Content search eDiscovery of Exchange Online Mailbox

Question

Hi,

We have an user, who has the tendency to keep moving his emails to PST files. Now all the PST files have gone corrupt and beyond recovery. The mailbox was not put on hold. Just wanted to know Content Search (ediscovery) in M365 Compliance center, will it let all the emails which got moved (or deleted) to be restored via exporting to a PST file? Or will it do search only on the present state of Exchange Online Mailbox?

As a test, i could see a mailbox of 800 MB but when i do content search it comes as 2.2 GB. Why such difference?

Answer 1

No, it will only pick up the mail that exists now in the mailbox. If they exist in the mailbox itself that is viewable to the end user or in the recoverable items area, the search will pick that up

https://learn.microsoft.com/en-us/exchange/security-and-compliance/recoverable-items-folder/recoverable-items-folder

Often the difference is because of attachments or "Unsearchable Items"

https://learn.microsoft.com/en-us/exchange/unsearchable-items-in-exchange-ediscovery-exchange-2013-help

Answer 2

Yes, once the mailbox is on hold, then any items moved to a pst will be preserved and recoverable with Ediscovery.
Any messages moved to a pst are essentially hard-deleted and will be in the recoverable items folder.

https://learn.microsoft.com/en-us/exchange/policy-and-compliance/recoverable-items-folder/recoverable-items-folder?view=exchserver-2019