Add search results to a review set in eDiscovery (preview)

When you're satisfied with the results of a search and you're ready to review and analyze the results, you can add them to a review set in the case. Copying the original data to the review set also facilitates the review and analysis process by providing you with advanced analytics tools such as themes detection, near-duplicate detection, and email thread identification.

Tip

Get started with Microsoft Copilot for Security to explore new ways to work smarter and faster using the power of AI. Learn more about Microsoft Copilot for Security in Microsoft Purview.

Create or add results to a review set

Tip

Do you prefer an interactive configuration guide experience? Check out the Create and manage review sets guide.

When you add the results of a search to a review set (the review sets in a case are listed on the Review sets tab), the following things occur:

• The search is run again. This means the actual search results copied to the review set may be different than the estimated results that were returned when the search was last run.
• All items in the search results are copied from the original data source in the live services, and copied to a secure Azure Storage location in the Microsoft cloud.
• All items (including the content and metadata) are reindexed so that all data in the review set is fully searchable during the review of the case data. Reindexing the data results in thorough and fast searches when you search the data in the review set during the case investigation.
• A file encrypted with a Microsoft encryption technology and is attached to an email message that's returned in the search results is decrypted when the email message and attached file are added to the review set. You can review and query the decrypted file in the review set. You have to be assigned the RMS Decrypt role to add decrypted email attachments to a review set. For more information, see Decryption in Microsoft Purview eDiscovery tools.

To add data to a review set, complete the following steps:

1. Select a search on the Searches tab, then select Add to review set.

2. On the Add items to review set flyout page, select Add to a new review set or Add to an existing review set.

   For a new review set, enter a name for the review set. To add data to an existing review set, select a review set from the drop-down choices.

   Adding data to a review set is a long-running process. This process includes gathering items from the original data sources in Microsoft 365 (for example, from mailboxes and sites), copying them to the Azure Storage location (this copying process is also called ingestion), and then reindexing the items. You can track the progress on the Process manager page. After the review set processing is completed, select the Review sets tab in the case, and then select the review set to start the process of filtering, reviewing, tagging, and exporting data in the review set.

3. In the Select items to add to review set section, choose one of the following options:

   • Indexed items that match your search query:
   • Indexed items that match your search query and partially indexed items that may not match query:
   • Partially indexed items that may not match query:

4. In the What to include for files from ODSP sites? section, complete the following options:

   • Select document versions: Specify how many versions of SharePoint documents to collect. Choose from Latest version only, Recent 10 versions, Recent 100 versions, or All versions.
   • Select folder items: Choose one of following options to collect items inside subfolders of a matched folder:
     • Only include items that matches query
     • Include all items in folder even if they don't match query
   • Select items in lists and attachments (list expansion): Choose of the following to collect files attached to SharePoint lists and their child items.
     • Include all items in SharePoint if any item matches the query
     • If applicable, select the Include attachments of lists checkbox.

5. In the What to include for messages and related items from Mailboxes? section, select the following options as applicable:

   • Organize conversation into HTML transcript: Contextual chat messages are threaded into HTML transcript of ease of review/handling.
   • Include Teams and Viva Engage conversations: Collect up to 12 hours of related conversations when a message matches a search.
   • Access links (cloud attachments) in messages: Collect items from links to SharePoint or OneDrive. Choose from Latest version only, Recent 10 versions, Recent 100 versions, or All versions.

6. Review your selections for the review set, then select Add to review set. To cancel, select Cancel.

Optical character recognition

When you add search results to a review set, optical character recognition (OCR) functionality in eDiscovery (preview) automatically extracts text from images, and includes the image text with the data that's added to a review set. You can view the extracted text in the Text viewer of the selected image file in the review set. This lets you conduct further review and analysis on text in images. OCR is supported for loose files, email attachments, and embedded images. For a list of image file formats that are supported for OCR, see Supported file types in eDiscovery.

You have to enable OCR functionality for each case that you create in eDiscovery (preview). For more information, see Configure search and analytics settings.

Conversation threading

Instant messaging is a convenient way to ask questions, share ideas, or quickly communicate across large audiences. As instant messaging platforms, like Microsoft Teams and Viva Engage groups, become core to enterprise collaboration, organizations must evaluate how their eDiscovery workflow addresses these new forms of communication and collaboration.

The conversation reconstruction feature in eDiscovery (preview) is designed to help you identify contextual content and produce distinct conversation views. This capability allows you to efficiently and rapidly review complete instant message conversations (also called threaded conversations) that are generated in platforms like Microsoft Teams.

With conversation reconstruction, you can use built-in capabilities to reconstruct, review, and export threaded conversations. Use eDiscovery conversation reconstruction to:

• Preserve unique message-level metadata across all messages within a conversation.
• Collect contextual messages around your search results.
• Review, annotate, and redact threaded conversations.
• Export individual messages or threaded conversations

Terminology

Here are few definitions to help you get start using conversation reconstruction.

• Messages: Represent the smallest unit of a conversation. Messages may vary in size, structure, and metadata.

• Conversation: Represents a grouping of one or more messages. Across different applications, conversations may be represented in different ways. In some applications, there's an explicit action that results from replying to an existing message. Conversations are formed explicitly as a result of this user action. For example, here's a screenshot of a channel conversation in Microsoft Teams.

  

  In other apps (such as group chat messages in Teams), there isn't a formal reply chain and instead messages appear as a "flat river of messages" within a single thread. In these types apps, conversations are inferred from a group of messages that occur within a certain time. This "soft-grouping" of messages (as opposed to a reply chain) represent the "back and forth" conversation about a specific subject of interest.

Adding conversations to a review set

After you reviewing and finalizing the search query, you can add the search results to a review set. You can use the threaded conversations option to collect contextual messages from conversations that contain items that match the criteria of the search. After you select the thread conversations option, the following things can happen:

1. Using a keyword and date range query, the search returned a hit on Message 3. This message was part of a larger conversation, illustrated by CRC1.
2. When you add the data into a review set and enable the conversation retrieval options, eDiscovery goes back and collects other items in CRC1.
3. After the items are added to the review set, you can review all the individual messages from CRC1.