The laminated table
| Artifact | Lives in | Discoverable via | Gap to know |
|---|---|---|---|
| 1:1/group chat | Participants' mailboxes (compliance copy) | Mailbox scope per custodian | Leavers need inactive mailboxes/holds |
| Channel messages | Group mailbox | Group/team scope | Scope the TEAM, not members |
| Private channel messages | Group scope (post-migration) + legacy member-mailbox history | Both scopes for long windows | The migration seam (channels module) |
| Meeting chat | Participants' mailboxes | As group chat | Includes externals' messages held by YOUR side |
| Recordings | OneDrive (recorder) / SPO (channel) | SPO/OD locations | Expiry timer may have deleted before the case (retention module) |
| Transcripts | With the meeting artifacts | Meeting artifacts search surfaces | E2ee meetings never had one |
| Whiteboards | Storage per whiteboard provisioning (OneDrive-based for new) | File-side search | Legacy boards' migration state varies |
| Files shared in chat | Sender's OneDrive | OD scope of the SHARER | The link in chat is a pointer — collect the file, not the message |
| Loop components | Loop storage (.loop files in OD/SPO) | File-side | A message quoting a Loop shows a snapshot-in-time question — collect both |
| Cards/bot posts | Compliance records of the thread | Message search | Card ACTIONS (what the user clicked) live in the app's own logs, not Teams |
| Shared-channel content | HOST tenant only | Host's group scope | Partners hold nothing (B2B module) |
Practice notes
- Custodian mapping is the real work: a matter's people -> their mailboxes + OneDrives + the TEAMS/groups they touched (Purview's custodian data-source mapping does Teams-aware expansion — use it rather than hand-listing).
- Conversation reconstruction: modern review renders chat as threaded transcripts — export choices decide whether legal reads conversations or confetti.
- Time zones and edit history: exports carry versions (message-lifecycle module) and UTC stamps — brief reviewers before they discover both mid-deposition.
What to watch (proofs)
- A quarterly test search per artifact row: one known item of each type, searched and found — the table above verified against YOUR tenant, dated.
- The seams: private-channel-era boundaries and recording-expiry settings (both in serv365's scanned/archived surfaces) — the two facts that most often falsify 'we have everything'.
- Hold coverage vs matter list: holds in Purview against active matters — every matter with Teams-relevant custodians should show Teams-aware hold scopes.
- Export integrity: item counts search-vs-export reconciled per collection — the gap you find in-house beats the gap opposing counsel finds.