preview the search

results, c) export the search results

20

Enabling Defensible Legal Hold: Preservation Hold Library

• A “preservation hold library” is created the first time a SharePoint site is put under hold.

• Users can continue to work on content without disruption

• Content on hold-including web pages, documents, lists, and other items are preserved as needed (if user edits an item it prompts preservation)

• Users don’t see the preservation hold library• To preserve all versions of content in a site

versioning must be enabled

21

File Formats Indexed by SharePoint in Office 365

23

Compliance Center

• Introduced January 2015• Future primary location of Office 365 eDiscovery

features• Objective is to bring together compliance related

features in a single console (eDiscovery, MDM, retention, auditing, etc.)

• Currently has a mix of unique and duplicate features– Unique:

• Can search across ALL mailboxes and SharePoint sites in a single search

– Duplicate• eDiscovery link redirects to the SharePoint eDiscovery Center

• Limitations: some features are not fully baked– Example: search does not have an export or legal hold function (executing these

functions requires use of PowerShell)

https://technet.microsoft.com/EN-US/library/dn876574.aspx

24

Things to know about Office 365 built-in eDiscovery

• When users leave what happens?– If mailbox is on hold, then user is converted to inactive mailbox and subject to eDiscovery

• Maximum of 10,000 mailboxes may be searched and placed on hold via a single eDiscovery search• Maximum of 2 eDiscovery searches can run at a time• Maximum # of keywords in a single eDiscovery search: 500• Maximum # of items displayed in preview: 200• 5: maximum # of holds that can be in effect that use scoping (after that all content is put on hold)• Can take up to 1 hour for legal hold to take effect• Quota! There is a 100 gigabyte quota on the Recoverable Items folder (can be increased, requires call to

Microsoft)—hold will stop working if the quota is reached• There are some limits to the # of sources that can be selected in eDiscovery Center• Keyword statistics do not appear for searches that include 100+ mailboxes

25

Things to know about Office 365 built-in eDiscovery

• E-mail de-duplication based on hash value calculated using:– InternetMessageId– ConversationTopic– IsSentItems– BodyTagInfo

• Unsearchable items– Files and other content that can’t be indexed for various reasons:

• Image files (TIFF, non-search PDF, etc.), MP3 (Unified Messaging!), bitmap

• Partially indexed/indexing error

• Large Excel files

• Encrypted using non-Microsoft technology or S/MIME

• Password protected

– Option to include unsearchable items when copying/exporting search results

26

Concluding Thoughts

• Velocity and scope of discovery in Office 365 is a challenge– New productivity and collaboration features are rolled out constantly—just like Smartphone apps– New types of ESI (for example, “Sway”) are regularly introduced– eDiscovery and IG features are in continual development and evolution

• Hybrid– Many organizations will have a hybrid implementation of Office 365 where some users are in the cloud and some are on-prem (temporarily or

permanently)

• Fast moving area– Don’t assume your outside lawyers or service providers are up to speed

• There are limitations in the native tools– Important to know what they are and if/where they might impact your approach to discovery

• For lawyers: the bar for attaining and maintaining the duty of competency is higher

• For IG professionals: master O365’s IG and eDiscovery features and secure a voice at the table with IT

27

Learning about eDiscovery and IG in Office 365

https://technet.microsoft.com/en-us/library/dn532171.aspx

28

Keeping up with Office 365

http://success.office.com/en-us/roadmap/

DTI Information Governance Services

29

Consulting• Records and Information

Management (RIM)– Assessments

– Policies and schedules

– Program implementation

• eDiscovery and Litigation Readiness– Assessments

– eDiscovery response planning and implementation

– Process design and implementation

• ESI Data Mapping– Proactive process to “map-out” an

organization’s IT systems and ESI sources

– Proprietary “systems” and risk based approach

Technology Services• Defensible disposition and

deletion– Categorization

– Repository/application retirement

– Content audit

– File share and SharePoint cleanup

• Email and archive migration– Archive retirement

– Migrate email to cloud

– PST consolidation

– Legal hold repository

• Sensitive Data Retrieval/Remediation– Targeted identification of PHI, HIPAA, PCI, IP,

and other sensitive and critical data types• Delete

• Copy/Move

• Audit

Office 365 Consulting, Training, and

Implementation• Office 365 Readiness and Strategy

– eDiscovery best practices and workflows

• Office 365 eDiscovery Outsourcing– DTI operates eDiscovery features and functions

• Office 365 Email Management and OneDrive for Business Planning

• Legal Hold Process and Planning• Training

– Half or full Day workshops and training for law firms and corporations