Relativity Collect

Relativity Collect is an application for RelativityOne, which can assist with the collection of email and documents from Office 365. When collecting data directly from OneDrive or Outlook, the admin must first set a custodian.

At the second stage search criteria are designated.

While wildcard and proximity searches cannot be run, any words which begin with a keyword will be returned in the results. For example, the keyword 'court' will return files using 'courthouse' or 'courtroom'. Multiple criteria can be used. The Office 365 index of electronic files is searched rather than the files themselves.

Searches in OneDrive can be set for specific file extensions and files created in a particular date range. Searches can be set on the file name and file path fields as well.

The standard email metadata fields can also be searched, as well as the body of the email. The attachment content cannot be searched, but there is a setting to return emails with or without attachments.

Emails Purged From Outlook May Still Exist

After an email is deleted from the Deleted Items folder, or removed from the Inbox with SHIFT + DELETE, the email will be sent to the Deletions subfolder of the Recoverable Items Folder. The Recoverable Items Folder is not visible to the user. Each user's profile contains a deleted item retention period set by the admin. The default is 14 days. So, in most cases emails can be recovered for up to 14 days after a user has tried to delete them. The 'Recover Deleted Items' command is on the Folder tab of Outlook.

If an email is purged from the Recovered Deleted Items folder, or if the set retention period elapses, it is sent to the Purges subfolder of the Recoverable Items Folder. However, the email will not be removed from the Purges folder until the mailbox assistant processes the folder. A post on Microsoft's official site for Exchange states that: "You can configure the Managed Folder Assistant to process all mailboxes on a Mailbox server within a certain period (known as a work cycle). The work cycle is set to one day by default."

In-Place eDiscovery In Microsoft Exchange

Microsoft Exchange makes possible in place preservation of email messages. The archiving of relevant emails involves significant costs because of the need for a user to manage the copying or because of the need to purchase software to implement the hold on the email messages.

The LitigationHoldEnabled property of a mailbox will prevent any item in a mailbox from being removed.

The alternate 'in-place hold' will only direct the retention of emails which come up in a search query. A single mailbox can have multiple in-place holds, but no more than 500 search terms can be used.

Using more than 500 terms in a query will cause all content in the mailbox to be preserved. The LitigationHoldEnable property is either set or not. Either type of hold can be set to remain for a specific time period.

Searches can be run on the messages that are subject to in-place holds. While a hold is in place a user will retain the same rights to delete emails. The admin has the option of informing the user that the mailbox is subject to a hold.

Both types of holds use the Recoverable Items folder to preserve emails. So even when SHIFT + DELETE is used or emails are deleted from the Deleted Items folder, the emails are transferred to the Recoverable Items folder. The recoverable items folder is not visible to users. Note that a user does have the option to recover deleted items on the folder tab.