Export content from an eDiscovery (Standard) case
Tip
eDiscovery (preview) is now available in the new Microsoft Purview portal. To learn more about using the new eDiscovery experience, see Learn about eDiscovery (preview).
After a search associated with a Microsoft Purview eDiscovery (Standard) case is successfully run, you can export the search results. When you export search results, mailbox items are downloaded in PST files or as individual messages. When you export content from SharePoint and OneDrive sites, copies of native Office documents and other documents are exported. A Results.csv file that contains information about every item that's exported and a manifest file (in XML format) that contains information about every search result is also exported.
Tip
If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview trials hub. Learn details about signing up and trial terms.
Export search results
Note
For a limited time, this classic eDiscovery experience is also available in the new Microsoft Purview portal. Enable Compliance portal classic eDiscovery experience in eDiscovery (preview) experience settings to display the classic experience in the new Microsoft Purview portal.
Go to the Microsoft Purview compliance portal and sign in using the credentials for user account that has been assigned the appropriate eDiscovery permissions.
In the left navigation pane of the compliance portal, select Show all, and then select eDiscovery > eDiscovery (Standard).
On the eDiscovery (Standard) page, select the name of the case that you want to create the hold in.
On the Home page for the case, select the Searches tab.
On the Actions menu at the bottom of the flyout page, select Export results.
The workflow to export the results of a search associated with an eDiscovery (Standard) case is that same as exporting the search results for a search on the Content search page. For step-by-step instructions, see Export content search results.
Note
When you export search results, you have the option to enable deduplication so that only one copy of an email message is exported even though multiple instances of the same message might have been found in the mailboxes that were searched. For more information about deduplication and how duplicate items are identified, see Deduplication in eDiscovery search results.
After you start the export, the search results are prepared for downloading, which means they're transferred to a Microsoft-provided Azure Storage location in the Microsoft cloud.
Select the Exports tab in the case to display the list of export jobs.
You may have to select Refresh to update the list of export jobs so that it shows the export job you created. Export jobs have the same name as the corresponding search with _Export appended to the search name.
Select the export job you created to display status information on the flyout page. This information includes the percentage of items that have been transferred to the Azure Storage location.
After all items have been transferred, select Download results to download the search results to your local computer. For more information downloading search results, see Step 2 in Export content search results
Note
The exported search results must be downloaded within 14 days after you created the export job.
More information about exporting searches from a case
- For more information about the export files that are included when you export search results, see Export a Content search report.
- If you restart the export, any changes to the queries of the searches that make up the export job won't affect the search results that are retrieved. When you restart an export, the same combined search query job that was run when the export job was created will be run again.
- Also, if you restart an export, the search results that are copied to the Azure Storage location overwrites the previous results. The previous results that were copied won't be available to be downloaded.