Exchange 2013: eDiscovery Changes


With the release of Exchange 2013, there are some changes that are relevant to eDiscovery; whether it be for In-Place Holds or Litigation Queries to export to the Discovery Mailbox. Most notably, eDiscovery/Exchange Search does not support AQS – it switched to KQL. KQL is supported in the SearchQuery parameter (Keywords box in the Exchange Admin Center). However, Outlook still uses AQS.

Using KQL, we can perform searches that are beneficial to the eDiscovery and will save time/money/resources, without the need to invoke a third-party to process the data for you.

For example, if I perform a query for any messages that only have a word document as an attachment, I get the two messages I expect to find.

If perform the same query but, this time, define a subject or keyword I'm after, the messages are excluded because the primary rule hasn't been met.

If I perform a third query with words that exist in the document (but not in the document name), these documents will return in my query, as well.

There is a limitation to the number of mailboxes that can be searched and it is 5,000*. Any number beyond this and the specified query will return the following error: An unknown error occurred on the search server. Please contact your administrator for assistance. The message from the search server is 'The search exceeded the maximum number of mailboxes that can be searched at a time. Please try searching less than 5000 mailboxes.'.

*The maximum number of mailboxes that you can search can be changed in on-premises Exchange 2013. You can use the Set-ThrottlingPolicy command with the DiscoveryMaxMailboxes parameter to do so but this may come at a negative impact to performance.

As Exchange now uses the FAST Search index, we can query for what documents haven't been processed and why. For example, if I what to query for the error where the document parser encountered a processing error, I would use the following command in Exchange Management Console:

Get-FailedContentIndexDocuments Administrator -ErrorCode 7 | FT -AutoSize

DocID Database                Mailbox       Subject           Description
—– ——–                ——-       ——-           ———–
3462  LAB-NAEX15-01 Store 002 Administrator Binaries Test     The document parser encountered a processing error.
3464  LAB-NAEX15-01 Store 002 Administrator FW: Binaries Test The document parser encountered a processing error.

Using this I can see what, precisely, caused the document to not be indexed:

$errorSevens = Get-FailedContentIndexDocuments Administrator -ErrorCode 7
$errorSevens[0].AdditionalInfo
 301002 Error parsing document 'exchange://localhost/Attachment/34eb02b4-3bc6-4163-a40d-2587faa9e0db/135d5536-d180-4198-9ba8-574b53df8206/e08d777e-e710-4407-a53d-1f57a4a58d79/a654efa1-bb87-426a-aaca-9866be73
3ccd/438086667654.0/System.Data.dll'. Document has an undetectable format and will not be parsed. 301002 Error parsing document 'exchange://localhost/Attachment/34eb02b4-3bc6-4163-a40d-2587faa9e0db/135d5536-
d180-4198-9ba8-574b53df8206/e08d777e-e710-4407-a53d-1f57a4a58d79/a654efa1-bb87-426a-aaca-9866be733ccd/438086667654.1/mscorlib.dll'. Document has an undetectable format and will not be parsed.

In this case, the documents are binaries attached to the email for testing in regards to another issue. FAST Search cannot reverse-engineer binaries, so it is safe to assume that these files aren't necessary for my eDiscovery purposes. See here for a list of formats that Exchange FAST Search can index.

Comments (6)

  1. Anonymous says:

    Hi, Solvetech! Apologies for the late reply.

    You’re probably getting an error because [0] is calling the first iteration (index) of an object. If there is not object (i.e.: if it is ‘null’), there will be nothing to index. Most commonly, this will result in an error like "Cannot index into a null array."

    The ‘.AdditionalInfo’ is calling the property, ‘AdditionalInfo’ off of the object that will return from the index of zero.

  2. Anonymous says:

    Hey, Chris! Thanks! 🙂

  3. Chris Branca says:

    Hey John, long time no see. nice article 🙂

  4. Solvetech says:

    Using Exchange PS as administrator I don’t understand the following which fails
    $errorSevens = Get-FailedContentIndexDocuments Administrator -ErrorCode 7
    $errorSevens[0].AdditionalInfo

    First line runs OK but I don’t understand second line

  5. Anonymous says:

    Here are some pointers on searches with EWS:

    Exchange 2013 has indexed fields and many fields automatically

  6. Marty V says:

    You referencce this article in another post about the max number of mailboxes that can be searched. It appears that, regardless of what you set the throttling policy to be, the max number is 5000. Period. This article gives hope that more than 5000 can
    be searched by the statement: "*The maximum number of mailboxes that you can search can be changed in on-premises Exchange 2013. You can use the Set-ThrottlingPolicy command with the DiscoveryMaxMailboxes parameter to do so but this may come at a negative
    impact to performance."" Can you confirm that no more than 5000 mbxs can be searched regardless of what the throttling policy is set at? Thanks!