Office 365 for the Information Governance and ediscovery Practitioner. Part II: ediscovery Deep Dive October 27, 2015

Transcription

1 Office 365 for the Information Governance and ediscovery Practitioner Part II: ediscovery Deep Dive October 27, 2015

2 Three-Part Webinar Series: Office 365 for the Information Governance and ediscovery Practitioner Part I: The Fundamentals of Office 365 What is Office 365 (it s not just in the cloud!) but rather an entire ecosystem of applications, tools, and content. This webinar breaks it all down. The Office 365 plans available and why this is important The primary system components (Exchange, SharePoint, and Skype for Business) Types of data and ESI likely to reside in Office 365 Overview of the Information Governance and ediscovery features built into the platform Part II: ediscovery Deep Dive When: Tuesday, October 27 at 1:00 PM Eastern Time Can you address some, all, or none of your ediscovery requirements and needs using the built-in ediscovery features of Office 365? This webinar will help organizations answer this question. Review of type of ESI available for discovery from Office 365 ediscovery Center explained: where much of the ediscovery activity takes place Exchange ( ) only ediscovery Office 365 Compliance Center Pros and cons of built-in ediscovery features Guest Speaker: Craig Ball Part III: Information Governance and RIM When: Tuesday, November 17 at 1:00 PM Eastern Time Office 365 provides several different approaches to the retention and disposition of data including full records management capabilities via SharePoint. This webinar will provide an overview of the various options and approaches to managing data residing in Office 365. Options for records management in SharePoint and Exchange Security and compliance features Data loss prevention (DLP) Mobile device management (MDM) Information Rights Management (IRM) Encryption Auditing Guest Speaker: John Holliday

3 Housekeeping Today s webinar is being recorded and will be available for download within 1-2 days If you experience technical problems please call and press 2 To make comments or ask questions- type and enter via the Chat function

4 Guest Speaker Craig Ball, Esq., ESI Special Master and Attorney, Computer Forensics Examiner, Author and Educator Craig is a trial lawyer, computer forensic examiner, law professor and noted authority on electronic evidence. He limits his practice to serving as a court-appointed special master and consultant in computer forensics and electronic discovery. 4

5 John Collins, JD, Director of Information Governance Solutions, DTI John Collins, J.D., DTI s Director of Information Governance Solutions, has extensive experience assisting clients with a full range of information governance initiatives, including ESI data mapping, litigation and electronic discovery readiness, and the development of management and records retention policies. 5

6 Agenda Review: what is Office 365? ediscovery tools in Office 365 viewed from 100k feet Some plans do, some plans don t (include ediscovery tools) Some history ESI available for discovery in Office 365 ESI subject to Office 365 s ediscovery tools Exchange-specific ediscovery tools Live demonstration SharePoint ediscovery Center Live demonstration Compliance Center Things to know about ediscovery in Office 365 6

7 What is Office 365? Suite of Services/Products , Instant Messaging, Collaboration, File Storage Office (Word, Excel, PowerPoint, Access, etc.), Exchange, SharePoint, Skype for Business Software as a Service (SaaS) Individuals, companies, organizations subscribe to the service for a fixed monthly or annual fee Cloud Quintessential example of cloud computing Hardware, storage, backup and disaster recovery are handled by Microsoft Brand Microsoft is labeling products and services as Office 365 or part of Office 365 (Project for Office 365, Dynamics CRM, etc.) Juggernaut 84% growth in # of seats year-over-year 1 out of every 4 enterprise customers of Microsoft use Office 365 7

8 Office 365: a plan for all Office 365 is marketed and sold to two distinct market segments: 1. Home (households, individuals, students) 2. Business (corporations, government, education, nonprofit) 8

9 100k View of ediscovery Features in Office 365 Search across one or more mailboxes and SharePoint sites Preserve Exchange/Outlook, SharePoint, and Skype for Business content Preview preserved content Collect and export Exchange/Outlook, SharePoint, and Skype for Business content Coming Soon! Equivio Zoom Near-Duplicate Detection Thread Analysis Relevance ranking Themes and Search Will cover on 11/17! 9

10 Not all Office 365 plans include ediscovery features Office 365 Enterprise E1 Office 365 Enterprise E3 Office 365 Office 365 Enterprise E4 Enterprise K1 Feature Office 365 Small Business Office 365 Small Business Premium Office 365 Midsize Business Office 365 Education E1 Office 365 Government E1 Office 365 Education E3 Office 365 Government E3 Office 365 Education E4 Office 365 Government E4 ediscovery Center (SharePoint Online) No No No Yes Yes Yes No Litigation Hold (Exchange Online) No No No No Yes Yes No In-Place Hold (Exchange Online) No No No No Yes Yes No In-Place ediscovery (Exchange Online) No No Yes Yes Yes Yes Yes Office 365 Government K1 Full Office 365 Service Comparison: 10

11 Through the Years: ediscovery in Exchange Exchange Exchange Exchange Exchange Exchange First Generation Legal Hold Mailbox Search & Export Exchange 2010 Office Second Generation Legal Hold Mailbox Search & Export Exchange 2013 Equivio acquired Third Generation Legal Hold Mailbox Search & Export Office 365 Cloud First Exchange : Exchange Introduced 2010: First ediscovery specific features 11

12 Through the Years: ediscovery in SharePoint ediscovery Center introduced SharePoint 2016 SharePoint Portal Server 2001 SharePoint Team Services 2002 Windows SharePoint Services 2.0 and SharePoint Portal Server 2003 Weak legal hold introduced Windows SharePoint Services 3.0 and MOSS 2007 Still weak but can put nonrecords on hold SharePoint Foundation 2010 and SharePoint Server 2010 and SharePoint Enterprise 2010 Office 365 (2010) SharePoint Foundation 2013 and SharePoint Server 2013 Equivio acquired (January 2015) Cloud First 2001: SharePoint Introduced 2007: First ediscovery specific features 12

13 What kinds of ESI is available for discovery from Office 365? Instant Messaging chats Voice and video call logs Word Excel PowerPoint Outlook OneNote Access Publisher Files of all types (Word, PowerPoint, Excel, PDF, Visio, CAD, audio, video, Sway, and more) Sites, web pages (blog, wiki, discussions, and more) App content (calendar, survey, newsfeed, announcements) & attachments Contacts Calendar Tasks Notes Journal 13

14 What ESI in Office 365 is subject to the built-in ediscovery tools? Yes No Exchange Public Folders Outlook Web App Groups (rolling out) Meeting content, recorded meetings 14

15 Exchange In-Place ediscovery & Hold Exchange/Outlook Tasks Contacts Meetings Notes Journal 1 Create search and (optionally) place ESI on hold 2 Preview results Refine/modify search 3 Export 4 Remove hold, delete search Conversation History Call Logs IM One or more mailboxes OWA Preview Mode Discovery Search Mailbox PST Skype for Business Boolean, Proximity, Wildcard, date range, metadata Call logs IM Exchange In-Place ediscovery and Hold allows an individual with appropriate permissions to search one or more mailboxes and a) place the mailbox on hold, b) preview the search results, c) export the search results 15

16 Enabling Defensible Legal Hold: Recoverable Items Folder Users do not have access to the recoverable items folder ediscovery search and hold does have access 16

17 File Formats Indexed by Exchange Search in Office 365 message Graphics Interchange Format JPEG Microsoft Excel Excel File Microsoft InfoPath Microsoft Office Binder Microsoft PowerPoint Microsoft Publisher Microsoft Word Microsoft XML Paper Specification OneNote OpenDocument Presentation OpenDocument Spreadsheet OpenDocument Text Outlook Item Portable Document Format Rich Text Text vcalendar vcard Visio Web archive Web page XML document ZIP archive.eml.gif.jpeg.xls,.xlt,.xlsx,.xlsm,.xlb,.xlc,.xlsb odbcexcel.infopathml.obt, obd.pptx,.pptm,.ppt,.ppsx,.ppsm,.pps,.ppam,.potm,.pot,.potx.pub.doc,.docm,.dotx,.dotm,.dot,.docx.xps.one.odp.ods.odt.msg.pdf.rtf.txt.vcs.vcf.vdw,.vsd,.vss,.vst,.vsx,.vtx,.vssx,.vssm,.vsdm,.vstx,.vstm,.vdx.mhtml.html.xml.zip Items Not Indexed Include AVI Bitmap MP3 MPEG PNG Microsoft Windows Wave Audio.avi.bmp.mp3.mpeg.png.wav 17

18

19 SharePoint ediscovery Center 1 Create case 2 Choose sources 3 Create query/queries 4 Place on hold, preview results refine results 5 Export 6 Remove hold, close case One or more mailboxes Boolean, Proximity, Wildcard, date range, metadata Filter by type of ESI Exchange = PST SharePoint Web Pages Files Lists App Data Web Content One or more SharePoint sites SharePoint = Natives,.mht,.csv EDRM load file, reports SharePoint ediscovery Center allows an individual with appropriate permissions to search one or more mailboxes and SharePoint sites and a) place the mailbox(s) and site(s) on hold, b) preview the search results, c) export the search results 19

20 Enabling Defensible Legal Hold: Preservation Hold Library A preservation hold library is created the first time a SharePoint site is put under hold. Users can continue to work on content without disruption Content on hold-including web pages, documents, lists, and other items are preserved as needed (if user edits an item it prompts preservation) Users don t see the preservation hold library To preserve all versions of content in a site versioning must be enabled 20

21 File Formats Indexed by SharePoint in Office

22

23 Compliance Center Introduced January 2015 Future primary location of Office 365 ediscovery features Objective is to bring together compliance related features in a single console (ediscovery, MDM, retention, auditing, etc.) Currently has a mix of unique and duplicate features Unique: Can search across ALL mailboxes and SharePoint sites in a single search Duplicate ediscovery link redirects to the SharePoint ediscovery Center Limitations: some features are not fully baked Example: search does not have an export or legal hold function (executing these functions requires use of PowerShell) 23

24 Things to know about Office 365 built-in ediscovery When users leave what happens? If mailbox is on hold, then user is converted to inactive mailbox and subject to ediscovery Maximum of 10,000 mailboxes may be searched and placed on hold via a single ediscovery search Maximum of 2 ediscovery searches can run at a time Maximum # of keywords in a single ediscovery search: 500 Maximum # of items displayed in preview: 200 5: maximum # of holds that can be in effect that use scoping (after that all content is put on hold) Can take up to 1 hour for legal hold to take effect Quota! There is a 100 gigabyte quota on the Recoverable Items folder (can be increased, requires call to Microsoft) hold will stop working if the quota is reached There are some limits to the # of sources that can be selected in ediscovery Center Keyword statistics do not appear for searches that include 100+ mailboxes 24

25 Things to know about Office 365 built-in ediscovery de-duplication based on hash value calculated using: InternetMessageId ConversationTopic IsSentItems BodyTagInfo Unsearchable items Files and other content that can t be indexed for various reasons: Image files (TIFF, non-search PDF, etc.), MP3 (Unified Messaging!), bitmap Partially indexed/indexing error Large Excel files Encrypted using non-microsoft technology or S/MIME Password protected Option to include unsearchable items when copying/exporting search results 25

26 Concluding Thoughts Velocity and scope of discovery in Office 365 is a challenge New productivity and collaboration features are rolled out constantly just like Smartphone apps New types of ESI (for example, Sway ) are regularly introduced ediscovery and IG features are in continual development and evolution Hybrid Many organizations will have a hybrid implementation of Office 365 where some users are in the cloud and some are on-prem (temporarily or permanently) Fast moving area Don t assume your outside lawyers or service providers are up to speed There are limitations in the native tools Important to know what they are and if/where they might impact your approach to discovery For lawyers: the bar for attaining and maintaining the duty of competency is higher For IG professionals: master O365 s IG and ediscovery features and secure a voice at the table with IT 26

27 Learning about ediscovery and IG in Office

28 Keeping up with Office

29 DTI Information Governance Services Office 365 Consulting, Training, and Implementation Office 365 Readiness and Strategy ediscovery best practices and workflows Office 365 ediscovery Outsourcing DTI operates ediscovery features and functions Office 365 Management and OneDrive for Business Planning Legal Hold Process and Planning Training Half or full Day workshops and training for law firms and corporations Consulting Records and Information Management (RIM) Assessments Policies and schedules Program implementation ediscovery and Litigation Readiness Assessments ediscovery response planning and implementation Process design and implementation ESI Data Mapping Proactive process to map-out an organization s IT systems and ESI sources Proprietary systems and risk based approach Technology Services Defensible disposition and deletion Categorization Repository/application retirement Content audit File share and SharePoint cleanup and archive migration Archive retirement Migrate to cloud PST consolidation Legal hold repository Sensitive Data Retrieval/Remediation Targeted identification of PHI, HIPAA, PCI, IP, and other sensitive and critical data types Delete Copy/Move Audit 29