Content search eDiscovery of Exchange Online Mailbox

GoodResource 376 Reputation points
2022-03-29T09:46:27.183+00:00

Hi,

We have an user, who has the tendency to keep moving his emails to PST files. Now all the PST files have gone corrupt and beyond recovery. The mailbox was not put on hold. Just wanted to know Content Search (ediscovery) in M365 Compliance center, will it let all the emails which got moved (or deleted) to be restored via exporting to a PST file? Or will it do search only on the present state of Exchange Online Mailbox?

As a test, i could see a mailbox of 800 MB but when i do content search it comes as 2.2 GB. Why such difference?

Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,305 questions
Microsoft Exchange Hybrid Management
Microsoft Exchange Hybrid Management
Microsoft Exchange: Microsoft messaging and collaboration software.Hybrid Management: Organizing, handling, directing or controlling hybrid deployments.
1,950 questions
{count} votes

2 answers

Sort by: Most helpful
  1. Andy David - MVP 143.6K Reputation points MVP
    2022-03-29T10:39:10.433+00:00

    No, it will only pick up the mail that exists now in the mailbox. If they exist in the mailbox itself that is viewable to the end user or in the recoverable items area, the search will pick that up

    https://learn.microsoft.com/en-us/exchange/security-and-compliance/recoverable-items-folder/recoverable-items-folder

    Often the difference is because of attachments or "Unsearchable Items"

    https://learn.microsoft.com/en-us/exchange/unsearchable-items-in-exchange-ediscovery-exchange-2013-help


  2. Andy David - MVP 143.6K Reputation points MVP
    2022-03-30T11:38:21.993+00:00

    Yes, once the mailbox is on hold, then any items moved to a pst will be preserved and recoverable with Ediscovery.
    Any messages moved to a pst are essentially hard-deleted and will be in the recoverable items folder.

    https://learn.microsoft.com/en-us/exchange/policy-and-compliance/recoverable-items-folder/recoverable-items-folder?view=exchserver-2019

    0 comments No comments