Email eDiscovery: finding mail for disputes, audits and requests

What eDiscovery means for email

Microsoft describes eDiscovery as "the process of identifying and delivering electronic information that can be used as evidence in legal cases". In a UK business the same process turns up in more places than court:

• Disputes and litigation: finding what was said to a customer, supplier or former employee, and preserving it once a claim is in prospect
• HR investigations: grievances, disciplinary matters and whistleblowing reports, where the evidence is often in email
• Regulatory and audit requests: an FCA-regulated firm producing records of communications, or an auditor checking a decision trail
• Subject access requests: searching mail for an individual's personal data under UK GDPR
• Internal questions: proving whether an instruction, contract change or complaint was ever received

Email is usually the largest and most important source in each of these. It is also the hardest to search well if the mail is spread across live mailboxes, PST files on laptops and the accounts of people who have left. An archive brings it into one searchable place, which is why eDiscovery is one of the main reasons organisations buy one. For the basics, see what email archiving is.

The eDiscovery workflow in five stages

Whatever tool you use, the work follows the same shape.

1. Identify the people, mailboxes, dates and topics that matter, and agree who is running the search
2. Preserve the relevant mail so nothing is deleted while the matter is live; this is a legal hold
3. Search and collect using criteria you can explain later: accounts, date ranges, senders, recipients and keywords
4. Review the results, tag what is relevant, flag what needs a second opinion and set aside what is out of scope
5. Produce the agreed mail in a usable format, and record what was searched, by whom and when

In the civil courts of England and Wales, Practice Direction 31B on electronic documents says the extent of a reasonable search depends on the circumstances, and that it may be reasonable to limit a search by date, place or category. Being able to show that your search was sensible and proportionate is as important as the results. An archive's search criteria, saved searches and audit log are what let you show that.

eDiscovery in Microsoft 365 and Google Workspace

Both platforms include eDiscovery tools for their own data, and they are capable. Describing them fairly:

Microsoft Purview eDiscovery searches Exchange Online mailboxes, Teams, OneDrive, SharePoint, Microsoft 365 Groups and Viva Engage. Cases hold the searches, holds and exports for a matter, and premium features add review sets, tagging, analytics and conversation threading. Microsoft retired all classic eDiscovery experiences, including classic Content Search, eDiscovery (Standard) and eDiscovery (Premium), on 31 August 2025; everything now runs in the Microsoft Purview portal. Microsoft says both admins and users working with eDiscovery cases need a Microsoft 365 Enterprise E3 or E5 licence, and that licensing requirements can vary by feature. More detail is on our Office 365 email archiving page.

Google Vault lets licensed admins search, hold and export Gmail and other Workspace data. Google is clear that "Vault isn't a data archive": it works on live data, and if you delete a user or a required licence, their data "might be irreversibly purged and no longer available to Vault". See Google Vault vs a separate email archive.

The common limit is that native tools search the platform's own live data. Mail that a leaver took with them in a PST, mail in an old on-premises archive and mail from an account that was deleted without a hold are outside their reach.

How eDiscovery works in NinjaOne Archiver

NinjaOne Archiver searches a separate archive. When a mailbox is added, Archiver backs up the mail already in it; from then on, email journaling sends a copy of incoming and outgoing messages to a journal mailbox that NinjaOne hosts, and any legacy archives you import sit alongside. Searches run in the End-User Portal under Compliance > eDiscovery.

• Five main criteria: email account, date range, from, to/cc/bcc and keywords, combined with AND and OR logic, with more criteria added as needed
• Saved searches: save the criteria, preview the results and adjust them, so the same search can be rerun and explained later
• Tags and alerts: tag results, and switch on an alert for a saved search so the person who saved it gets a daily email when newly archived mail matches
• Review flags: flag results for review, so a Data Protection Officer or Reviewer can mark them as reviewed
• Attachments: an Email Attachments view lists attachments in one place, searchable by keyword and filterable by file type
• Advanced search: a separate search for when you only need to download, restore or migrate results

One caution from NinjaOne itself: journaling can fail, and a journal setup error, such as expired or invalid credentials, can leave gaps in coverage until it is fixed. Checking that journaling is working is part of how we can help set Archiver up.

The archive keeps mail of people who have left, as long as it was captured before their account went, so a search for a dispute or a request can include former employees without reopening their accounts. That ties directly into what to do with a former employee's mailbox.

Native tools and NinjaOne Archiver side by side

A fair comparison of where each fits. Many organisations use both: native tools for day-to-day data in the tenant, and a separate archive for the long-term, independent record.

None of these makes a search defensible on its own. The people running it still decide the scope, the keywords and what is relevant.

Roles and access: keeping searches in the right hands

eDiscovery can expose anyone's mail, so who can search matters as much as what they can find. NinjaOne Archiver separates the jobs:

• IT Admins manage accounts and users but cannot access the compliance features, view file contents or download mail
• Compliance and Review Officers use all the compliance features and can download mail, but cannot restore, migrate or delete accounts
• Data Protection Officers use all the compliance features and are the only role that can delete an eDiscovery search or delete items through a review process; they cannot download, restore or migrate
• Reviewers and Limited Reviewers only review the items assigned to them in a review process

The compliance roles exist only on the Archiver plans. One point to plan for: the Full Admin role can reach everything, compliance features included, so give day-to-day IT staff the IT Admin role if HR or legal searches should stay out of their sight. NinjaOne says its audit log captures all activity in the portal. When you plan a rollout, it is worth agreeing who holds each role before the first request arrives.

How Forever Systems helps

We can supply NinjaOne Archiver and set it up so that eDiscovery is ready before you need it: journaling switched on and checked, retention policies matched to your record categories, legacy mail imported where you have it, and the compliance roles given to the right people. We can walk your HR, legal or compliance lead through running, saving and tagging a search, and explain what the archive can and cannot show.

We do not give legal advice or run disclosure exercises for you, and we do not promise any outcome in a dispute. What we can do is make sure the mail is there and searchable when your advisers ask for it. Contact us to talk about eDiscovery for your Microsoft 365 or Google Workspace mail. Pricing depends on users and bundle: ask us for a quote.