{"id":838,"date":"2025-10-26T18:19:09","date_gmt":"2025-10-26T12:49:09","guid":{"rendered":"https:\/\/www.mailxaminer.com\/blog\/?p=838"},"modified":"2025-11-20T18:07:44","modified_gmt":"2025-11-20T12:37:44","slug":"ediscovery-search-office-365","status":"publish","type":"post","link":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/","title":{"rendered":"How to Perform eDiscovery Search in Office 365 to Carve Evidence?"},"content":{"rendered":"<blockquote class=\"wp-block-quote\"><p>Carrying out eDiscovery search in Office 365 is not an easy task because it demands a complete integrated strategy that starts from a definite and robust excavatory content search and export content in court-admissible format.<\/p><\/blockquote>\n<p>When discussing <strong><a href=\"https:\/\/www.mailxaminer.com\/blog\/ediscovery-vs-digital-forensics\/\" target=\"_blank\" rel=\"noopener\">eDiscovery vs Digital Forensics<\/a><\/strong>, it\u2019s important to know both of them. Digital forensics focuses on deep technical investigation and recovery of digital evidence. Whereas eDiscovery in Office 365 is more about identifying, collecting, and producing electronically stored information (ESI) for legal and compliance purposes.<\/p>\n<p>Microsoft Purview provides a basic tool, i.e., eDiscovery (standard,). Organizations use this feature to search and export content in the form of evidence in Microsoft 365 and Office 365. For the deployment of eDiscovery, nothing is needed, however, IT admins and eDiscovery managers need to complete some prerequisite tasks to search, export, and preserve content.<\/p>\n<p><em><strong>Quick Note: Necessary Prerequisites to Use the eDiscovery Platform Effectively:<\/strong><\/em><\/p>\n<ul>\n<li>Assign proper licenses for using the eDiscovery tool<\/li>\n<li>Enable required eDiscovery apps<\/li>\n<li>Allocate eDiscovery permissions<\/li>\n<\/ul>\n<div class=\"alert alert-warning\">\n<p><span style=\"color: #0000ff;\"><strong>Table of Contents:<\/strong><\/span><\/p>\n<p><strong><a href=\"#a\">eDiscovery Work Flow for Content Search in Microsoft Office 365<\/a><\/strong><\/p>\n<ul>\n<li><a href=\"#b\">Step 1. Provide appropriate permission<\/a><\/li>\n<li><a href=\"#c\">Step 2. Create a new case<\/a><\/li>\n<li><a href=\"#d\">Step 3. Add members to the case<\/a><\/li>\n<li><a href=\"#e\">Step 4. Perform a content search on the case<\/a><\/li>\n<li><a href=\"#f\">Step 5. Export content search result into PST file<\/a><\/li>\n<\/ul>\n<p><strong><a href=\"#g\">Reliable Solution Designed Especially for eDiscovery &amp; Forensics Experts<\/a><\/strong><\/p>\n<ul>\n<li><a href=\"#h\">Type 1 General Search<\/a><\/li>\n<li><a href=\"#i\">Type 2 Proximity Search<\/a><\/li>\n<li><a href=\"#j\"> Type 3 Keyword search<\/a><\/li>\n<\/ul>\n<\/div>\n<p>Before moving ahead further, let&#8217;s first under the basic concept of the standard eDiscovery tool.<\/p>\n<h2><strong>What is eDiscovery (Standard)?<\/strong><\/h2>\n<p>If you go by definition, eDiscovery is a tool that is used to perform searches on mailboxes, SharePoint online, <a href=\"https:\/\/www.mailxaminer.com\/blog\/microsoft-teams-forensics\/\" target=\"_blank\" rel=\"noopener\"><strong>Microsoft Teams<\/strong><\/a>, and Microsoft 365 groups. Here, you can add mailboxes under hold so that the search is preserved for future use.<\/p>\n<p>To access eDiscovery in the Microsoft 365 compliance center and to use the hold &amp; export feature, your organization must have supported licenses. Also, to run a search or to export search results in eDiscovery, you must be a member of the eDiscovery Manager role group.<\/p>\n<h2>Why do you need eDiscovery?<\/h2>\n<p>There are basically two reasons why an organizations need an ediscovery office 365 method:<\/p>\n<ul>\n<li><strong>Legal compliance-<\/strong> It is mandatory in the US that every organization must follow the Federal Rules of Civil Procedure (FRCP). There are guidelines for handling evidence, including digital data, during civil lawsuits.<\/li>\n<\/ul>\n<p>Since 2006, the FRCP has included Electronically Stored Information (ESI) as discoverable evidence. This means companies must be able to provide emails, messages, and documents when required in legal cases.<\/p>\n<ul>\n<li><strong>Managing ESI-<\/strong> Today\u2019s businesses create and store huge amounts of digital data, often exceeding 50\u2013100 TB, especially as more operations move to the cloud. Without proper systems, collecting and presenting this data for legal purposes can be difficult, slow, and error-prone. Using a strong eDiscovery solution helps organizations manage data effectively and stay compliant with legal requirements.<\/li>\n<\/ul>\n<h3 id=\"a\" class=\"h4\"><strong>eDiscovery Workflow for Content Search in Microsoft Office 365<\/strong><\/h3>\n<p>Here is the practical approach for using the eDiscovery tool. Carefully follow the below-mentioned steps, otherwise, there might be a chance of data loss.<\/p>\n<h3 class=\"text-danger\"><span id=\"b\"><strong>Step 1: Provide appropriate permission<\/strong><\/span><\/h3>\n<ul>\n<li>From the Microsoft 365 admin center, go to compliance. It will redirect you to the Microsoft 365 compliance center.<\/li>\n<li>Click on <strong>Permissions.<\/strong><\/li>\n<li>Under the compliance center, click on roles. This will list all the permissions that are required to manage certain tasks.<\/li>\n<li>Next, for eDiscovery permissions, click on eDiscovery manager and make sure all the necessary roles, such as <strong>Export<\/strong>, <strong>Hold<\/strong>, and <strong>Preview<\/strong>, are added to the roles. If not added, click on the<strong> edit role group <\/strong>to add the required roles.<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"629\" class=\"wp-image-2462\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-21.png\" alt=\"Edit role group \" \/><\/figure>\n<ul>\n<li>To add global admins, click on <strong>Choose<\/strong> <strong>eDiscovery Administrator<\/strong> &amp; select the <strong>Edit<\/strong> option.<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"629\" class=\"wp-image-2461\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-20.png\" alt=\"eDiscovery Administrator\" \/><\/figure>\n<ul>\n<li>Click the button <strong>+ Add<\/strong> to add the user as an eDiscovery Administrator<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"629\" class=\"wp-image-2463\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-22.png\" alt=\"add user\" \/><\/figure>\n<ul>\n<li>Choose the user you need to be added as a member and click on the <strong>Add<\/strong> button.<\/li>\n<\/ul>\n<blockquote><p><strong>Important Note: <\/strong>Once you make changes within a eDiscovery manager, it can take upto 24 hr to reflect the changes. So, you might have to wait for some time to access all the features of the eDiscovery.<\/p><\/blockquote>\n<p>After you see the changes are replicated, you can move to the next step.<\/p>\n<h3 class=\"text-danger\"><span id=\"c\"><strong>Step 2:<\/strong> <strong>Create a new case<\/strong><\/span><\/h3>\n<ul>\n<li>For creating a case, click on <strong>eDiscovery &gt;&gt; <\/strong><strong>Core<\/strong> &gt;&gt; <strong>Create a Case<\/strong>.<\/li>\n<\/ul>\n<ul>\n<li>Then, a dialog box will pop up. You can enter the <strong>Case name<\/strong> &amp; <strong>Case description <\/strong>and click the<strong> Save<\/strong> button.<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"629\" class=\"wp-image-2459\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-18.png\" alt=\"create a new case\" \/><\/figure>\n<h3 class=\"text-danger\"><strong><span id=\"d\">Step 3: Add members to the case<\/span><\/strong><\/h3>\n<p>To access and manage the newly created case, you need to add members to it. For that, follow the below given steps.<\/p>\n<ul>\n<li>Click the <strong>Search &amp; Security <\/strong>option from the <strong>Security &amp; Compliance Center <\/strong>and select <strong>eDiscovery<\/strong> to see the list of created cases.<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"629\" class=\"wp-image-2464\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-23.png\" alt=\"list of created cases\" \/><\/figure>\n<ul>\n<li>Select the newly created case and click on the <strong>+ Add<\/strong> button under the Manage Members section<\/li>\n<\/ul>\n<p><strong>Note: <\/strong>If you want to add a new role group to the case to do an eDiscovery search in Office 365, click on the <strong>+Add<\/strong> button under the Manage role group.<\/p>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"629\" class=\"wp-image-2466\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-25.png\" alt=\"new role group\" \/><\/figure>\n<ul>\n<li>Select the members and click the <strong>Save<\/strong> button to select the new list of members.<\/li>\n<\/ul>\n<h3 class=\"text-danger\"><span id=\"e\"><strong>Step 4: Perform a content search on the case<\/strong><\/span><\/h3>\n<p>You can perform a content search in Office 365 mailbox to extract the electronic evidence. The content search related to the case can be accessed only by the members of the case or members of the manager role group.<\/p>\n<ul>\n<li>Go to <strong>Security &amp; Compliance Center <\/strong><strong>&gt; &gt;<\/strong><strong> Search &amp; investigation <\/strong><strong>&gt; &gt;<\/strong><strong> eDiscovery<\/strong> and open the case to perform a content search.<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"732\" class=\"wp-image-2469\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-28.png\" alt=\"Search &amp; investigation\" \/><\/figure>\n<p>&nbsp;<\/p>\n<ul>\n<li>Click the <strong>+ New Search<\/strong> from the search tab<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"629\" class=\"wp-image-2467\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-26.png\" alt=\"New Search\" \/><\/figure>\n<ul>\n<li>On the new search page, you can create a <strong>search query<\/strong> by adding <strong>keywords<\/strong>.<\/li>\n<li>Under the <strong>Location<\/strong> option, select the location to perform the content search in Office 365.<\/li>\n<li>Click the Modification option to search for any users, groups, teams, or site locations.<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"629\" class=\"wp-image-2470\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-29.png\" alt=\"search query\" \/><\/figure>\n<ul>\n<li>Click on the <strong>save &amp; run<\/strong> option and provide a <strong>Name<\/strong> and <strong>Description<\/strong> to save the search settings during the eDiscovery search in Office 365.<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1373\" height=\"629\" class=\"wp-image-2468\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-27.png\" alt=\"save the search \" \/><\/figure>\n<h4 class=\"text-danger\"><span id=\"f\"><strong>Step 5: Export content search results into the PST file<\/strong><\/span><\/h4>\n<p>After completing the process of content search in Office 365, it&#8217;s now time to export the Office 365. To perform the exporting process, follow the steps below.<\/p>\n<ul>\n<li>Go to <strong>Security<\/strong> &amp; <strong>Compliance Center<\/strong> &gt;&gt; <strong>Search &amp; investigation<\/strong> &gt;&gt; <strong>eDiscovery<\/strong><\/li>\n<li>Choose the case and click on the <strong>Open<\/strong> button.<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1372\" height=\"677\" class=\"wp-image-2473\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-32.png\" alt=\"eDiscovery \" \/><\/figure>\n<ul>\n<li>Select the <strong>Search<\/strong> tab &gt;&gt; Choose the content <strong>search result<\/strong> you wanted to export &gt;&gt; <strong>View result<\/strong><\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"629\" class=\"wp-image-2472\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-31.png\" alt=\"search result\" \/><\/figure>\n<ul>\n<li>Click on <strong>More<\/strong> and select <strong>Export Results <\/strong>to export the result of the eDiscovery search in Office 365 into PST.<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"677\" class=\"wp-image-2471\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-30.png\" alt=\"Export Results\" \/><\/figure>\n<ul>\n<li>From the export result tab user can change Output, Export exchange content as, etc, and then click the <strong>Export<\/strong> button.<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"677\" class=\"wp-image-2477\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-36.png\" alt=\"export result tab\" \/><\/figure>\n<ul>\n<li>Select the <strong>Export<\/strong> tab to see the list of exported results.<\/li>\n<li>Choose the Export result that you need to download and click on the <strong>Download results<\/strong> button.<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"677\" class=\"wp-image-2474\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-33.png\" alt=\"Download results\" \/><\/figure>\n<ul>\n<li>Copy and paste the <strong>export key<\/strong> in the pop-up window and <strong>brows<\/strong>e the destination location to which you want to save the search result.<\/li>\n<li>Then click the <strong>Start <\/strong>button to start the downloading process.<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"677\" class=\"wp-image-2475\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-34.png\" alt=\"eDiscovery export test\" \/><\/figure>\n<ul>\n<li>When the process is completed, click close and finish the downloading process.<\/li>\n<\/ul>\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1370\" height=\"677\" class=\"wp-image-2476\" src=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2019\/03\/image-35.png\" alt=\"Process completed\" \/><\/figure>\n<p><strong>Quick Recap of eDiscovery Workflow:<\/strong><\/p>\n<blockquote>\n<ul>\n<li>Must have appropreate licences.<\/li>\n<li>Assign necessary permissions.<\/li>\n<li>Create a case<\/li>\n<li>Perform content search on required mailboxes<\/li>\n<li>Place search\/contents on hold<\/li>\n<li>Export search reults<\/li>\n<\/ul>\n<\/blockquote>\n<p>The above-mentioned process of content search and exporting the result via the eDiscovery tool on Office 365 is a very tiring and time-consuming method. Apart from time limitations, eDiscovery search tools have several other limitations in terms of <strong>Search limit, Export limit, Indexing limits for email messages,<\/strong> etc.<\/p>\n<p>During the Forensic Investigation, searching the content and exporting the Office 365 mailbox to PST format in a faster way could be helpful in legal proceedings. To perform eDiscovery in Office 365 without investing too much time and effort, forensic experts can take the help of the <a href=\"https:\/\/www.mailxaminer.com\/product\/\" target=\"_blank\" rel=\"noopener\"><strong>Professional Email Forensics Tool<\/strong><\/a>. It allows them to dig into the mailbox as well as preserve the carved evidence in suitable and appropriate formats.<\/p>\n<h4 class=\"h3\"><strong>Reliable Solution Designed Especially for the eDiscovery &amp; Forensic Experts<\/strong><\/h4>\n<p><a href=\"https:\/\/www.mailxaminer.com\/\" target=\"_blank\" rel=\"noopener\"><strong>MailXaminer<\/strong><\/a>, a tried and tested tool, has been specially designed for investigators to perform eDiscovery searches in Office 365 and other web-based email mailboxes. The software is an all-rounder that follows all the eDiscovery investigation guidelines and assures that investigators get a suitable result that they can present as evidence in the courtroom.<\/p>\n<p>So, first, download and launch the software on your Desktop\/Laptop. Then, follow the steps below.<\/p>\n<h4><strong>Simple Steps to Add Evidence Using the Tried and Tested Tool\u2013<\/strong><\/h4>\n<p><strong>Step 1. <\/strong>To start the investigation, create a new case. To do so, select <strong>Create Case<\/strong> from the Cases screen and enter the necessary case-related information.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/www.mailxaminer.com\/assets\/img\/guide\/investigator\/03-select-create-case.webp\" alt=\"create a case\" width=\"1366\" height=\"728\" \/><br \/>\n<strong>Step 2. <\/strong>Click the <strong>Add New Evidence<\/strong> option to add the evidence file to the software for scanning.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/www.mailxaminer.com\/assets\/img\/guide\/investigator\/07-dashboard.webp\" alt=\"Add new evidence\" width=\"1366\" height=\"728\" \/><br \/>\n<strong>Step 3. <\/strong>The window for adding evidence will then appear. Select the email client here.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/www.mailxaminer.com\/assets\/img\/guide\/investigator\/08-email-clients-list.webp\" alt=\"Select desired email client\" width=\"1366\" height=\"729\" \/><br \/>\n<strong>Step 4. <\/strong>Afterward, click <strong>Finish<\/strong> after utilizing the <strong>Add File<\/strong> option to browse the evidence file. [Bin icon has been displayed in front of the deleted files.]<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/www.mailxaminer.com\/assets\/img\/guide\/investigator\/24-calendar-preview.webp\" alt=\"click finish after adding the file\" width=\"1366\" height=\"729\" \/><br \/>\n<strong>Step 5. <\/strong>Go to the <strong>&#8220;Search&#8221;<\/strong> tab after the file has been scanned. Here, the program will preview all emails, including the deleted ones.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone\" src=\"https:\/\/www.mailxaminer.com\/assets\/img\/guide\/investigator\/37-global-date-filter.webp\" alt=\"search for tab bar\" width=\"1920\" height=\"1080\" \/><\/p>\n<p>Using this tool, you can perform different searches, such as:<\/p>\n<h4><span id=\"h\"><u><strong>1. General Search<\/strong><\/u><\/span><\/h4>\n<p>Using the general search feature, you can fetch the email data related to the keyword used to search over the entire mailbox or selected attributes.<\/p>\n<ul>\n<li>The <strong><a href=\"https:\/\/www.mailxaminer.com\/blog\/proximity-fuzzy-stem-search-method-in-digital-forensics\/\" target=\"_blank\" rel=\"noopener\">digital forensic search methods<\/a><\/strong> are acquainted with the various search algorithms, such as <strong>General<\/strong>, <strong>Wildcard, Regular Expression, Stem &amp; Fuzzy search, <\/strong>which help the investigators to search and extract the evidence from Office 365 Outlook mailboxes during the eDiscovery process.<\/li>\n<\/ul>\n<p>To perform content search, more specifically, the general search allows filtering the data with the help of <strong><a href=\"https:\/\/www.mailxaminer.com\/blog\/how-to-use-boolean-search-in-email-forensic\/\" target=\"_blank\" rel=\"noopener\">Boolean operators<\/a><\/strong> such as <strong>AND, OR &amp; NOT, <\/strong>and metadata such as <strong>Subject<\/strong>, <strong>To<\/strong>, <strong>From<\/strong>, etc.<\/p>\n<h4><span id=\"i\"><strong><u>2. Proximity Search<\/u><\/strong><\/span><\/h4>\n<p>Proximity search allows the investigator to perform an eDiscovery search in an Office 365 mailbox based on the approximate word combination. That means this search operation is useful when the user knows more than one keyword and the approximate character distance between them. This will help to filter the results more specifically.<\/p>\n<h4><span id=\"j\"><strong><u>3. Keyword search<\/u><\/strong><\/span><\/h4>\n<p>The <strong><a href=\"https:\/\/www.mailxaminer.com\/keywords.html\" target=\"_blank\" rel=\"noopener\">forensic keyword search<\/a><\/strong> helps to search the content with a list of keywords. Either the user can insert a set of keywords manually into the tool, can add them as a CSV file. Click on the <strong>Add Keywords<\/strong> button to insert a keyword list for performing a <strong><a href=\"https:\/\/www.mailxaminer.com\/blog\/how-to-search-keywords-in-outlook\/\" target=\"_blank\" rel=\"noopener\">keyword search in Outlook<\/a><\/strong> 365 mailbox.<\/p>\n<p>While dealing with a large forensic case, saving the search results can be helpful for the investigators to further investigate the case. Users can easily save these search results by clicking on the Save button of the eDiscovery supporting tool and providing the <strong>Search Result Name<\/strong> &amp; <strong>Note<\/strong>.<\/p>\n<p>After completing a content search in Office 365 Outlook mailbox by using various search mechanisms present in the tool. The final process of eDiscovery is to <strong><a href=\"https:\/\/www.mailxaminer.com\/blog\/export-office-365-mailbox-to-pst\/\" target=\"_blank\" rel=\"noopener\">export Office 365 mailbox to PST<\/a><\/strong> file.<\/p>\n<p>The most helpful part of the tool that comes into use for the investigators during Office 365 eDiscovery <strong><a href=\"https:\/\/www.mailxaminer.com\/case-management.html\" target=\"_blank\" rel=\"noopener\">case management<\/a><\/strong> is the <strong>Export <\/strong>feature. It helps in presenting the evidence in the courtroom. The software supports various file formats, which are acceptable in the litigatory proceedings, including PST, PDF, Concordance, and many more.<\/p>\n<h5><strong>Conclusion<\/strong><\/h5>\n<p>Exporting Office 365 Outlook mailboxes into a file format is the most demanding exporting process, especially the PST file format. That&#8217;s why users prefer to select PST format as the first option for exporting the result of eDiscovery Search in Office 365. But, without proper knowledge, it could be difficult for users to select the best option to export the result.<\/p>\n<p>So, to make things easier, we have discussed both manual and automated methods. This is so because the manual method takes more time and effort to deliver accurate results. Investigators often prefer the automated method, which uses a proven tool, to perform searches in Office 365 and extract evidence. Hence, try the software now!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Carrying out eDiscovery search in Office 365 is not an easy task because it demands a complete integrated strategy that <a href=\"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/\" >Read More&#8230;<\/a><\/p>\n","protected":false},"author":9,"featured_media":6142,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39,1],"class_list":["post-838","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-email-client","category-forensics"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>eDiscovery Search in Office 365 Mailbox to Extract Evidence<\/title>\n<meta name=\"description\" content=\"eDiscovery search in Office 365 mailbox can be done using eDiscovery tool. Perform a case management content search in Office 365 and export search result to PST file.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"eDiscovery Search in Office 365 Mailbox to Extract Evidence\" \/>\n<meta property=\"og:description\" content=\"eDiscovery search in Office 365 mailbox can be done using eDiscovery tool. Perform a case management content search in Office 365 and export search result to PST file.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/\" \/>\n<meta property=\"og:site_name\" content=\"MailXaminer Official Blog\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-26T12:49:09+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-11-20T12:37:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2025\/03\/SysTools-Article-29.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Tej Pratap Shukla\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tej Pratap Shukla\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/ediscovery-search-office-365\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/ediscovery-search-office-365\\\/\"},\"author\":{\"name\":\"Tej Pratap Shukla\",\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/#\\\/schema\\\/person\\\/ff3afbe1ac8838fe3a5246ab51b37a8c\"},\"headline\":\"How to Perform eDiscovery Search in Office 365 to Carve Evidence?\",\"datePublished\":\"2025-10-26T12:49:09+00:00\",\"dateModified\":\"2025-11-20T12:37:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/ediscovery-search-office-365\\\/\"},\"wordCount\":1967,\"image\":{\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/ediscovery-search-office-365\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/SysTools-Article-29.png\",\"keywords\":[\"content search in office 365\",\"export office 365 mailbox to pst\",\"Office 365 Outlook mailbox\"],\"articleSection\":[\"Email client\",\"Forensics\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/ediscovery-search-office-365\\\/\",\"url\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/ediscovery-search-office-365\\\/\",\"name\":\"eDiscovery Search in Office 365 Mailbox to Extract Evidence\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/ediscovery-search-office-365\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/ediscovery-search-office-365\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/SysTools-Article-29.png\",\"datePublished\":\"2025-10-26T12:49:09+00:00\",\"dateModified\":\"2025-11-20T12:37:44+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/#\\\/schema\\\/person\\\/ff3afbe1ac8838fe3a5246ab51b37a8c\"},\"description\":\"eDiscovery search in Office 365 mailbox can be done using eDiscovery tool. Perform a case management content search in Office 365 and export search result to PST file.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/ediscovery-search-office-365\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/ediscovery-search-office-365\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/ediscovery-search-office-365\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/SysTools-Article-29.png\",\"contentUrl\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/SysTools-Article-29.png\",\"width\":1280,\"height\":720,\"caption\":\"How to Perform eDiscovery Search in Office 365\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/ediscovery-search-office-365\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog Home\",\"item\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Forensics\",\"item\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/category\\\/forensics\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"How to Perform eDiscovery Search in Office 365 to Carve Evidence?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/\",\"name\":\"MailXaminer Official Blog\",\"description\":\"Tech Talks by Forensics Experts\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/#\\\/schema\\\/person\\\/ff3afbe1ac8838fe3a5246ab51b37a8c\",\"name\":\"Tej Pratap Shukla\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/477bdfb87b4a0b6b287b8e9aa10b59e78eb55a1f2f34d4caaa36e2f3754584cc?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/477bdfb87b4a0b6b287b8e9aa10b59e78eb55a1f2f34d4caaa36e2f3754584cc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/477bdfb87b4a0b6b287b8e9aa10b59e78eb55a1f2f34d4caaa36e2f3754584cc?s=96&d=mm&r=g\",\"caption\":\"Tej Pratap Shukla\"},\"description\":\"A versatile technocrat, always in the search for new and interesting areas related to technology. Works on multiple technical problems faced by users frequently. Provides the user-friendly solutions to deal with numerous technical issues.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/tej-pratap-shukla\\\/\"],\"url\":\"https:\\\/\\\/www.mailxaminer.com\\\/blog\\\/author\\\/tej\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"eDiscovery Search in Office 365 Mailbox to Extract Evidence","description":"eDiscovery search in Office 365 mailbox can be done using eDiscovery tool. Perform a case management content search in Office 365 and export search result to PST file.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/","og_locale":"en_US","og_type":"article","og_title":"eDiscovery Search in Office 365 Mailbox to Extract Evidence","og_description":"eDiscovery search in Office 365 mailbox can be done using eDiscovery tool. Perform a case management content search in Office 365 and export search result to PST file.","og_url":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/","og_site_name":"MailXaminer Official Blog","article_published_time":"2025-10-26T12:49:09+00:00","article_modified_time":"2025-11-20T12:37:44+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2025\/03\/SysTools-Article-29.png","type":"image\/png"}],"author":"Tej Pratap Shukla","twitter_misc":{"Written by":"Tej Pratap Shukla","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/#article","isPartOf":{"@id":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/"},"author":{"name":"Tej Pratap Shukla","@id":"https:\/\/www.mailxaminer.com\/blog\/#\/schema\/person\/ff3afbe1ac8838fe3a5246ab51b37a8c"},"headline":"How to Perform eDiscovery Search in Office 365 to Carve Evidence?","datePublished":"2025-10-26T12:49:09+00:00","dateModified":"2025-11-20T12:37:44+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/"},"wordCount":1967,"image":{"@id":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2025\/03\/SysTools-Article-29.png","keywords":["content search in office 365","export office 365 mailbox to pst","Office 365 Outlook mailbox"],"articleSection":["Email client","Forensics"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/","url":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/","name":"eDiscovery Search in Office 365 Mailbox to Extract Evidence","isPartOf":{"@id":"https:\/\/www.mailxaminer.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/#primaryimage"},"image":{"@id":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2025\/03\/SysTools-Article-29.png","datePublished":"2025-10-26T12:49:09+00:00","dateModified":"2025-11-20T12:37:44+00:00","author":{"@id":"https:\/\/www.mailxaminer.com\/blog\/#\/schema\/person\/ff3afbe1ac8838fe3a5246ab51b37a8c"},"description":"eDiscovery search in Office 365 mailbox can be done using eDiscovery tool. Perform a case management content search in Office 365 and export search result to PST file.","breadcrumb":{"@id":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/#primaryimage","url":"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2025\/03\/SysTools-Article-29.png","contentUrl":"https:\/\/www.mailxaminer.com\/blog\/wp-content\/uploads\/2025\/03\/SysTools-Article-29.png","width":1280,"height":720,"caption":"How to Perform eDiscovery Search in Office 365"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mailxaminer.com\/blog\/ediscovery-search-office-365\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog Home","item":"https:\/\/www.mailxaminer.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Forensics","item":"https:\/\/www.mailxaminer.com\/blog\/category\/forensics\/"},{"@type":"ListItem","position":3,"name":"How to Perform eDiscovery Search in Office 365 to Carve Evidence?"}]},{"@type":"WebSite","@id":"https:\/\/www.mailxaminer.com\/blog\/#website","url":"https:\/\/www.mailxaminer.com\/blog\/","name":"MailXaminer Official Blog","description":"Tech Talks by Forensics Experts","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mailxaminer.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.mailxaminer.com\/blog\/#\/schema\/person\/ff3afbe1ac8838fe3a5246ab51b37a8c","name":"Tej Pratap Shukla","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/477bdfb87b4a0b6b287b8e9aa10b59e78eb55a1f2f34d4caaa36e2f3754584cc?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/477bdfb87b4a0b6b287b8e9aa10b59e78eb55a1f2f34d4caaa36e2f3754584cc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/477bdfb87b4a0b6b287b8e9aa10b59e78eb55a1f2f34d4caaa36e2f3754584cc?s=96&d=mm&r=g","caption":"Tej Pratap Shukla"},"description":"A versatile technocrat, always in the search for new and interesting areas related to technology. Works on multiple technical problems faced by users frequently. Provides the user-friendly solutions to deal with numerous technical issues.","sameAs":["https:\/\/www.linkedin.com\/in\/tej-pratap-shukla\/"],"url":"https:\/\/www.mailxaminer.com\/blog\/author\/tej\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mailxaminer.com\/blog\/wp-json\/wp\/v2\/posts\/838","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mailxaminer.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mailxaminer.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mailxaminer.com\/blog\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mailxaminer.com\/blog\/wp-json\/wp\/v2\/comments?post=838"}],"version-history":[{"count":10,"href":"https:\/\/www.mailxaminer.com\/blog\/wp-json\/wp\/v2\/posts\/838\/revisions"}],"predecessor-version":[{"id":6839,"href":"https:\/\/www.mailxaminer.com\/blog\/wp-json\/wp\/v2\/posts\/838\/revisions\/6839"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mailxaminer.com\/blog\/wp-json\/wp\/v2\/media\/6142"}],"wp:attachment":[{"href":"https:\/\/www.mailxaminer.com\/blog\/wp-json\/wp\/v2\/media?parent=838"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mailxaminer.com\/blog\/wp-json\/wp\/v2\/categories?post=838"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}