Question

During an incident investigation in Microsoft Defender XDR, legal counsel asks you to identify and review email and Teams messages sent by a suspected malicious insider before any data is exported. You have created an eDiscovery (Standard) case and added the user's mailbox and OneDrive as data sources. You now need to locate the specific messages and confirm their content while ensuring you do NOT permanently alter or remove any items. What should you do next?

Accepted Answer

Create a content search collection in the case, then use the review set preview to examine the matching items without altering them

Answer

Run a Purview Audit search for the user's SendMessage activities and open each mailbox item directly

Answer

Use Defender for Endpoint live response on the user's device to collect the local Outlook OST file for offline review

Answer

Apply a purge action in Threat Explorer to remove the messages so they can be preserved as evidence