In early November 2016, an event took place that impacted workers’ lives even more than the U.S. presidential election a few days later impacted their conversations with their loved ones that Thanksgiving.
On November 2 of that year, Microsoft officially launched Microsoft Teams, which then rolled out to Microsoft 365 customers worldwide in March 2017. By 2022, Teams reached 270 million users compared to Slack’s mere 18 million. Teams users are sending approximately 33.75 billion messages daily.
With 90% of the Fortune 500 and over 1 million organizations using Microsoft 365, Teams has become the go-to app for work communications.
But as Peter Parker’s Uncle Ben never said, “With great Microsoft Teams usage comes great eDiscovery data creation.”
From the mind-boggling volume of data, to the presence of the terrifyingly named “dark data,” to the complex nature of chat data compared to emails and standard business docs, Microsoft Teams eDiscovery has a unique set of challenges you need to understand in order to overcome.
eDiscovery in Microsoft Teams: What’s the Big Deal?
What Microsoft Teams giveth in terms of convenience and usability, it taketh away by making eDiscovery daunting.
First, there are the various file types (and the various eDiscovery challenges they may present) that companies must collect and review.
Direct messages, group messages, and channel messages? Check.
Word, Excel, PowerPoint, and other Office and non-Office files (more on that later) you’ve shared through Teams? Yup.
Audio and video recordings of channel meetings or scheduled meetings? Of course.
Next, there’s the slight wrinkle that Teams doesn’t store these files in a central location.
Teams stores messages in Microsoft Exchange, but stores files and meeting recordings in SharePoint Online or OneDrive for Business. Also, Teams doesn’t store data by data type; it stores it by custodian, which can get complicated when there are guest users.
Then, there’s the channel structure. Teams eDiscovery looks different for messages and files in private channels than in shared channels. Private and shared channels have their own SharePoint sites that differ from the parent team site, providing more places to search for relevant documents.
Of course, you can’t forget presence data and other metadata that can be difficult to search and review. Presence data provides activity indicators to show when users are available, busy, or away. Teams also generates metadata about user activity, such as login and logout times, device information, and IP addresses.
In other words, there’s a lot going on with Teams eDiscovery...
Key Challenges of Microsoft Teams Conversations for eDiscovery
For most companies, Microsoft Teams chat is the feature they use the most. That’s why when we’re talking about Teams eDiscovery, messages, conversations, and chat history are probably going to make up the bulk of the collected and reviewed files.
But wading through Teams chats during eDiscovery is like wading through your phone’s camera roll looking for the one photo you took last year — or was it the year before? — of that crazy flaming dessert you and your friends shared.
First, there’s the large volume of data. Based on the stats we mentioned in the intro to this post, the average company has over 30,000 messages flowing through Teams each day.
Everything from substantive messages to “Got it”s, “Will do”s, and “I’ll keep you posted”s to messages with only emojis in them could be responsive to discovery requests and could even be the difference maker in a case.
Next, there’s how Teams structures its messages, conversations, and chat history when it exports them.
You know those threaded conversations in Gmail and Outlook that make it easy for you to understand the context of the emails in them?
Uh, yeah, that’s not a thing in Teams data.
When you export Teams chat data, you’ll receive the data as .PST files that are neither organized nor structured. This makes it difficult to understand the context of chat conversations.
Speaking of exporting, your ability to export particular types of Teams eDiscovery data, like metadata or reactions (prior to June 1, 2022), might be as limited as your ability to understand what’s in them.
Finally, there’s dark data. In the eDiscovery context, dark data refers to data that’s stored and structured in an application like Teams but the application cannot index it when you try to locate and visualize it.
Microsoft 365, including Teams, has the reputation of being quite the dark data hoarder, with users reporting that it can miss up to 70% of data they’re searching for. Dark data in Teams eDiscovery could include large attachments or documents that are incompatible with Microsoft products — but which could still be responsive, relevant, or hot.
Breaking Through the Chat Noise: How to Navigate Teams eDiscovery
Yes, we know we’ve painted a picture of Microsoft Teams eDiscovery that’s as bleak as the possibility of your Friday night plans panning out when your boss calls you at 3:30 to see if you can help with a “quick project going out tonight.” But unlike that situation, you can navigate Teams eDiscovery in a way that won’t make you question your life’s choices.
First, you can use automated tools like Logikcull to manage Teams eDiscovery data. A tool like this can collect Teams data right from the source, and handle core Teams eDiscovery files together with associated files from other sources like Google Vault, Slack, and Box through built-in integrations.
Here's a preview of how you can ingest your Teams data via direct integration with Logikcull:
Second, you can leverage technology to give unstructured data structure. This technology can reassemble the conversations Teams sliced and diced when it exported custodians’ messages, making it easier to review the conversations in their original context. (There’s a Humpty Dumpty joke here but we’re not going to make it.)
Third, companies can use tools that shine a light on dark data. Microsoft’s technology might have a blind spot with large attachments or non-Microsoft files, but the best eDiscovery software does not. It can index Microsoft non-indexed and “partially indexed” files, so companies can search 100% of the data they collect from Teams.
Finally, along the same lines, companies can use third-party tools to collect certain data types from Teams they would not have otherwise been able to get their hands on given the limitations of Microsoft’s own tools or other less capable third-party tools.
Tech to the Rescue? How eDiscovery Software Can Help
Some eDiscovery tools, like Logikcull, offer comprehensive support for Microsoft Teams data that help users solve the key challenges Teams eDiscovery poses.
Logikcull can quickly ingest as much data as you can throw at it directly from Teams — or collected in a click, via direct integration — and can search and index nearly any kind of file, eliminating concerns about the sizes of data collections and dark data.
With Logikcull, you can combine your Teams eDiscovery data with any other datasets, ensuring a seamless workflow. Logikcull will apply over 3,000 processing steps upon ingestion, including Deep Text Recognition, to ensure it properly indexes all your conversations so you can search through them.
Logikcull automatically processes and sorts this data, and provides hundreds of filters — like by “Sender” or “Channel” — that will help you quickly review your relevant chats and cull out any irrelevant ones. You can also visualize Teams conversations in their original format, so you’ll be able to understand the full flow of different conversations. This helps combat the unstructured data problem.
Here's a quick preview of how Logikcull can handleTeams data:
Logikcull also provides users advanced search capabilities, including unlimited searches with unlimited keywords, and the ability to add privilege and auto tags during review. With its unified search feature, users can search for data across all Microsoft 365 sources, including Teams, Exchange Online, SharePoint Online, and OneDrive for Business.
Conclusion
With millions of people relying on Microsoft Teams daily as their primary tool for communicating with their colleagues, it’s no wonder Teams eDiscovery is not exactly a walk in the park. There’s so much complex data to be processed that it’s easy for companies to miss key documents for their legal matters.
With eDiscovery tools like Logikcull, companies can streamline the collection, processing, and review of their Teams data while analyzing it together with documents from any other source, seeing the full picture of evidence.
Goodbye voluminous, unstructured, and complex data. Hello relevant, responsive, and hot conversations buried under the never-ending noise of chat data.
