Content Search and eDiscovery are both search tools used for identifying data and exporting content. However, the detailed comparison of Content Search vs eDiscovery shows various key differences.
Users, especially businesses, must understand how and when to use the right feature. Only that way, identifying specific content might be simplified and done promptly.
Content Search and eDiscovery: Overview of Key Differences
Both eDiscovery(Core and Advanced) and Content Search have the same purpose: helping users find important data by using search criteria. However, there are key differences between the two, starting with who they are available to, the data sources they use, search criteria, etc.
Understanding the search tools
Content Search
Content Search is a tool available on Office 365 accessible through the Security and Compliance Center. By accessing Content Search, admins can look for stored data across various data sources within a digital environment.
It can be used to search for in-place content of the organization. Some examples include documents, instant messages, databases, emails, and other types of digital content.
After the search, the results can be previewed and exported to a desired location.
eDiscovery
eDiscovery is a complex process of finding evidence for legal proceedings through the identification, collection, processing, and analysis of electronically stored information.
There are many eDiscovery software out there, two of which are Microsoft Purview Core and Advanced eDiscovery, which will be targeted in this guide. With eDiscovery in Office 365, a search of mailboxes can be done by going to the Exchange Admin Center and selecting In-Place eDiscovery.
When to use Content Search and when eDiscovery
Content Search only identifies and exports content stored in different Microsoft services, such as Yammer, SharePoint, or OneDrive, among the most popular. Through Content Search, you only find data and export the search results, usually for the company’s purposes.
On the other hand, eDiscovery has a more specific purpose, as the searches can be exported and presented as evidence in specific legal cases. Hence, eDiscovery is often used by legal firms since it provides more precise searches and greater security.
The licenses needed for Content Search and eDiscovery
Whether a company or a legal team can use the eDiscovery and Content Search feature depends on their Microsoft license. All organizations with Microsoft 365 E1 licenses or higher licenses can use the Content Search feature.
Different licenses are needed for accessing the core and advanced eDiscovery tools. A Microsoft 365 E3 is needed for the core, and an E5 license is required for using the advanced eDiscovery tool.
Data sources
The two search solutions browse through stored data but use slightly different data sources. A Content Search uses the following data sources to identify content:
- Yammer
- OneDrive + Teams 1:1 chats and media
- SharePoint + Teams channel chats and media
- Groups
- Skype for Business messaging conversations
On the other hand, eDiscovery uses the same data sources plus Exchange mailboxes, public folders, and Microsoft Groups.
Core/Advanced eDiscovery vs Content Search Features
One of the greatest differences between Content Search and eDiscovery is their features. Content Search allows basic data search. On the other hand, core and advanced eDiscovery allows everything in Content Search plus some additional features.
Here are the main differences in the features of all three.
| Content Search | Core eDiscovery | Advanced eDiscovery | |
|---|---|---|---|
| Role-based permissions | ✔ | ✔ | ✔ |
| Export search results | ✔ | ✔ | ✔ |
| Content Search | ✔ | ✔ | ✔ |
| Usage of search conditions | ✔ | ✔ | ✔ |
| Use of keyword queries | ✔ | ✔ | ✔ |
| Search statistics | ✔ | ✔ | ✔ |
| Place content locations on legal hold | x | ✔ | ✔ |
| Case management | x | ✔ | ✔ |
| Analytics | x | x | ✔ |
| Collection statistics and reports | x | x | ✔ |
| Optical character recognition | x | x | ✔ |
| Advanced indexing | x | x | ✔ |
| Review sets and set filtering | x | x | ✔ |
| Legal hold notification | x | x | ✔ |
| Custodian management | x | x | ✔ |
Search Criteria
While creating a search on Content Search versus eDiscovery, there will be different search criteria to utilize.
The Content Search allows administrators to:
- Do search queries
- Select locations for searching, like devices and platforms
- Possibility to include keywords and conditions
- Using ID list
On the other hand, the eDiscovery is broader, and the search criteria might be used for:
- User-targeted searches
- Group and team-targeted searches
- Doing searches targeting OneDrive accounts
- Searching sites, including Office 365 groups and Microsoft Team
Running a Content Search or eDiscovery
The similarities between Content Search vs eDiscovery are that they include the same steps, but different criteria can be used. Both tools are located in the menu bar of the Security and Compliance Center.
Administrators can add a name and description of the search inquiry. This is optional but highly recommended for more organized searches.
Next, the administrator should choose the location. This could be specific users, groups, sites, or accounts. After selecting the locations, the conditions of the search should be set. Adding specific keywords and conditions will bring better search results.
Finally, by clicking on Submit, the tool will start the search. After it is done, administrators can choose what to do with the results. If the search was successful, the administrator can export the search results either as a .zip or .csv file.
There are three options for exporting a report, and they include the following output options:
- Exporting all items except the ones that are encrypted, unindexed, or have unrecognized format
- Exporting only items with unrecognized format, encrypted or ones that weren’t indexed for some reason
- Exporting all items
In other cases, the administrator can edit the search or rerun a Content Search.
Visibility
Another significant thing that distinguishes the Content Search vs eDiscovery is the visibility. Content Searches can be seen by anyone who has access to the features.
On the other hand, every eDiscovery case that is opened has a security boundary. Since eDiscovery searches are used by legal representatives, only people who have been granted access can see the eDiscovery search. Only one person has the power to see the listings of each eDiscovery case, and that is the eDiscovery Administrator.
Data preservation
Another concept that eDiscovery has that’s not included with Content Search is putting content on hold. In other words, organizations can preserve the data from manipulation or destruction. Selecting the option to place content on hold is especially helpful when a case is intended to go to litigation.
The eDiscovery case will be kept active as long as it is put on hold. Individual collection basis holds can be released by closing the case or deleting the hold.
Conclusion
Searching through electronically stored information can be time-consuming when organizations aren’t utilizing the right tools. Thus, knowing the features mentioned in the Content Search vs eDiscovery comparison is of significant importance.
With Content Search, the users can quickly locate specific information by browsing different data sources, while eDiscovery is a crucial process for legal and regulatory contexts.
