It is not uncommon for an eDiscovery search to show several unindexed items. They might be confusing and make the search process harder. But what are unindexed items in eDiscovery exactly?
Knowing why files are not indexed can help legal teams lower the chances of missing important electronic evidence. By overcoming this challenge in eDiscovery, legal professionals can unlock crucial information about their cases.
Image by Thomas Lefebvre from Unsplash.com
What Are Unindexed Items in eDiscovery?
Unindexed items are mailbox items and documents that can’t be indexed for search. The eDiscovery unindexed items are also known as partially indexed items.
But how are unindexed items different from indexed items in eDiscovery?
The main difference between unindexed and indexed items lies in the possibility of processing. Unindexed items in eDiscovery are files and data that cannot be processed with the search inquiry.
Get exclusive access to all things tech-savvy, and be the first to receive
the latest updates directly in your inbox.
On the other hand, indexed items are fully processed and searchable. They are included in the search results and are ready to use for digital forensics. Indexed items allow quicker retrieval and analysis.
According to Microsoft, unindexed items are rare for most organizations and count up to 1% of the content by volume. However, as larger files have higher chances of being partially indexed, legal professionals might get less than 12% by the size of the unindexed items.
Reasons for Appearance of Unindexed Items in Content Search
Understanding the reasons behind unindexed items in eDiscovery is essential. Different eDiscovery tools may have varying factors that prevent certain files from being indexed. For this reason, implementing the best eDiscovery tools is highly recommended.
When running an eDiscovery with Microsoft Purview, for example, the causes for the appearance of unindexed items in content search may include:
- Unrecognized or unsupported file types for indexing
- The attached file in the message can’t be opened
- An indexing error occurred for a supported file type
- The email message has too many attached files
- The email message contains a large file attachment
- The file in the email message is password-protected
- The email message has a file encrypted with technologies other than Microsoft
It is good to know what types of unindexed items can be found in eDiscovery, taking into account their origins. The most common unsupported and unrecognized files for indexing in Microsoft Purview are bitmap (.bmp) and MP3 (.mp3).
Investigating Partially Indexed Items in eDiscovery
Understanding what are unindexed items in eDiscovery and their roots can help legal teams build effective strategies for minimizing the occurrence of partial indexing.
Partially indexed items can only be viewed by exporting the search results. So, legal teams need to export a content search report for effective data management.
Knowing how to navigate the output options when exporting eDiscovery search results is important. By selecting the proper output option and searching all content locations, there is an option to export only partially indexed items from the eDiscovery search.
In Microsoft Purview eDiscovery, the unindexed items are typically exported in a report with the same name. In addition to the unindexed items, the folder will include two types of legacy fields – Error Tags and Error Properties.
These are crucial for discovering why an indexing error has occurred. Furthermore, they make it easier to discover whether the file contains data vital for the investigation.
The Unindexed Item’s Effect on eDiscovery Search Accuracy
So why are unindexed items important in eDiscovery? Unindexed items may significantly slow down the digital data collection in legal investigations. They may create blind spots in the dataset and potentially hide critical evidence.
A large amount of unindexed data limits visibility and accessibility to the needed files. Legal teams might have to deal with an inaccurate search process and increase their retrieval efforts without access to the unindexed items.
Image by Scott Graham from Unsplash.com
Considerations About Unindexed Items in Content Search
During litigation, it is important to have several considerations in mind about unindexed items.
First, an eDiscovery search displays only the amount and size of unindexed Exchange items. The statistics part on the flyout page doesn’t include unindexed items in OneDrive accounts or SharePoint sites.
Secondly, the eDiscovery results include only the partially indexed items matching the search criteria. The same goes for exporting the results.
Many also worry about using certain eDiscovery options and discussing whether to purge unindexed items. It is paramount to note that the purge option doesn’t delete unindexed items.
The last few changes from Microsoft also made it impossible to do a search and exclude the unindexed items. The motive behind this decision is for legal purposes. However, organizations and professionals can still exclude the unindexed items from the export report.
Sometimes, the count of partially indexed items can change. A partially indexed item is counted twice – once in the total number of search results and once in the category of unindexed items. But, when the search results are exported, the unindexed items will be counted together with the other results.
Conclusion
Understanding what are unindexed items in eDiscovery is significantly important. Legal teams unfortunately overlook them, increasing the risk of missing out on valuable leads for their proceedings.
By acknowledging unindexed items in eDiscovery searches, lawyers can enhance the comprehensiveness of their investigations. Consequently, thorough research might contribute to more detailed and informed decision-making about legal cases.
