Downloaded 17 times
More Related Content
Similar to Information Governance and ediscovery in office 365 ediscovery deep dive
Information Governance and ediscovery in office 365 ediscovery deep dive
- 1. Part II: eDiscoveryDeep Dive October 27, 2015 Office 365 for the Information Governance and eDiscovery Practitioner
- 2. Part I: The Fundamentalsof Office 365 What is Office 365 (it’s not just email in the cloud!) but rather an entire ecosystem of applications, tools, and content. This webinar breaks it all down. • The Office 365 plans available— and why this is important • The primary system components (Exchange, SharePoint, and Skype for Business) • Types of data and ESI likely to reside in Office 365 • Overview of the Information Governance and eDiscovery features built into the platform Three-Part Webinar Series: Office 365 for the Information Governance and eDiscovery Practitioner Part II: eDiscovery Deep Dive • When: Tuesday, October 27 at 1:00 PM Eastern Time Can you address some, all, or none of your eDiscovery requirements and needs using the built-in eDiscovery features of Office 365? This webinar will help organizations answer this question. • Review of type of ESI available for discovery from Office 365 • eDiscovery Center explained: where much of the eDiscovery activity takes place • Exchange (email) only eDiscovery • Office 365 Compliance Center • Pros and cons of built-in eDiscovery features • Guest Speaker: Craig Ball Part III: Information Governance and RIM • When: Tuesday, November 17 at 1:00 PM Eastern Time Office 365 provides several different approaches to the retention and disposition of data—including full records management capabilities via SharePoint. This webinar will provide an overview of the various options and approaches to managing data residing in Office 365. • Options for records management in SharePoint and Exchange • Security and compliance features – Data loss prevention (DLP) – Mobile device management (MDM) – Information Rights Management (IRM) – Encryption – Auditing • Guest Speaker: John Holliday http://dtiglobal.com/news-events/events
- 3. Housekeeping • Today’s webinaris being recorded and will be available for download within 1-2 days • If you experience technical problems please call 888- 447-1119 and press “2” • To make comments or ask questions- type and enter via the “Chat” function
- 4. Guest Speaker 4 Craig Ball,Esq., ESI Special Master and Attorney, Computer Forensics Examiner, Author and Educator Craig is a trial lawyer, computer forensic examiner, law professor and noted authority on electronic evidence. He limits his practice to serving as a court-appointed special master and consultant in computer forensics and electronic discovery.
- 5. 5 John Collins, JD,Director of Information Governance Solutions, DTI John Collins, J.D., DTI’s Director of Information Governance Solutions, has extensive experience assisting clients with a full range of information governance initiatives, including ESI data mapping, litigation and electronic discovery readiness, and the development of e-mail management and records retention policies.
- 6. Agenda 6 • Review: whatis Office 365? • eDiscovery tools in Office 365 viewed from 100k feet • Some plans do, some plans don’t (include eDiscovery tools) • Some history • ESI available for discovery in Office 365 • ESI subject to Office 365’s ediscovery tools • Exchange-specific eDiscovery tools –Live demonstration • SharePoint eDiscovery Center –Live demonstration • Compliance Center • Things to know about eDiscovery in Office 365
- 7. What is Office365? 7 • Suite of Services/Products – E-mail, Instant Messaging, Collaboration, File Storage – Office (Word, Excel, PowerPoint, Access, etc.), Exchange, SharePoint, Skype for Business • Software as a Service (SaaS) – Individuals, companies, organizations subscribe to the service for a fixed monthly or annual fee • Cloud – Quintessential example of cloud computing – Hardware, storage, backup and disaster recovery are handled by Microsoft • Brand – Microsoft is labeling products and services as “Office 365” or part of Office 365 (Project for Office 365, Dynamics CRM, etc.) • Juggernaut – 84% growth in # of seats year-over-year – 1 out of every 4 enterprise customers of Microsoft use Office 365
- 8. Office 365: aplan for all 8 • Office 365 is marketed and sold to two distinct market segments: 1. Home (households, individuals, students) 2. Business (corporations, government, education, nonprofit)
- 9. 100k View ofeDiscovery Features in Office 365 9 • Search across one or more mailboxes and SharePoint sites • Preserve Exchange/Outlook, SharePoint, and Skype for Business content • “Preview” preserved content • Collect and export Exchange/Outlook, SharePoint, and Skype for Business content • Coming Soon! Equivio Zoom – Near-Duplicate Detection – Thread Analysis – Relevance ranking – Themes and Search Will cover on 11/17!
- 10. Not all Office365 plans include eDiscovery features 10 Office 365 Enterprise E1 Office 365 Enterprise E3 Office 365 Enterprise E4 Office 365 Enterprise K1 Office 365 Education E1 Office 365 Education E3 Office 365 Education E4 Office 365 Government K1 Office 365 Government E1 Office 365 Government E3 Office 365 Government E4 eDiscovery Center (SharePoint Online) No No No Yes Yes Yes No Litigation Hold (Exchange Online) No No No No Yes Yes No In-Place Hold (Exchange Online) No No No No Yes Yes No In-Place eDiscovery (Exchange Online) No No Yes Yes Yes Yes Yes Feature Office 365 Small Business Office 365 Small Business Premium Office 365 Midsize Business Full Office 365 Service Comparison: https://technet.microsoft.com/en-us/office/dn788955.aspx?f=255&MSPPError=-2147217396
- 11. Through the Years:eDiscovery in Exchange 11 Exchange 4.0 1996 Exchange 5.5 1997 Exchange 2000 2000 Exchange 2003 2003 Exchange 2007 2006 Exchange 2010 Office 365 2010 Exchange 2013 Equivio acquired Office 365 Exchange 2016 First Generation Legal Hold Mailbox Search & Export Second Generation Legal Hold Mailbox Search & Export Third Generation Legal Hold Mailbox Search & Export CloudFirst 1996: Exchange Introduced 2010: First eDiscovery specific features
- 12. Through the Years:eDiscovery in SharePoint 12 SharePoint Portal Server 2001 SharePoint Team Services 2002 Windows SharePoint Services 2.0 and SharePoint Portal Server 2003 Windows SharePoint Services 3.0 and MOSS 2007 SharePoint Foundation 2010 and SharePoint Server 2010 and SharePoint Enterprise 2010 Office 365 (2010) SharePoint Foundation 2013 and SharePoint Server 2013 Equivio acquired (January 2015) SharePoint 2016 Still weak but can put non- records on hold CloudFirst “Weak” legal hold introduced eDiscovery Center introduced 2001: SharePoint Introduced 2007: First eDiscovery specific features
- 13. What kinds ofESI is available for discovery from Office 365? 13 •Files of all types (Word, PowerPoint, Excel, PDF, Visio, CAD, audio, video, “Sway,” and more) •Sites, web pages (blog, wiki, discussions, and more) •“App” content (calendar, survey, newsfeed, announcements) •E-mail & attachments •Contacts •Calendar •Tasks •Notes •Journal •Instant Messaging chats •Voice and video call logs •Word •Excel •PowerPoint •Outlook •OneNote •Access •Publisher
- 14. What ESI inOffice 365 is subject to the built-in eDiscovery tools? 14 Exchange Public Folders Yes No Outlook Web App “Groups” (rolling out) Meeting content, recorded meetings
- 15. Exchange In-Place eDiscovery& Hold 15 Exchange In-Place eDiscovery and Hold allows an individual with appropriate permissions to search one or more mailboxes and a) place the mailbox on hold, b) preview the search results, c) export the search results 1 Create search and (optionally) place ESI on hold 2 Preview results Refine/modify search 3 Export 4 Remove hold, delete search One or more mailboxes Exchange/Outlook Boolean, Proximity, Wildcard, date range, metadata PST Skype for Business Email IM Contacts Call Logs Notes Meetings IM Call logs Journal OWA Preview Mode Discovery Search Mailbox Tasks Conversation History
- 16. Enabling Defensible LegalHold: Recoverable Items Folder 16 • Users do not have access to the recoverable items folder • eDiscovery search and hold does have access
- 17. File Formats Indexedby Exchange Search in Office 365 17 Email message .eml Graphics Interchange Format .gif JPEG .jpeg Microsoft Excel .xls, .xlt, .xlsx, .xlsm, .xlb, .xlc, .xlsb Excel File odbcexcel Microsoft InfoPath .infopathml Microsoft Office Binder .obt, obd Microsoft PowerPoint .pptx, .pptm, .ppt, .ppsx, .ppsm, .pps, .ppam, .potm, .pot, .potx Microsoft Publisher .pub Microsoft Word .doc, .docm, .dotx, .dotm, .dot, .docx Microsoft XML Paper Specification .xps OneNote .one OpenDocument Presentation .odp OpenDocument Spreadsheet .ods OpenDocument Text .odt Outlook Item .msg Portable Document Format .pdf Rich Text .rtf Text .txt vCalendar .vcs vCard .vcf Visio .vdw, .vsd, .vss, .vst, .vsx, .vtx, .vssx, .vssm, .vsdm, .vstx, .vstm, .vdx Web archive .mhtml Web page .html XML document .xml ZIP archive .zip AVI .avi Bitmap .bmp MP3 .mp3 MPEG .mpeg PNG .png Microsoft Windows Wave Audio .wav Items Not Indexed Include…
- 19. SharePoint eDiscovery Center 19 1 Createcase 2 Choose sources 3 Create query/queries 4 Place on hold, preview results refine results 5 Export 6 Remove hold, close case One or more mailboxes Exchange = PST One or more SharePoint sites SharePoint Boolean, Proximity, Wildcard, date range, metadata Filter by type of ESI SharePoint = Natives, .mht, .csv EDRM load file, reports Web Pages Files Lists App Data Web Content SharePoint eDiscovery Center allows an individual with appropriate permissions to search one or more mailboxes and SharePoint sites and a) place the mailbox(s) and site(s) on hold, b) preview the search results, c) export the search results
- 20. Enabling Defensible LegalHold: Preservation Hold Library 20 • A “preservation hold library” is created the first time a SharePoint site is put under hold. • Users can continue to work on content without disruption • Content on hold-including web pages, documents, lists, and other items are preserved as needed (if user edits an item it prompts preservation) • Users don’t see the preservation hold library • To preserve all versions of content in a site versioning must be enabled
- 21. File Formats Indexedby SharePoint in Office 365 21
- 23. Compliance Center 23 • IntroducedJanuary 2015 • Future primary location of Office 365 eDiscovery features • Objective is to bring together compliance related features in a single console (eDiscovery, MDM, retention, auditing, etc.) • Currently has a mix of unique and duplicate features – Unique: • Can search across ALL mailboxes and SharePoint sites in a single search – Duplicate • eDiscovery link redirects to the SharePoint eDiscovery Center • Limitations: some features are not fully baked – Example: search does not have an export or legal hold function (executing these functions requires use of PowerShell) https://technet.microsoft.com/EN-US/library/dn876574.aspx
- 24. Things to knowabout Office 365 built-in eDiscovery 24 • When users leave what happens? – If mailbox is on hold, then user is converted to inactive mailbox and subject to eDiscovery • Maximum of 10,000 mailboxes may be searched and placed on hold via a single eDiscovery search • Maximum of 2 eDiscovery searches can run at a time • Maximum # of keywords in a single eDiscovery search: 500 • Maximum # of items displayed in preview: 200 • 5: maximum # of holds that can be in effect that use scoping (after that all content is put on hold) • Can take up to 1 hour for legal hold to take effect • Quota! There is a 100 gigabyte quota on the Recoverable Items folder (can be increased, requires call to Microsoft)—hold will stop working if the quota is reached • There are some limits to the # of sources that can be selected in eDiscovery Center • Keyword statistics do not appear for searches that include 100+ mailboxes
- 25. Things to knowabout Office 365 built-in eDiscovery 25 • E-mail de-duplication based on hash value calculated using: – InternetMessageId – ConversationTopic – IsSentItems – BodyTagInfo • Unsearchable items – Files and other content that can’t be indexed for various reasons: • Image files (TIFF, non-search PDF, etc.), MP3 (Unified Messaging!), bitmap • Partially indexed/indexing error • Large Excel files • Encrypted using non-Microsoft technology or S/MIME • Password protected – Option to include unsearchable items when copying/exporting search results
- 26. Concluding Thoughts 26 • Velocityand scope of discovery in Office 365 is a challenge – New productivity and collaboration features are rolled out constantly—just like Smartphone apps – New types of ESI (for example, “Sway”) are regularly introduced – eDiscovery and IG features are in continual development and evolution • Hybrid – Many organizations will have a hybrid implementation of Office 365 where some users are in the cloud and some are on-prem (temporarily or permanently) • Fast moving area – Don’t assume your outside lawyers or service providers are up to speed • There are limitations in the native tools – Important to know what they are and if/where they might impact your approach to discovery • For lawyers: the bar for attaining and maintaining the duty of competency is higher • For IG professionals: master O365’s IG and eDiscovery features and secure a voice at the table with IT
- 27. Learning about eDiscoveryand IG in Office 365 27 https://technet.microsoft.com/en-us/library/dn532171.aspx
- 28. Keeping up withOffice 365 28 http://success.office.com/en-us/roadmap/
- 29. DTI Information GovernanceServices 29 Consulting • Records and Information Management (RIM) – Assessments – Policies and schedules – Program implementation • eDiscovery and Litigation Readiness – Assessments – eDiscovery response planning and implementation – Process design and implementation • ESI Data Mapping – Proactive process to “map-out” an organization’s IT systems and ESI sources – Proprietary “systems” and risk based approach Technology Services • Defensible disposition and deletion – Categorization – Repository/application retirement – Content audit – File share and SharePoint cleanup • Email and archive migration – Archive retirement – Migrate email to cloud – PST consolidation – Legal hold repository • Sensitive Data Retrieval/Remediation – Targeted identification of PHI, HIPAA, PCI, IP, and other sensitive and critical data types • Delete • Copy/Move • Audit Office 365 Consulting, Training, and Implementation • Office 365 Readiness and Strategy – eDiscovery best practices and workflows • Office 365 eDiscovery Outsourcing – DTI operates eDiscovery features and functions • Office 365 Email Management and OneDrive for Business Planning • Legal Hold Process and Planning • Training – Half or full Day workshops and training for law firms and corporations