Add content to a case and place sources on hold in the eDiscovery Center

Content that is part of an eDiscovery case – such as potential evidence for litigation, audits and investigations –can be managed in an eDiscovery Set. Each case can have multiple eDiscovery Sets. You can also filter the source content you include, such as by author or sender, by a date range, or by search keywords.

When a content source is part of a case, you can place it on hold so that a copy is preserved. This includes SharePoint sites, documents, or pages, and Exchange mailboxes. In SharePoint Server, you can also hold content on searchable file shares. When items are placed on hold, people can continue to work on them without disruption. Content that is being managed by policies will not expire when it is placed on hold.

After you have defined content sources, you can run queries and export the content to provide to authorities. The exported content includes a load file based on the Electronic Discovery Reference Model standard.

Note: Once you add content sources or queries to an eDiscovery case, changing the regional settings for the site is not supported.

Create an eDiscovery Set to manage content sources

This procedure creates an eDiscovery Set and adds content sources to it. To also place content on hold, follow the next procedure, Place content sources on hold.

Add and Manage eDiscovery Sources

Note: To include sources in a case, they must first be indexed by the SharePoint search service. For more information, see the person that manages the sites and mailboxes you want to include.

If your case is not already open, in an eDiscovery Center, click Cases, and then click the case that you want to add content sources to.
Under eDiscovery Sets, click New Item.
Type a name for the eDiscovery Set, such as Executive Correspondence.
Next to Sources, click Add & Manage Sources.
In the dialog box that appears, under Mailboxes, type the account names or e-mail addresses for the Exchange mailboxes you want to include in the case.
Under Locations, type the URL for the content you want to use as the source. In SharePoint Server, you can also type a file share address. Any content you include must be indexed by search.
Click Save.
In the box under Filter, type any keywords you want to use to narrow down the source.
To narrow down content by a date range, enter the Start Date and End Date.
To limit results to the author of a document or list item, or to a specific sender of e-mail messages, type the names or e-mail addresses in the Author/Sender box.
To limit results to a specific Exchange domain, type its name in the Domain box.
Click the Apply Filter button.
To verify that you've selected the right content, click Preview Results.
Click Save.

Note: You can add and remove content sources after you create an eDiscovery Set. To see a list of content sources in an eDiscovery Set, click Sources.

Top of Page

Place content sources on hold

Note: To include sources in a case, they must first be indexed by the SharePoint search service. For more information, see the person that manages the sites and mailboxes you want to include.

If your case is not already open, in an eDiscovery Center, click Cases, and then click the case in which you want to place on hold.
Under eDiscovery Sets, click New Item.
Type a name for the eDiscovery Set, such as Executive Correspondence.
Next to Sources, click Add & Manage Sources.
In the dialog box that appears, under Mailboxes, type the account names or e-mail addresses for the Exchange mailboxes you want to include in the case.
Under Locations, type the URL for the content you want to use as the source. In SharePoint Server, you can also type a file share address. Any content you include must be indexed by search.
Click Save.
In the box under Filter, type any keywords you want to use to narrow down the source.
To narrow down content by a date range, enter the Start Date and End Date.
To limit results to the author of a document or list item, or to a specific sender of e-mail messages, types the names or e-mail addresses in the Author/Sender box.
To limit results to a specific Exchange domain, type its name in the Domain box.
Click the Apply Filter button.
Click Enable In-Place hold.
To verify that you've selected the right content, click Preview Results.
Click Save.

Note: After you've placed content on hold, if you want to see a list of content sources for a case, click Sources.

Remove a hold from content sources

If your case is not already open, in an eDiscovery Center, click Cases, and then click the case in which you want to remove a hold.
Click eDiscovery Sets.
Under Sources, click the name of the source whose hold you want to remove. The address of the location of the name or names of the Exchange mailboxes will be listed.
Click Disable In-Place Hold.

Top of Page

Remove an eDiscovery Set from a case

If your case is not already open, in an eDiscovery Center, click Cases, and then click the case in which you want to remove an eDiscovery Set.
Click to the left of the eDiscovery Set to select it, so that a check mark appears besides its name.
Click the three dots … to display the Open Menu.
Click Delete Item.
When prompted whether to send the item to the Recycle Bin, click OK.

Top of Page

Learn more about holds

These types of content can be placed on hold as part of a case:
- Documents
- Lists (including blogs and wiki content)
- Pages (including pages that host blogs and wikis)
- Exchange objects, such as tasks, calendar entries, contacts, email messages and attachments. If Microsoft Lync conversations are archived in Microsoft Exchange, they will be included.
- In SharePoint Server, content on file shares that have been crawled by search. eDiscovery in SharePoint Online doesn't support file shares.
When you place a hold on the content sources in an eDiscovery set, the hold status for each source is displayed in the In-Place Hold Status column in the list of content sources. The following list describes each hold status value.
- On hold Indicates that the entire content source is on hold. This value is displayed when the box under Filter is left blank, and In-Place Hold is enabled for the sources in the eDiscovery set. The result is that all content in the specified source is placed on hold.
- On hold with filter Indicates that items that meet the search criteria that's specified in the box under Filter in the content source is on hold, and In-Place Hold is enabled for the sources in the eDiscovery set. The result is that content that meets the search criteria in the specified source is placed on hold.
- Not on hold Indicates that the content source is not on hold.
- Cannot hold Indicates that the content source can't be put on hold.
- Failed Indicates that the request to place the content source on hold failed.
- Processing Indicates that the hold request is in progress. This status is displayed after you click Enable In-Place Hold and then click Save in an eDiscovery set. After a few moments, refresh the eDiscovery set page and this value is replaced with one of the previous values.
When a hold is placed on a SharePoint site, you can't remove an app from the site.
When a hold is placed on a SharePoint site, a preservation hold library is created, if one doesn't already exist. Users can still work with the content, but a copy of the content as it was at the time that you initiated the hold is preserved as users change the content. Regular users with typical permissions can't see the preservation hold library. Only users with Web application- level permissions, or users who have been granted specific permissions, can view the preservation hold library.
If a user attempts to change or delete content in a site that is on hold, SharePoint first checks whether the content was changed since the hold was applied. If this is the first modification since the hold was applied, SharePoint copies the content to the preservation hold library, and then allows the user to change or delete the original content.
A user will receive an error if they try to delete a library, list, or site collection that's on hold. Users will also receive an error if they try to delete a folder that contains a file that's on hold. If users want to delete a folder that contains one or more files that are on hold, they have to delete those files before they can delete the folder.
To store all versions of content in a site, you have to enable document versioning for the document libraries in the site. If a document is deleted from a site that's on hold and document versioning is enabled, all versions of the deleted document will be preserved. If document versioning isn't enabled, the version of content that is current at the time that the hold was applied is the only version that is preserved. If the content is changed multiple times after the hold is applied, intermediate versions of the content are not preserved, so that storage space is used more efficiently. Most content in a site typically does not change, and content that is not changed is not copied to the preservation hold library.
If you remove a hold from a site, all files in the preservation hold library will be deleted (moved to the first-stage Recycle Bin) within 7 seven days of removing the hold. That's because a timer job for the preservation hold library runs once every 7 days and identifies items to delete. Files will be deleted the next time the timer job runs after the hold is removed from the site.