We help IT Professionals succeed at work.
Troubleshooting Question

* Critical Time Search Issue * O365 EDiscover Issue

39 Views
Last Modified: 2020-09-24
I have a client working with litigation to obtain some specific emails which pertain to a current lawsuit.   I have been asked to perform an eDiscovery search on some keywords which I am able to access via protection.office.com.   The results did find a ton of information.   Something strange happened after I ran the search and it completed.   I did an exact search of item AND item AND item specifically to get emails directly related to those key words within email messages itself.   The litigators need this information by Thursday.   The process did complete after I told the results to export and I did successfully download all the data along with the SharePoint data and between 2 searches was able to obtain 6 PST file exports.    I have added all 6 of those PST files to Outlook however our client is complaining he is having trouble finding any related emails (With those keysearch names) searching.  He is using Outlook 365.   We have done this twice and get the same result.   Our client thinks we are incompetent and unable to give him what he wants.   I have spoken with Microsoft who has validated I have done the searches in eDiscovery properly and has to escalate to a higher team why:

1. Search results are pulling emails with no relevancy as to keywords in the email and spitting out data totally irrelevant to the item AND item AND item search.
2. Why Outlook (When searching for one of those keywords) comes up with no results even though the search results show in the compliance portal.   

Indexing is turned on as well as cache mode on his workstation.   Has anyone here worked with eDiscovery and can tell me why after downloading and importing those PST search files nothing works in regards to relevance of key words specific in email messages during a search?   This is pretty high priority.   The last export and download I did between 2 searches was almost 100gig of data.   Am I missing something doing these eDiscovery searches?  Any help as always is appreciated.      
Comment
Watch Question

Andrew N. KowtaloSupport Center Engineer

Author

Commented:
I have read through this article tried using different options listed here still getting the same results.  Random.

https://docs.microsoft.com/en-us/sharepoint/governance/export-content-and-create-reports-in-the-ediscovery-center#export-ediscovery-content 


CERTIFIED EXPERT
Most Valuable Expert 2015
Distinguished Expert 2019

Commented:
First of all, use the Preview functionality in the portal to validate you are getting correct results, even take a screenshot or two to present to the lawyer as needed. Next, explain to him that he actually needs to wait for Outlook to index the full content of the PST file(s), which can take a while if they're 100GB+. Only then he will be able to use the search functionality.

You can also use the Report from the export to find where a given item is located, than browse to the corresponding (sub)folder and locate it manually. Or export individual items instead of PSTs for that matter.
Andrew N. KowtaloSupport Center Engineer

Author

Commented:
@Vasil this was already done and something very strange happened.   Preview Functionality at first when clicking on any email search result showed HTTP 400 errors for every message.   After about 20-30 minutes the preview then decided to actually show the emails with those keywords.    Why is that?

Also in regards to his PST imports its been days already and caching has been on the entire time.   There is no notification within outlook that shows any folders being updated.    I have tried using various methods to search and Outlook returns no result.   
Andrew N. KowtaloSupport Center Engineer

Author

Commented:
My understanding is crawling using keyword AND keyword AND keyword will only show me emails with all of those results.  It seems the search is returning keyword OR keyword OR keyword.   
Andrew N. KowtaloSupport Center Engineer

Author

Commented:


Andrew N. KowtaloSupport Center Engineer

Author

Commented:
The above screen shot is happening with alot of the email the search result is showing.  ^^ in the portal.
Andrew N. KowtaloSupport Center Engineer

Author

Commented:
Some of those messages from the crawl eventually display the emails even after it says web page cannot be displayed.  So I am wondering if I need to give it time?  There was one search I did 5 days ago that is still showing error 400 with some of the searches but then somehow popup randomly then disappear again in the search results.   I think Microsoft has some back end issues going on.   
Andrew N. KowtaloSupport Center Engineer

Author

Commented:
Microsoft has just informed me they have had to run diagnostics on their back end to fix known issues.  Now search results are showing blank and a mix of emails.   There is something wrong with the crawling feature.   Running exports should not generate 20 gigs of PST for 158 search results for 1 and 49 search results for another.   
Support Center Engineer
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Commented:
Hi Andrew,
I am facing same issue. When I am clicking on mail (result after query completion), it showing HTTP 400 error in window. Please help.
Andrew N. KowtaloSupport Center Engineer

Author

Commented:
@Dopt you have to ensure the searches you are creating are given time to propagate.   I had to wait 20-30 minutes for messages to show up.   I got in contact with Microsofts support and they actually had to run some diagnostics on the back end to fix my issue.   You should probably contact them through your O365 portal to get a hold of a level 2 (Make sure not level 1) to address the situation.  
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.