Microsoft Office 365 has a powerful tool to help search emails to meet eDiscovery requests, or to search emails for traces of illicit activity by employees. The basic tool looks at the contents of select mail boxes using search criteria that you input. The criteria can be simply email addresses from/to, or move to more complex searches including multiple search terms.
The results of the search can be displayed and/or exported to a PST file.
In order to maintain records after an employee leaves, email boxes need to be saved so that in the event an issue comes up, the contents of the email box may be searched. We setup clients with an archive mail box where mail boxes of former employees are moved when they leave. This gives the company the ability to search the mail boxes in the future if they need to. Without the archive mail box, user mail boxes are deleted in three weeks of the user’s account being deactivated. Once Microsoft deletes the mail box, it's gone for good.
Microsoft also offers an email archiving feature that copies all the email that goes through Exchange Online. Unless a business has an Office 365 E3 account or greater and the archive facility is not available in Office 365. Without the archiving feature enabled, if a user deletes an email, the deleted emails will be lost to the eDiscovery process. Technically an eDiscovery without archiving provides results of requested emails that are currently housed in the Microsoft Exchange Server online at that point in time.
Government agencies, regulated entities and commercial firms (like healthcare practices) that may be the defendant in a lawsuit need to have a good eDiscovery system in place to meet documentation requests. For clients that want email archiving for all emails we normally use the archive feature in ProofPoint. With the archive feature in ProofPoint, every email that goes into and out of a person’s email box gets copied to an archive email server in the cloud. The emails are retained for 10 years in the ProofPoint system, and cannot be changed or deleted. Administrators in ProofPoint can quickly search millions of emails by email address, date range and content to generate a list of emails to investigate.
Click HERE for more details.