eDiscovery for Teams Chat

[TriggerHappyUK]

Hi all,

 

Does anyone have a simple to follow guide on how to do an eDiscovery for Teams Chat history of a student?

 

I've been asked by the Head of Year of a student to get their Teams Chat history. I remember being able to do it before, but the steps I wrote down last time don't correspond to what I'm seeing in the Compliance console.

 

I can get the emails, but it doesn't include Teams chats.

 

Cheers,

 

C

[psydii]

Are you using Premium (formerly 'Advanced')?

 

Steps if you are:

 

Create a Case. (We name them against a helpdesk ticket number - and if particularly sensitive the helpdesk ticket only references a date code with the corrosponding DSL / HR's name)

Case Format: NEW (this bit is important, almost everything that should have worked two years ago now works they way the documentation suggested they always should have.)

Add the custodians (the student under investigation)

I tend to keep both their their mailbox and OneDrive selected.

Let the Hold and Index process complete, you can monitor this int the Jobs tab.

 

Once the re-index has completed, create a "Collection", using date range as the search condition. I tend not to filter by message kind or any other aspects just yet. Add the collection to a new review set, give the review set a sensible name. TBH I tend to start with "Review Set 1" just for consistency.

Let the collection process complete (monitor progress in Jobs tab)

Now go into the Review set and with the analytics button/icon run "Document and E-Mail analytics"

Let the Document and Email analytics process complete.

Back in the review set add a filter -> Item Properties -> Message Kind.

In the new message kind filter box, select you can now filter by "message kind" select "MicrosoftTeams, IM" (I feel like this option has changed in the last week?)

 

You should now have a Results Set view of just team messages, threaded as best they can be. (threaded chat is a pain as it can branch and converge as people join and leave the chats.

[TriggerHappyUK]

Are you using Premium (formerly 'Advanced')?

 

 

No, we are Standard