Content search and holds

What it is (and isn't)

Content Search runs a query across chosen locations — mailboxes, SharePoint/ OneDrive sites, Teams and Groups — and returns matches you can preview, statistics you can read, and results you can export. It is the search primitive; eDiscovery cases wrap it in holds, review sets and case governance. A content search on its own does not preserve — it reads current state, so if content is deleted between search and export, it can vanish. Preservation is the hold's job.

Scoping and KQL

Two dials define a search:

• Locations — explicit mailboxes/sites, or "all" where permitted. The trap is a location not chosen — the inactive mailbox of a leaver, a group mailbox, the Teams channel behind a chat. A search only finds what it was pointed at, and an under-scoped search that returns "nothing" is dangerously reassuring.
• Query — Keyword Query Language (KQL): keywords, AND/OR/NOT, and properties (sent, received, from, subject, filename, date ranges, sensitivity label). Over-broad queries return unreviewably large sets; over-narrow ones miss variants (synonyms, misspellings, attachments). Iterate against the statistics preview before exporting.

Holds preserve what search finds

The pairing is: search to find, hold to keep. Once a matter is live, place a hold (case hold or retention) so the located content survives user deletion, deletion policies and end-of-retention — the "retention/hold wins" principle again. Search without a hold is a snapshot that can decay; hold without a good search preserves the wrong scope. Both, in order, is the defensible pattern.

Export integrity

Export is where defensibility is won or lost:

• Completeness — the export must cover the full result set; partial/aborted exports that look complete are a real risk. Verify item counts against the search statistics.
• Fidelity — items export with metadata and, for eDiscovery, in formats that preserve the chain (with the eDiscovery Export tool). Re-processing or opening files before export can alter metadata — handle exports read-only.
• Auditability — the search and export are themselves audited, which is what lets you attest later that what you produced is what the system held.

What to watch (proofs)

• Scope completeness: Get-ComplianceSearch for the locations a search targeted — confirm leavers' inactive mailboxes, group mailboxes and relevant sites are included, not just the obvious ones.
• Result vs export counts: Get-ComplianceSearch statistics against Get-ComplianceSearchAction export results — a mismatch is an incomplete production.
• Hold pairing: for any live matter, a Get-CaseHoldPolicy hold covering the same scope the search found — find-and-keep, both present.
• Search auditability: search/export operations in Search-UnifiedAuditLog — the attestation trail that the production is complete and unaltered.