eDiscovery - Managing Cases

We are excited to introduce enhanced functionalities and streamlined eDiscovery workflows with the Case Review App, which offers unparalleled efficiency and effectiveness in managing your investigations. Explore Case Review now!

This article contains information on creating and managing eDiscovery Cases in Mimecast, detailing archive searches, export processes, linking to Smart Tags, case statuses, and auditing procedures.

eDiscovery Cases allow administrators to group multiple Archive Searches in a single case. They can be used in many ways, as outlined below:

Field / Option	Description
Export	Messages can be exported from the Administration Console in .ZIP files containing messages in .EML format.
Retention Adjustment	Messages can be made subject to a retention adjustment to increase or decrease the length of time they are stored in the Mimecast archive.
Litigation Hold	Messages can be placed in Litigation Hold, where they will not expire from the Mimecast archive for a period defined by an Administrator, regardless of the message's actual expiration date.
Link to Smart Tag	Messages can be linked to a Smart Tag, allowing individual users, groups, or users to view archived messages where they are not the sender or recipient.

Creating An eDiscovery Case

eDiscovery Cases cannot be deleted once created.

To create and work with eDiscovery Cases, you must be an administrator and have one of the following roles:

• Super Administrator
• Full Administrator
• Discovery Officer.

To create an eDiscovery case:

1. Log in to the Mimecast Administration Console.
2. Navigate to Archive | Discovery Cases menu item.

eDiscovery Cases are stored in folders. Therefore, we cannot create a Case in the "Root" folder. See the Administration Console: Managing Folders for details on how to create a folder.

3. Click on the New Discovery Case button.
4. Complete the Discovery Properties dialog as follows:

   Field / Option	Description
   Description	Enter a description for your Case. This will be displayed in the Discovery Case Definitions list.
   Notes	Enter the case details. This helps you and other administrators identify the Case at a later date.

5. Click on the Save and Exit button.

Assigning Archive Searches To eDiscovery Cases

The Build Discovery Case options available are described below. In addition, you can use a combination of these options in a single eDiscovery Case.

To start assigning archive searches to your eDiscovery Case:

1. Open the Discovery Case.
2. Select the Build Discovery Case drop-down menu.

Quick Basic Search

A Quick Basic Search allows you to search a specific mailbox in your archive. Additionally, you can narrow the Search to include exact text in the selected Mailbox.

To perform a quick search:

1. Click on the Build Discovery Case | Quick Basic Search menu item.
2. Complete your Search Parameters as required:

Field / Option	Description
Search Description	A name to identify the Search.
Search Text	The text which you would like to search.
Mailbox	Use the Lookup button to locate the Mailbox for which you would like to limit the Search.
From Date	The earliest message sent date to be included in the Search. The default is Eternal to ensure all past messages are considered in the Search.
To Date	The latest message sent date to be included in the Search. The default is Eternal to ensure all future messages are considered in the Search.

Advanced Search

For more granular options, the Advanced Search function can be used:

1. Click on the Build Discovery Case | Advanced Search menu item.
2. Complete your Search Parameters as required:

Field / Option	Description
Search Text	The text for which you are searching. View the guidance on-screen for using search operators.
Message Components	Select which message components are to be considered in the Search.
Include Litigation Hold Messages	Select whether to include messages that have passed their natural expiration date but are still available due to Litigation Hold.
Search within a Smart Tag	When used, searches are limited to messages assigned to the selected Smart Tag.
Sender and Recipient Filters	Either the full email address(s) or domain name of the sender and / or recipient you want to filter the Search on: Use spaces to enact an "OR" when including multiple addresses or domains. If you are unsure of the full address, use a wildcard (*) for the domain part of the address. A wildcard (*)  cannot be used at the start of an email address. To exclude an address from the Search, use the "NOT" operator. This must be used after an address or domain to include, for example, mimecast.com, NOT [e-mail].
Date Range	The date range to filter the Search based on the message sent date.
Route Filter	Specify the route of the messages to search for, for example, inbound, outbound, or internal.
Result Sort Order	The order in which you would like the results displayed.

1. To view the results of the Search, click the Search button.
2. Once reviewed, click the Back button to return to the Advanced Search screen.
3. To save the Search to the Case, click the Save and Exit button on the top toolbar.

Adding Previously Saved Searches

If there are searches that have previously been saved, these can be linked to an eDiscovery Case. To add the Saved Search to the Case, click the Save and Exit button on the top toolbar.

Once a Saved Search is assigned to an eDiscovery Case, it will no longer display within the Archive | Saved Searches section to prevent an accidental update or deletion of the Saved Search.

Export An eDiscovery Case

Once your eDiscovery Case is built, you can export the messages that are part of the Case. 
Messages are exported in batches of 10 GB. Each batch consists of downloaded files with a maximum of 2 GB per file. For more information, see Exporting Archived Message Data.

When exporting eDiscovery Cases with multiple linked saved searches, a separate batch is created for each linked Saved Search.

 eDiscovery Case exports are limited to 50,000 message items and a maximum of 10GB across all constituent searches.

To export an eDiscovery case:

1. Log in to the Mimecast Administration Console.
2. Navigate to Archive | Discovery Cases menu item.
3. Select the required Discovery Case.
4. Click on the Export Case button.
5. Complete the Export Details dialog as required:

Field / Option	Description
Discovery Description	Specify a description for the download.
Export Type	Specify the file type to use for the exported file.
Download Filename	Specify a file name for the exported file.

6. Click on the Save button. The export is visible in the Case Exports section of the Discovery Case page.

Canceling An eDiscovery Case Export

While an Export is either Pending or In Progress, it's possible to cancel it using the Cancel Exports button in the toolbar.

Linking An eDiscovery Case To A Smart Tag

Results from an eDiscovery Case can be linked to a previously created Smart Tag. This allows specific users to view messages securely.

To link an eDiscovery Case to a Smart Tag:

1. Click on the Build Discovery Case | Link to Smart Tag menu item.
2. Complete the Link Properties settings as required:

Field / Option	Description
Select Smart Tag	Use the Lookup button next to the Select Smart Tag field to select from a list of existing Smart Tags.
Linking Action	Select whether messages will be linked to or removed from the Smart Tag. Use Create Smart Tag Links when you want to make the messages linked with a Smart Tag available to the user. Once permissions to access the Smart Tag are applied to a user or group, the associated mail can begin to be viewed in the Mimecast application within minutes. However, this may take some time to process, depending on the number of emails. Use Remove smart tag links when you want to remove messages from a Smart Tag, preventing users from being able to view them. This Action will not be applied immediately, as a request is posted to your account for processing during nightly housekeeping tasks. The Remove Smart Tag Links action is logged in the Administration Console under Account | Audit Logs. In addition, the Action displays in the queue as Archive Service Logs for the Category and Discovery Case Adjustments as the Type.
Perpetual Link	Check the Perpetual Link option to include all future and existing messages. If not selected, results will only have those emails that match the search criteria when the initial Search is run. No future messages will be included.

3. Click the Save and Exit button on the top toolbar to add them to the Case.

Managing an eDiscovery Case

eDiscovery Cases are managed from the Administration Console in the Administration | Archive | Discovery Cases menu. The cases are displayed by folder, with high-level information about each case available at a glance.

eDiscovery Case Statuses

eDiscovery Cases can have a status of either Editable or Locked. A Case will be locked when it:

• Has been assigned to a Litigation Hold.
• Has been assigned to a Retention Adjustment.
• Has been linked to a Smart Tag.
• It is being exported.

When locked, no new searches can be added, and existing searches cannot be amended.

Mimecast will automatically unlock a case if:

• An associated Litigation Hold expires.
• There are no Retention Adjustments linked to the Case.
• All linked Smart Tags have been unlinked.
• It is not being exported. This is automatically checked once per day during nightly housekeeping routines.

When a Case is Unlocked, an Unlock Discovery Case entry is added to the Account Access Event log. This is viewed in the Account | Audit Logs menu in the Administration Console.

Editable Cases

If the Case Status is Editable, a Manage Saved Searches option is available. Provides a list of all the searches assigned to the Case and gives additional information such as:

• Who created the Search.
• If the Search was saved or not.
• The search time and date.
• Basic search parameters.

Right-clicking on the Search allows the Administrator to amend the search criteria and unlink or delete the Saved Search. As long as it's editable, you can remove a saved search from an eDiscovery Case (the Unlink Saved Search menu item). However, you cannot delete a Case once it has been created.

Locked Cases

Once the Case has been Locked, a View Saved Searches option is available. The same information is displayed; however, no changes can be made to the Search. Right-clicking on the Saved Searches provides the view menu options. A Saved Search Summary is also provided, listing all searches assigned to the Case.

Auditing

eDiscovery Case auditing is linked to the Search Audit Logs and the Message View Logs. To view the Logs, open the Case, click on the View Audit Logs drop-down menu, and select a Log.

eDiscovery Search Audit

eDiscovery Search Audit shows a Log of all Searches performed as part of this Case, along with the Search Parameters; this will also include any searches that were not saved.

Details included being:

• Who created the Search.
• Was it saved.
• Search time and date.
• Basic search parameters.

Right-clicking on a search gives you the option to View Search Parameters or View Search Results. Unfortunately, the ability to remove any entries from the list is not available.

eDiscovery Email View Audit

Email View Audit Shows a log of all viewed emails associated with this Case.

Details included being:

• Whether the content or metadata has been viewed.
• Who viewed the message.
• The date and time the viewing occurred.