Does a completed eDiscovery export prove that someone downloaded or stole the data?
No. Preparing an export, downloading it, and transferring it to another destination are separate observations. Review the actual case authorization, export contents, and evidence of each transfer.
“Legal needs the mailbox export today. Send it to this review workspace.”
The request sounds ordinary to someone who supports investigations. It supplies a business purpose, a deadline, and a destination. Yet each part needs its own authority. A real case can be used to justify the wrong data set, and an approved collection can still be sent to an unapproved recipient.
eDiscovery is the process of finding and handling electronic information for investigations or legal matters. Here, the product examples concern Microsoft Purview. Before exporting, confirm which information the request covers and where the copy is allowed to go.
A legitimate tool can perform an unauthorized task
Microsoft’s 2020 DART case report, …And Then There Were Six, describes an intruder using eDiscovery, Compliance Search, and Microsoft Flow to automate theft of search results after administrator credentials were compromised. That incident establishes historical abuse of legitimate features. It does not establish that current Purview behaves like the older environment. Microsoft DART: case report 001
Investigators may need broad access to answer a bounded question. Review the reason for the search, the selected data, and the custody of the resulting copy together.
Our emergency data-request guide addresses who may request disclosure. This article follows the internal operator after a request arrives: how does that request become a search, an export, and a delivered package? A familiar sender or genuine case number cannot substitute for that chain of decisions.
Connect the case approval, search, export, and delivery
For an export review, keep four records connected without treating them as interchangeable:
| Record | What to establish | What it does not establish alone |
|---|---|---|
Case authorization |
Accountable owner, purpose, approved people and data |
Every requested action is within scope |
Search definition |
Locations, date range, query, and relevant options |
Every matching item will be exported |
Export preparation |
Options, completion state, included items, exclusions |
Somebody downloaded the package |
Delivery record |
Who obtained which copy and where it went |
The recipient was authorized to receive it |
This is a proposed review model, not a list of Microsoft event names. Use actual service records and preserve their original fields. If a record is missing, mark the corresponding question unresolved.
Microsoft distinguishes preparing results from downloading them. Its current guidance also identifies restrictions that exclude some search hits from export. Microsoft: export considerations
A SharePoint FileAccessed event can reflect eDiscovery’s service-side collection or export, rather than an outside recipient receiving the file. Microsoft: export considerations
Connect the case to the copy
An evidence review, not an attack trace
- Case authority
Who approved the work? Which data and recipients?
- Search scope
Which locations, dates, query, and options?
- Prepared export
What did the package contain? Preparation does not prove download.
- Copy and destination
Who obtained the copy? Was the destination approved?
A missing record leaves a question open. Package expiry does not recall copies.
Check who can initiate and who can download
Purview uses roles and case permissions to govern eDiscovery actions. The Compliance Search role permits searches and related estimates, while other roles govern initiating actions such as preview or export. Those distinctions make role review useful, but “no Export role” is too simple a test for every download path.
Microsoft documents a specific exception: without premium features enabled, a user with Compliance Search but without Export can download results for up to two weeks after someone with Export initiates the export. The documented grace period does not apply when premium features are enabled. Check the actual feature mode, case access, and assigned roles before concluding who could obtain a package. Microsoft: Compliance Search and Export roles
Also check the download-link mode. Standard links require sign-in and access; optional pre-authorized links let whoever possesses them download until expiry. Microsoft says not to share export links. An authorized operator should deliver files to external recipients through approved access-controlled channels. Microsoft: export packages
Ask the reviewer: who is expected to initiate the export, and who is expected to retrieve it? Record both. A workflow that approves only the initiator may leave the next handoff unclear.
Keep business authorization separate from technical authorization, meaning the permissions the service enforces. A person can have the required role yet lack approval for this particular matter. Conversely, an approved investigator may need the administrator to resolve a legitimate permission problem. The response should identify which condition is missing instead of casually expanding access.
Treat scope and destination changes as new decisions
A follow-up request can cite the correct case number while changing the date range, adding mailboxes, or substituting a review workspace. Compare each requested change with the existing authorization. Contact the case owner through the established channel before preparing a broader package or moving it elsewhere.
Approval of a replacement destination should identify the receiving organization and expected reviewers. A genuine access problem may justify changing the delivery route; it does not automatically justify widening the search.
If the operator needs to validate a configured permission boundary, use a separately authorized test case with synthetic files, agreed identities and destinations, and cleanup. A successful approval check does not establish what Purview would permit or alert on.
Scope includes export options
The query is only part of a review. The export configuration can affect what enters the package, including how partially indexed items or related content are handled. Ask the operator to preserve the options used and reconcile the package report with the approved scope. A screenshot of the query alone is an incomplete handover. Microsoft: export options
If the package contains material outside the request, stop the handoff and involve the case owner. If expected items are missing, preserve the reported exclusions and errors rather than silently expanding permissions or rerunning a broader search. Legal and compliance owners should decide the appropriate handling of matter data; the security team can help investigate technical access and transfer questions.
Find out where the exported copy went
Microsoft documents a 14-day expiration for search export packages, distinct from review-set exports. That service-side expiry does not demonstrate deletion of a copy already downloaded elsewhere. Treat it as a package-availability rule, not a retention policy for every receiving system. Microsoft: search export expiration
If a questionable request was fulfilled, responders should establish the last supported point in the chain. Was a package prepared? Did someone retrieve it? Is there evidence of an upload, external access, or redistribution? Preserve available records promptly and state gaps in collection or retention. A missing download record does not prove a download was impossible.
The case owner can identify the approved recipients and handling requirements. The service administrator can review effective permissions and package availability. The endpoint or storage owner can investigate copies under their control. Removing a role may prevent some future actions; it does not establish what happened to a file already transferred. The integration-token response guide explains the same distinction between stopping further access and accounting for earlier data operations.
Review one recent authorized export. Another reviewer should be able to connect its purpose, scope, operator, and destination without reconstructing the decision from chat messages.
