Discover content and act on it with eDiscovery

In today's world, information is fairly scattered within an organization, mostly in form of emails, documents, file share, third-party repositories and it could be a challenge for an organization and its legal teams to find relevant content in an event of legal action, litigation or simply for compliance to standards and policies. eDiscovery in SharePoint 2013 enables organizations to retrieve content from various data sources and respond to events by taking an immediate action such as placing a temporary hold on specific SharePoint site.

Logical Components - eDiscovery

eDiscovery Architecture: eDiscovery functionality can be added to any web application by creating a site out of eDiscovery Center site template. Discovery Center allows you to manage sources, create cases(using eDiscovery Case site template) and export content. eDiscovery feature works upon the foundation laid by SharePoint search infrastructure. In fact, it relies on search service application(SSA) associated with the web application and the content that it can discover is crawled and indexed by the SSA. If there are more than one SSA in a farm or an organization, corresponding Discovery Centers need to be provisioned.    
Discovery Center allows you to gather content from:

• SharePoint sites
• File Shares
• Exchange mailboxes
• Archived Lync content

Typical Life Cycle - eDiscovery

Once sources are identified, you must create a eDiscovery Set where you specify sources, queries and whether the content is preserved. Queries allow you filter content based on various search criteria.     Holds: You can put a hold on entire SharePoint site and preserve the state of site content at that time. If you wish to place a hold only on a portion of your site, you can create a query that limits the content. In an event of hold, users see the captured state of the content even when the content is changed, moved or deleted. Only the authorized users with permissions to perform eDiscovery can view both preserved and original content.  

How does hold work? SharePoint marks the content as 'preserved' at the time discovery performed. When the content changes, it is moved to a Preservation Hold Library , a document library that requires site collection administrator permissions or web application permissions. If an item changes again, only the current version and the original version when the hold was applied are saved. This not only saves storage but also improves efficiency.  

Removing a hold: Closing a case automatically removes a hold from the content.  

Export: Results of eDiscovery can be exported and reviewed in a review tool. Content will be exported in following formats. Later all can be printed or exported to PDF.