#Backup Data eDiscovery

In the Backup data e-discovery page, you can perform metadata-based searches for Exchange Online and both metadata-based and content-based searches for OneDrive. After you have found the backup data you want, you can perform a data recovery, exportation, or deletion job directly from the search result page. To enable this feature, contact AvePoint Support. Note that an additional cost is required.

If you previously enabled metadata-based search and now want to upgrade your e-discovery capabilities to include content-based search, contact AvePoint Support to upgrade your subscription and an additional cost is required.

*Note: It may take extra time to update the index for the newly backed up data or for the deleted content. Therefore, the search that was performed right after the backup/deletion job may not be accurate. In addition, if you have ever changed the storage, the eDiscovery can only search from your backups in the current storage.

Follow the steps below to search for the emails and perform the operation you need:

1. To enable this feature for the first time, click the Activate services button.

2. Select either Exchange Online or OneDrive service to search for your backup data.

3. Configure search conditions based on your selected service:

   • For Exchange Online, configure the search conditions for Subject, Sent from, Sent to, and Date sent.

     • You can enter multiple keywords in the Subject box and separate them with a semicolon (;).

     • The Sent from box and the Sent to box also support entering multiple users. Ensure you use a semicolon (;) to separate them.

     • The time range you configured for Date sent cannot exceed one year. The search will find the emails that were sent or received within that time range.

   • You can also use the Advanced search to narrow down results by filtering the container, mailbox address, folder name, or whether the email has attachments.

   • For OneDrive, configure the search conditions for Document name, Content, Created by, and Modified date range.

     • Support document types include .txt, .pdf, .docx, .doc, .xlsx, .xls, .pptx, .ppt, with a file size limit of less than 50 MB.

     • The following characters are not supported for search: +, -, &, ||, !, ( ), { }, [ ], ^, ", :, , /.

     • The search primarily supports English queries and has limitations for other languages.

     • Documents that have sensitive labels with encrypted data are not supported and cannot be found by Content search.

   • You can also use the Advanced search to narrow down results by filtering container, user, folder name, data size or document modifier.

4. Click Search.

5. On the search result page, the search results in the latest backup cycle are displayed. The search results can display a maximum of 2000 items. You can click the link above the table to check the search result in another backup cycle. In addition, you can update the search conditions to adjust your search results.

6. You can perform the following operations on the emails in the search result:

   • Download file list – Download the search results to an XLSX file on your local computer. Extract the ZIP file and open the XLSX file in Excel to view all the records in the search results, including the email subject, recovery point, sent from, and sent to.

   • Restore – Restore the email to its original location. For details, refer to Restore Exchange Online Data.

   • Export – Export the selected backup data. An export job will start. You can navigate to Job Monitor to check for the job progress and download the exported content. For details, refer to Download the Exported Data.

   • Delete – Delete the selected backup data. In the confirmation window, you need to select the I understand that the selected backup data will be permanently deleted option and click Yes to confirm your deletion.