What's new in eDiscovery in SharePoint Server 2013

SharePoint 2013

We are in the process of combining the SharePoint Server 2013 and SharePoint Server 2016 content into a single content set. We appreciate your patience while we reorganize things. See the Applies To tag at the top of each article to find out which version of SharePoint an article applies to.


Applies to: SharePoint Server 2013

Topic Last Modified: 2014-06-05

Summary: Get a quick introduction to eDiscovery and in-place hold capabilities in SharePoint Server 2013.

The eDiscovery functionality in SharePoint Server 2013 provides improved ways to help you protect your business. SharePoint Server 2013 includes the following:

  • A site collection from which you can perform eDiscovery queries across multiple SharePoint farms and Exchange servers and preserve the items that are discovered.

  • In-place preservation of Exchange mailboxes and SharePoint sites — including SharePoint list items and SharePoint pages — while still allowing users to work with site content.

  • Support for searching and exporting content from file shares.

  • The ability to export discovered content from Exchange Server 2013 and SharePoint Server 2013.

The following sections describe the new functionality:

SharePoint Server 2013 introduces a new site for managing discovery cases and holds. The eDiscovery Center site template creates a portal through which you can access discovery cases to conduct searches, place content on hold, and export content. For each case, you create a new site that uses the eDiscovery Case site template. Each case is a collaboration site that includes a document library which you can use to store documents related to the management of the case. In addition, you can associate the following things with each case:

  • Sources: Exchange mailboxes, SharePoint sites, or file shares from which content can be discovered.

  • eDiscovery sets: Combinations of sources, filters, and whether to preserve content. eDiscovery sets are used to identify and preserve content.

  • Queries: The search criteria, such as author, date range, and free-text terms, and the scope of the search. Queries are used to identify content to export.

  • Exports: A list of all of the exports that were produced that relate to the case.

When there is a new need for discovery — for example, a legal case or an audit — a user who has appropriate permissions can create a new case, create eDiscovery sets to identify the specific material to be located, and then preserve the sites and mailboxes in which content was discovered. The user can then create queries to further refine the content that is relevant, preview the content, and export the content. When the case is closed, all of the holds associated with the case are released.

In SharePoint Server 2013, content that is put on hold is preserved, but users can still change it. The state of the content at the time of preservation is recorded. If a user changes the content or even deletes it, the original, preserved version is still available. Regular users see the current version of the content; compliance officers who have permissions to use the eDiscovery features of SharePoint Server 2013 can access the original, preserved version.

In-place holds in SharePoint Server 2013 offer improvements to the hold functionality in earlier versions of SharePoint Server. Improvements include the following:

  • Documents, list items, pages, and Exchange Server 2013 mailboxes can be preserved.

  • Preservation is done at the level of a site. Preserving a site preserves the contents of the site.

  • Users can continue to work with content that is preserved. The content remains in the same location, and users can edit, delete, and add new content.

  • A user who has permissions to perform eDiscovery can access the original version of preserved content.

  • You do not have to preserve a whole site or mailbox. You can specify a query filter to define the scope of preservation, and preserve only the content that matches the query filter.

In SharePoint Server 2013, you can export the results of an eDiscovery search for later import into a review tool. You can export all of the content that is associated with an eDiscovery case. This includes the following:

  • Documents: Documents are exported from file shares. Documents and their versions are exported from SharePoint Server 2013.

  • Lists: If a list item was included in the eDiscovery query results, the complete list is exported as a comma-separated values (.csv) file.

  • Pages: SharePoint pages, such as wiki pages or blogs, are exported as MIME HTML (.mht) files.

  • Exchange objects: Items in an Exchange Server 2013 mailbox, such as tasks, calendar entries, contacts, email messages, and attachments, are exported as a .pst file.

An XML manifest that complies with the Electronic Discovery Reference Model (EDRM) specification provides an overview of the exported information.

In SharePoint Server 2013, you can centrally manage eDiscovery across multiple SharePoint farms, Exchange servers, and file shares. From one eDiscovery Center, you can do the following:

  • Create a case, define a query, and then search SharePoint Server 2013, Exchange Server 2013, and file shares throughout the enterprise for content that matches the query.

  • Export all of the content that was identified.

  • Preserve items in place in SharePoint Server 2013 or Exchange Server 2013.

  • Track statistics related to the case.

To implement eDiscovery across the enterprise, you configure SharePoint Server 2013 Search to crawl all file shares and websites that contain discoverable content, and configure the central Search service application to include results from Exchange Server 2013. Any content from SharePoint Server 2013, Exchange Server 2013, or a file share or website that is indexed by Search or by Exchange Server 2013 can be discovered from the eDiscovery Center.