Last updated:

Microsoft Purview eDiscovery

Portal
purview.microsoft.com
Documentation
Microsoft Learn
I use it for
Collecting mailboxes from Microsoft 365, on site together with a bailiff (gerechtsdeurwaarder).

If a company’s email runs in Microsoft 365, the mailboxes are in the cloud and not on the computers on site. With Purview eDiscovery you retrieve them there directly: you place a hold, search and export, without touching a device of the custodian. Mention that in the report. It explains why you work through the administrator of somebody else’s environment instead of copying a drive. I asked that question myself on Microsoft Q&A. The community’s answer: the administrator can retrieve a dismissed employee’s email with eDiscovery, as long as it is within the retention period and the permissions are in place. That is a forum answer, not an official Microsoft statement.

Check beforehand

Whether a company uses Microsoft 365 can be seen in the public DNS. If the MX record ends in mail.protection.outlook.com, the email runs on Exchange Online and the assignment can be done remotely. You then do need somebody who manages the environment and gives you access.

Access

Even an administrator cannot simply export: the eDiscovery permissions have to be granted separately. Arrange that beforehand as far as possible. If you cannot be sure it will work, at least make sure you have a direct line to whoever ultimately manages the environment, in case something goes wrong on site. With an ex parte assignment you cannot prepare anything, and then you depend on the cooperation of whoever administers it on site. Check on signing in straight away whether you can start an export. Which role group may do what is on Microsoft Learn: Assign permissions in eDiscovery.

This is how I work:

  • A temporary account in my name, created by the administrator, with the password via a one-time link. Never users’ passwords and never a shared account, so that the audit log shows who did what.
  • An InPrivate window, and an empty download folder that does not sync with the cloud.
  • After the download I ask the administrator in writing to delete the account, with confirmation of the hour. Both the opening and the closing of the access go in the report.

Work in purview.microsoft.com. The Azure portal web.purview.azure.com carries the same name, but serves a different purpose and gives an error message.

eDiscovery (Standard) is enough for hold, search and export. You do not need Premium. Do not start a trial in somebody else’s environment either.

The steps

  1. Create a new case, named after your own file reference. Leave existing cases alone.
  2. Create a search with the mailboxes from the assignment as the source.
  3. From that search, place a hold on the complete mailboxes, and wait until the status is On.
  4. Set the date, look at the statistics and start the export.
  5. Download, compute the hashes and check.
  6. Turn the hold off and have the account deleted.

Hold first

In Exchange Online, deleted email can by default be recovered for fourteen days. After that it is gone, unless a hold or a retention policy is active. So place the hold at the first access, before you search. Note in the report how much time lay between the service of the order and the hold: what was deleted in that period can no longer be established.

After the export and the check you turn the hold off with Turn off. Do not delete it, so that it stays visible in the case. Microsoft then keeps a delay hold for another thirty days. Leaving a hold without an end date in place usually goes further than the order asks.

Hold first Timeline: between service of the order and the hold, email can disappear for good. Then: hold on, search and export, verify, hold off, account removed. deletion still possible service of order hold on first access search, export download, hash, check hold off Turn off, do not delete account removed The red part goes into the report as a limitation: what was deleted then can no longer be established.

The date: Purview works in UTC

Purview works in UTC, and a range such as (Date=2025-03-31..2025-12-31) includes both boundary days. A Belgian period that starts at midnight already starts in UTC on the evening before. So let the search start a day earlier, and remove that extra day afterwards on the basis of Belgian time. At the end, for the same reason, an hour or two of the next day comes along.

Belgian period against the query in UTC The period imposed, in Belgian time, begins at midnight. In UTC that is the day before. The query therefore starts a day earlier; the margin day and the last hour are removed afterwards. Imposed period Belgian time 1 April 00:00 31 December 24:00 Query in Purview Date=2025-03-31..2025-12-31, UTC covers the whole period margin day ± 1 u Red: is in the raw export, is removed afterwards from the delimited set, based on Belgian time.

This also shifts the counts:

  • Purview adds partially indexed items, independently of your search. They can include emails from far outside the period.
  • The statistics beforehand are an estimate and can deviate by a few items. Count on the export and the report.
  • For calendar items the Date field is the start date of the appointment, not the receipt. An invitation that arrived within the period for a later appointment therefore belongs.

Note every difference and the explanation. What falls outside the period you leave out of the delimited set. In the raw export it stays, with a note.

Export settings

  • One PST per mailbox, so that the origin is in the file name.
  • Keep the folder structure. Otherwise you see the original folders only in the report.
  • Indexed and partially indexed items.
  • No deduplication. Every mailbox has to be complete, even if the same email is in two mailboxes.
  • The default package size (PST 5 GB, ZIP 10 GB). A large mailbox then ends up in several PSTs. Compute a separate hash for each PST.

How long it takes

In my assignments an export took from half an hour for a few thousand items to almost three hours for a complete mailbox. If it is short, I stay on site until the download and the check are finished. If it takes long, I do the last steps from my office.

Check after the download

First compute the hash of the ZIP and then leave that file untouched. Extract to a separate folder and compute the hash of each PST.

Then do a smoke test, a spot check really. Does the ZIP open? Does an email load when you open it by hand, and is the text readable? Open one or two, chosen at random, and record how you chose them. Do not read further than necessary, certainly not if it is private correspondence. Of all the checks below, this is the most important.

The export comes with a report of CSV files: the items, the locations, the settings used and a summary. You base the count on that. In the settings you see afterwards which export options were on.

  • Count the items in each PST per folder, without changing the PST, and compare with the report.
  • Do not take counts from Outlook. The number next to a folder is sometimes the number of unread items.
  • Outlook writes to a PST as soon as you open it. Always open a copy.
  • Look at which folders there are. Chats from Teams and Skype are in the mailbox and come along, even if the assignment is only about email. Deleted items that can still be recovered are in a separate folder.

If the assignment does not call for an analysis of the content, the check stops here: oldest and newest item, folders and counts. State in the report that you did not look further.

Two sets: A and B

An export of a complete mailbox almost always contains more than the assignment asks for. What a party gets to see is decided by the judge. That is why I make two sets:

  • A: the raw export, complete and unchanged, with hash values. I keep that secured.
  • B: the delimited set, with what certainly falls within the assignment. I deliver that.

Both are described in the report.

The A/B split The person-specific export splits into category A, the source material that is kept secured, and category B, the production that is delivered. The judge decides on the scope, not the expert. Person-specific export Category A source material, hash values kept secured, not delivered Category B delimited set: undisputed within the assignment, is delivered Who gets to see category B is decided by the judge, not the expert.

Handing over to a lawyer

With only a PST a lawyer can do little. So I deliver one folder with:

  • the raw PSTs, unchanged. Whoever does not have Outlook can view them in the free GoldFynch PST Viewer, which reads the file in the browser without uploading it;
  • each email as a separate .eml file, with a sequence number in the name. That opens with a double click, with the attachments;
  • an Excel list with per email the number, the folder, the date in Belgian time, sender, recipients, subject, attachments and a link to the file;
  • a README.txt that explains what is where and what fell outside the period;
  • a manifest with the SHA-256 of each file.

I do not make PDFs in advance. The lawyer makes those from the emails they want to use as exhibits, because metadata is lost in the conversion.

An .eml from a PST is a reconstruction. For received email the original headers are kept, for sent email, drafts and calendar items they are rebuilt. The raw PST therefore remains the reference. Mention that in the report.

Test the extraction the way the recipient does it: with Windows’ own extract function, in a folder with a long path, for example under OneDrive. Email subjects quickly make paths of more than 260 characters, and emoji in a subject give file names that do not open everywhere. So shorten the subject in the file name, with only ordinary characters, and keep the number and date. Record the old and the new names in a separate file. The content of the .eml does not change as a result.

How I send the folder: Boomerang and two-channel transfer.

Sources

Purview regularly changes screen names. When in doubt, follow the documentation: