eDiscovery and Database Content Indexing

In my spare time I answer questions in the Exchange Server TechNet forums. In these forums people tend to ask questions that seem benign and end up being a wild goose chase. An example of this would be eDiscovery issues that people experience in Exchange Server 2013. Having performed a few of these over the years I figured I had enough of a clue to help someone out with their issue. Turns out that I needed to think a little outside the box on this persons issue.

Consider this. You need to run an eDiscovery query for a legal discovery and the data returned does not match what was expected. For example, the results do not include any data from the past month or so. Here is what we used to troubleshoot why data was missing:

1) Run the query from the EAC in Exchange 2013 – change the date range, change mailboxes… basically change the criteria for the search to verify the results are consistent.

In our case the results were consistently missing the past one month of results.

2) Run the query with PowerShell like the following:

New-MailboxSearch -Name “Legal-Discovery” -SourceMailboxes Sales,Executives -TargetMailbox LegalDiscovery@domain.com -StartDate “01/1/2013” -EndDate “1/1/2014” -Recipients “*@domain.com” -SearchQuery “Sell high” -StatusMailRecipients “DiscoveryTeam”

Again, the results were consistently missing the past one month of results.

3) Then it occurred to me that Exchange Search is directly tied to the Content IContentIndex2ndex on a database. If you reference this document by Microsoft you can see that:

“In-Place eDiscovery uses the content indexes created by Exchange Search”

As such, we should check the state of the Content Index on the databases we want to search. Here’s how:

ContentIndexing

Now that we know the Content Index is failed we simply need to reseed the database. Here’s how:

Get-MailboxDatabaseCopyStatus * | where {$_.ContentIndexState -eq “Failed”} | Update-MailboxDatabaseCopy -CatalogOnly

Once the content indexes are recreated, then your eDiscovery search should work flawlessly.

Related Information
New-MailboxSearch
Update-MailboxDatabaseCopy

Advertisements

One thought on “eDiscovery and Database Content Indexing

  1. Pingback: Interesting things that I see on the internet 31/03/2013 | 503 5.0.0 polite people say HELO

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s