Salient Logo
Salient Logo

Navigating the eDiscovery minefield of email archiving

For most eDiscovery cases, email inboxes are a treasure trove of information. Everything from the content of the email messages themselves, to their attachments, links, and metadata, can hold invaluable investigatory leads and/or evidence. However, email archiving and 3rd party software can complicate the process of eDiscovery data collection.

Email-related challenges for eDiscovery 

The trouble is, ever since becoming the default business communication channel, email volumes have soared. It’s now estimated that within three years there will be over 40 billion more emails sent every day. That’s a lot of ground for investigators to cover, cost-effectively.  

High volumes, paired with increasing regulatory requirements necessitating stricter retention policies, have also placed far greater importance on email archiving – often performed by third-party applications working hand-in-hand with Microsoft 365. The result is a complex landscape in which knowing where to look and how to gather together emails, attachments, and file links is no longer a simple or intuitive matter. 

How can you be sure that file attachments have been stored with the emails? Are you confident that links referencing document libraries in your Microsoft 365 are still valid? Is it possible that files have been edited or deleted since they were linked in an email? Can you tell which version of a document a specific email is referencing? All of these questions may be critical for an investigation but, without advanced awareness and preparation, can be difficult to answer. 

Family matters: preserving the relationships between emails and their attachments 

With server-based email, emails and their attachments are sent together, stored together, and produced together. Their relationships remain clear and intact.  

When using Microsoft 365, on the other hand, users seldom attach documents themselves directly to an email. Instead, they include links to documents (Cloud attachments) in OneDrive or SharePoint, directing recipients to view the document in place, online.  

This approach means emails and attachments are not stored together and have no obvious connection when viewed in isolation. This can make it impossible to link a specific document to a specific email after production or export unless measures have been taken during collection to preserve these essential familial ties. 

Related document retention issues 

Microsoft 365 retention policies can also throw a spanner in eDiscovery works – particularly if they’ve not been thoroughly thought-out or kept updated.  

Retention policies affect how long data is available and what happens to it at the end of that period. Clear data lifecycle management policies help ensure retention and deletion policies are fit for purpose, meet both business and regulatory requirements, and keep data available for eDiscovery as/when necessary. 

Organisations using non-Microsoft email archiving technologies will also need to remember that disposition policies will not automatically apply. As a result, it’s possible that archived content may be retained beyond its mandatory expiry date, remaining discoverable with all the associated costs and risks that brings. 

A cautionary tale about email archiving 

A Salient client with a third-party email archiving solution found themselves with an eDiscovery requirement. They were able to use their archive tool to search for emails related to their investigation. On closer examination, however, they found the emails contained links to documents that had apparently been deleted from their Microsoft 365 environment.  

They discovered that their archive and live environment’s retention policies were misaligned, causing a mismatch in information that threw their investigation for a serious loop. 

The expert’s take: Very often, issues like this are only discovered once an eDiscovery case has started. The key (from a reactive perspective) is to find them as early as possible to inform early case assessment. 

There is, however, an opportunity for corporates to get ahead of problems like this by proactively documenting the eDiscovery process. Done well, this identifies gaps and hurdles for remediation before an actual eDiscovery requirement occurs, preventing situations like the above from arising. .

Move away from the reactive and drive down the cost of eDiscovery by embracing a proactive approach.  Get in touch to find out more about our eDiscovery maturity assessment >>

The challenges and pitfalls of eDiscovery in Microsoft 365

What does Microsoft Purview offer a legal team? How can the technology be used for eDiscovery activities and what sorts of challenges might you face?

Read the article >>

Microsoft Purview eDiscovery is a powerful tool in the right hands. Our experts share the causes and effects of over- and under-collection that are symptomatic of reactive eDiscovery requests.

Read the article >>

Encrypted data can create blind spots that, without expert knowledge, could go unnoticed during the search/collection/export of data during an eDiscovery case. 

Read the article >>

Email inboxes are a treasure trove of information. However, long term retention in email archives and preserving the relationships between emails, links, attachments can pose eDiscovery challenges.

Read the article >>

Indexing is the process of producing a searchable catalogue of files, messages and other content in a set of electronic data. Understanding how indexing works in Microsoft 365 is vital for acccurate and complete eDiscovery.

Read the article >>

Microsoft Purview’s eDiscovery tools can be directly affected by broader data governance and compliance issues. Our experts explore issues like data sovereignty and data residency in eDiscovery.  

Read the article >>