Perform eDiscovery exercise in SharePoint 2013

In a previous post I discussed what eDiscovery is and what is its place within SharePoint 2013. In this post I will explain how to exercise an eDiscovery task using features provided by SharePoint. Before we begin, let’s break the features in to 4 components.

1. eDiscovery site Templates

If we take a scenario of an organization, which can have multiple litigation related cases, audit exercises, etc.. it can have a site collection created from the template “eDiscovery Center” to manage all. You need to keep in mind that the eDiscovery Center template is available for Enterprise license only. After you create a site collection based on eDiscovery Center template, you can centrally manage all your eDiscovery related cases.

   

To create individual cases, We have another template called “eDiscovery Case”. If we create a case using this template it will be created as a sub web.

Each case is equipped with sections called eDiscovery sets,Queries, Exports. Furthermore record managers and others in legal team (site users) can use normal collaboration features from document libraries, calendars, task lists etc..

2. In-Place hold (In-Place preservation)

As we discussed in earlier post in-place hold is a mechanism to preserve content for litigation. Using eDiscovery features in SharePoint 2013 we can preserve content in SharePoint itself, Exchange mailboxes and Lync content. Hold can be placed either at the site or mailbox level, or can use query-based preservation.

Once you create a eDiscovery case, you can create eDiscovery sets to discover (find) and hold specific content. To preserve content, first we need to click on new item in eDiscovery sets.

It allows us to add multiple sources (SharePoint 2013 sites or Exchange mail boxes) 

After selecting the source, we can click on Enable In-Place Hold radio  button to preserve the content.

Lets assume you have thousands or millions of records in the site collection, It’ll be very difficult and expensive to process all of those content by the legal team. Gartner mentioned that, discovering right content accounts 35% of total litigation costs in USA. It sums up to billions. So to make our lives easier we can filter contents using queries.

We can filter content in 2 ways.

a) Apply filter from eDiscovery set

We can do that while we create the eDiscovery set or by editing an existing eDiscovery set. Let’s assume I have a large set of documents, and I need only content within a specific time frame and content that relate to “Research”. So I would apply a filter as below

b) Add queries to the content from Query and Export section

Lets assume that I' have multiple data sources, so I create multiple eDiscovery sets to easily manage the eDiscovery process. Then I figure out the content is still too large for the litigation process.  eDiscovery query section comes very handy at that point as I can apply filters to a specific eDiscovery set, all or multople discovery sets.

3. eDiscovery Export

Once we discover the content by above means we need to download the content so we can produce them to legal team for review. To do that there is an export tool.

To export the content we need to go to search and export section and click on export button

We can either download content or download the content.

The export tool download documents and lists items as well. Furthermore it generates a manifest file with metadata which complies Electronic Discovery Reference Model (EDRM). This itself is a very important feature. Let’s assume the litigation team has a 3rd party tool which they use to proof read the discovered content and it can input EDRM compliant content. Then we can directly input the exported package to that system. So as you can see there can be various interactions with other systems.

4. eDiscovery API

We can use the eDiscovery API to extend default features using components of Microsoft,Office.Server.Discovery namespace.

Above is a brief introduction on how to use eDiscovery features in SharePoint. You can find further info by referring following resources

• Good article from MVP blog 
• MSDN

Introduction to eDiscovery in SharePoint 2013

Enterprise Content Management in SharePoint

Enterprise Content Management (ECM) practice was introduced to SharePoint with SharePoint 2007.From that point onwards various new ECM features were added. There were notable additions and dramatic improvements  in SharePoint 2010 ECM features. SharePoint 2013 also have added some important features to the ECM stack.

Although few eDiscovery features were available in earlier versions, I would say the complete eDiscovery solution is introduced with SharePoint 2013. Before we discuss how eDiscovery features are implemented in SharePoint, it’s better to understand the eDiscovery concept.

eDiscovery

According to the definition, eDiscovery is the prrocess of discovering electronically stored information that is relevant to legal matters such as litigation, audits and investigations. As you would correctly assume, eDiscovery is not a concept introduced by SharePoint. SharePoint has implemented the concept electronically to make record managers and other stakeholders life easier and to save the huge costs involved with the litigation process.

Generally an eDiscovery exercise consist of following steps.

Simply put, eDiscory process starts with discovering (finding) relevant content and preserve that content so end users can’t modify them. After that, preserved content will be filtered to select only relevant information. Finally it is processed by legal/audit team to produce final outcome.

eDiscovery in SharePoint 2013

As I mentioned earlier, some eDiscovery features were available in earlier SharePoint versions, but with limitations. For an example SharePoint 2007 has an ability to put records (content) on hold where users can’t do modifications on them. SharePoint 2010 introduced major improvements by allowing site level holds and introduced the concept of search based  discovery.

But there were few limitations in SharePoint 2010 version of eDiscovery. Mainly it could discover content located only in SharePoint farm. Furthermore once content is on hold they become read only. If we take a real world scenario of litigation, which might take few months to complete, would result in disruption in business operations as relevant documents are read only.

In SharePoint 2013, above 2 limitations have being addressed successfully. First limitation is addressed allowing eDiscovery to discover content from SharePoint 2013, Exchange 2013 and Lync 2013. You can get a better understanding from the diagram given below.

The second limitation is eliminated by allowing end users to modify preserved content. But this will confuse readers as our objective is to preserve hold content to avoid modification. That’s true. but SharePoint implemented this in a smarter way.

Let’s check how it works. If a document is on hold stage and an end user modifies the content, original version of the document is moved to another library called “Preservation Hold Library”. when the same content is required for litigation, original document from preservation hold library will be provided. By doing this, it gives business users two benefits.

• Avoid disruptions in business process by allowing users to edit
• Save storage space as documents are not copied to different place 

eDiscovery in SharePoint 2013 includes new ways to reduce the cost and complexity of discovery. These include:

• The eDiscovery Center, a central SharePoint site used to manage preservation, search, and export of content stored in Exchange and SharePoint across SharePoint farms and Exchange servers.
  
• SharePoint In-Place Hold, which preserves entire SharePoint sites. In-Place Hold protects all documents, pages, and list items within the site but allows users to continue to edit and delete preserved content.
  
• Exchange In-Place Hold, which preserves Exchange mailboxes. In-Place Hold protects all mailbox content through the same UI and APIs used to preserve SharePoint sites.
  
• Query-based preservation allows users to apply query filters to one or more Exchange mailboxes and SharePoint sites and restrict the content that is held.

How eDiscovery works in SharePoint 2013

eDiscovery uses search service applications (SSAs) to crawl SharePoint farms. You can configure SSAs in many ways, but the most common way is to have a central search services farm that crawls multiple SharePoint farms. You can use this one search service to crawl all SharePoint content, or you can use it to crawl specific regions—for example, all SharePoint content in Europe.

To crawl a SharePoint farm, search first uses a service application proxy to connect to it. The eDiscovery Center uses the proxy connection to send preservations to SharePoint sites in other SharePoint farms.