Email archive export expectations
Overview
PST exports are clumsy; journal or compliance export tooling is better for litigation scale. Define format, chain of custody, integrity hashing.
Scope
Date range, mailboxes, shared mailboxes, Teams chats if required—modern eDiscovery spans more than Exchange.
Performance
Throttle EWS/Graph to avoid throttling errors; run off-hours; use Microsoft Purview where licensed.
Integrity
SHA-256 manifest; write-once storage WORM if counsel demands; read-only permissions to export share.
Pitfalls
Short-staffed IT refusing searchable format—push mbox/EML or vendor neutral per counsel template.
Costs
TB egress and vendor professional services often exceed client expectation—SOW line item.
MSP role
Facilitate access and document admin actions; preserve logs of who searched what for ethics.
Retention
Align to document destruction policy after case closed—do not hoard forever casually.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...