Introduction to eDiscovery in SharePoint 2013

Enterprise Content Management in SharePoint

Enterprise Content Management (ECM) practice was introduced to SharePoint with SharePoint 2007.From that point onwards various new ECM features were added. There were notable additions and dramatic improvements  in SharePoint 2010 ECM features. SharePoint 2013 also have added some important features to the ECM stack.

Although few eDiscovery features were available in earlier versions, I would say the complete eDiscovery solution is introduced with SharePoint 2013. Before we discuss how eDiscovery features are implemented in SharePoint, it’s better to understand the eDiscovery concept.

eDiscovery

According to the definition, eDiscovery is the prrocess of discovering electronically stored information that is relevant to legal matters such as litigation, audits and investigations. As you would correctly assume, eDiscovery is not a concept introduced by SharePoint. SharePoint has implemented the concept electronically to make record managers and other stakeholders life easier and to save the huge costs involved with the litigation process.

Generally an eDiscovery exercise consist of following steps.

Simply put, eDiscory process starts with discovering (finding) relevant content and preserve that content so end users can’t modify them. After that, preserved content will be filtered to select only relevant information. Finally it is processed by legal/audit team to produce final outcome.

eDiscovery in SharePoint 2013

As I mentioned earlier, some eDiscovery features were available in earlier SharePoint versions, but with limitations. For an example SharePoint 2007 has an ability to put records (content) on hold where users can’t do modifications on them. SharePoint 2010 introduced major improvements by allowing site level holds and introduced the concept of search based  discovery.

But there were few limitations in SharePoint 2010 version of eDiscovery. Mainly it could discover content located only in SharePoint farm. Furthermore once content is on hold they become read only. If we take a real world scenario of litigation, which might take few months to complete, would result in disruption in business operations as relevant documents are read only.

In SharePoint 2013, above 2 limitations have being addressed successfully. First limitation is addressed allowing eDiscovery to discover content from SharePoint 2013, Exchange 2013 and Lync 2013. You can get a better understanding from the diagram given below.

The second limitation is eliminated by allowing end users to modify preserved content. But this will confuse readers as our objective is to preserve hold content to avoid modification. That’s true. but SharePoint implemented this in a smarter way.

Let’s check how it works. If a document is on hold stage and an end user modifies the content, original version of the document is moved to another library called “Preservation Hold Library”. when the same content is required for litigation, original document from preservation hold library will be provided. By doing this, it gives business users two benefits.

• Avoid disruptions in business process by allowing users to edit
• Save storage space as documents are not copied to different place 

eDiscovery in SharePoint 2013 includes new ways to reduce the cost and complexity of discovery. These include:

• The eDiscovery Center, a central SharePoint site used to manage preservation, search, and export of content stored in Exchange and SharePoint across SharePoint farms and Exchange servers.
  
• SharePoint In-Place Hold, which preserves entire SharePoint sites. In-Place Hold protects all documents, pages, and list items within the site but allows users to continue to edit and delete preserved content.
  
• Exchange In-Place Hold, which preserves Exchange mailboxes. In-Place Hold protects all mailbox content through the same UI and APIs used to preserve SharePoint sites.
  
• Query-based preservation allows users to apply query filters to one or more Exchange mailboxes and SharePoint sites and restrict the content that is held.

How eDiscovery works in SharePoint 2013

eDiscovery uses search service applications (SSAs) to crawl SharePoint farms. You can configure SSAs in many ways, but the most common way is to have a central search services farm that crawls multiple SharePoint farms. You can use this one search service to crawl all SharePoint content, or you can use it to crawl specific regions—for example, all SharePoint content in Europe.

To crawl a SharePoint farm, search first uses a service application proxy to connect to it. The eDiscovery Center uses the proxy connection to send preservations to SharePoint sites in other SharePoint farms.