高级电子数据展示中的对话线程Conversation threading in Advanced eDiscovery

即时消息是一种在大型受众中提问、分享想法或快速沟通的便捷方式。Instant messaging is a convenient way to ask questions, share ideas, or quickly communicate across large audiences. 由于即时消息平台(如 Microsoft Teams 和 Yammer 组)成为企业协作的核心,组织必须评估其电子数据展示工作流如何处理这些新的通信和协作形式。As instant messaging platforms, like Microsoft Teams and Yammer groups, become core to enterprise collaboration, organizations must evaluate how their eDiscovery workflow addresses these new forms of communication and collaboration.

高级电子数据展示中的对话重建功能旨在帮助你识别上下文内容并生成不同的对话视图。The Conversation Reconstruction feature in Advanced eDiscovery is designed to help you identify contextual content and produce distinct conversation views. 此功能允许你高效快速地查看完整的即时消息对话, (在 Microsoft Teams 等) 生成的线程对话。This capability allows you to efficiently and rapidly review complete instant message conversations (also called threaded conversations) that are generated in platforms like Microsoft Teams.

通过对话重建,可以使用内置功能来重新构造、审阅和导出线程对话。With Conversation Reconstruction, you can use built-in capabilities to reconstruct, review, and export threaded conversations. 使用高级电子数据展示对话重建可以:Use Advanced eDiscovery Conversation Reconstruction to:

  • 保留对话中所有邮件的唯一消息级别元数据。Preserve unique message-level metadata across all messages within a conversation.

  • 收集与搜索结果相关的上下文消息。Collect contextual messages around your search results.

  • 查看、注释和修订线程对话。Review, annotate, and redact threaded conversations.

  • 导出单个消息或线程对话Export individual messages or threaded conversations

术语Terminology

下面是帮助您开始使用对话重建的一些定义。Here are few definitions to help you get start using Conversation Reconstruction.

  • 邮件: 表示对话中最小的单元。Messages: Represent the smallest unit of a conversation. 邮件的大小、结构和元数据可能会有所不同。Messages may vary in size, structure, and metadata.

  • 对话: 表示一个或多个邮件的分组。Conversation: Represents a grouping of one or more messages. 跨不同的应用程序,对话可能以不同方式表示。Across different applications, conversations may be represented in different ways. 在某些应用程序中,有一个显式操作会导致答复现有邮件。In some applications, there is an explicit action that results from replying to an existing message. 对话是此用户操作显式形成的。Conversations are formed explicitly as a result of this user action. 例如,下面是 Microsoft Teams 中频道对话的屏幕截图。For example, here is a screenshot of a channel conversation in Microsoft Teams.

    Microsoft Teams 频道对话

    在其他应用 (Teams) 中的 1xN 聊天消息)中,没有正式的回复链,而是消息在单个线程中显示为"消息的平面流"。In other apps (such as 1xN chat messages in Teams), there is not a formal reply chain and instead messages appear as a "flat river of messages" within a single thread. 在这些类型的应用中,对话从特定时间发生的一组消息中推断得出。In these types apps, conversations are inferred from a group of messages that occur within a certain time. 这种消息"软分组" (而不是回复链) 表示有关特定关注主题的"来回"对话。This "soft-grouping" of messages (as opposed to a reply chain) represent the "back and forth" conversation about a specific topic of interest.

步骤 1:创建草稿集合Step 1: Create a draft collection

确定相关保管人和内容位置后,可以创建搜索以查找潜在相关内容。After you have identified relevant custodians and content locations, you can create a search to find potentially relevant content. 在高级 电子 数据展示案例的"集合"选项卡上,可以通过单击"新建集合"并遵循向导来创建集合。On the Collections tab in the Advanced eDiscovery case, you can create a collection by clicking New collection and following the wizard. 若要了解如何创建集合、生成搜索查询和预览搜索结果,请参阅 创建草稿集合For information about how you can create a collection, build a search query, and preview the search results, see Create a draft collection.

步骤 2:将草稿集合提交到审阅集Step 2: Commit a draft collection to a review set

查看并完成集合中的搜索查询后,可以将搜索结果添加到审阅集。After you have reviewed and finalized the search query in a collection, you can add the search results to a review set. 当你将搜索结果添加到审阅集时,原始数据将复制到 Azure 存储区域,以便于审阅和分析过程。When you add your search results into a review set, the original data is copied to an Azure Storage area to facilitate the review and analysis process. 有关向审阅集添加搜索结果的信息,请参阅 将草稿集合提交到审阅集For more information about adding search results to a review set, see Commit a draft collection to a review set.

将对话中的项目添加到审阅集时,可以使用线程对话选项从包含与集合的搜索条件匹配的项目的对话中收集上下文消息。When you add items from conversations to a review set, you can use the threaded conversations option to collect contextual messages from conversations that contain items that match the search criteria of the collection. 选择线程对话选项后,可能会发生以下情况:After you select the thread conversations option, the following things can happen:

对话检索

  1. 使用关键字和日期范围查询,搜索返回了邮件 3 的命中Using a keyword and date range query, the search returned a hit on Message 3. 此消息属于大型对话的一部分,如 CRC1 所示This message was part of a larger conversation, illustrated by CRC1.

  2. 当你将数据添加到审阅集并启用对话检索选项时,高级电子数据展示将返回并收集 CRC1 中的其他项目。When you add the data into a review set and enable the conversation retrieval options, Advanced eDiscovery will go back and collect other items in CRC1.

  3. 将项目添加到审阅集后,你可以查看来自 CRC1 的所有单个邮件。After the items have been added to the review set, you can review all the individual messages from CRC1.

若要启用线程对话选项,请参阅 将草稿集合提交到审阅集To enabled the threaded conversations option, see Commit a draft collection to a review set.

步骤 3:查看和导出线程对话Step 3: Review and export threaded conversations

处理内容并添加到审阅集后,您可以开始查看审阅集内的数据。After the content has been processed and added to the review set, you can start reviewing the data in the review set. 根据内容是添加到标准审阅集还是对话审阅集,审阅功能会有所不同。The review capabilities are different depending on whether the content was added to a standard review set or a conversation review set.

查看标准审阅集内的对话Reviewing conversations in a standard review set

在标准审阅集,处理邮件并显示为单个项目,类似于邮件存储在邮箱文件夹中的方式。In a standard review set, messages are processed and displayed as individual items, similar to how they're stored in a mailbox folder. 在此工作流中,每封邮件都作为单独的项目进行处理。In this workflow, each message is processed as a separate item. 因此,按线索设置的摘要和导出选项在标准审阅集内不可用。As a result, the threaded summary and export options aren't available in a standard review set.

标准审阅集

查看对话审阅集内的对话Reviewing conversations in a conversation review set

在对话审阅集内,将各个消息进行线程处理,并呈现为对话。In a conversation review set, individual messages are threaded together and presented as conversations. 这样,你可以查看和导出上下文对话。This lets you review and export contextual conversations.

对话审阅集

以下各节介绍审阅和导出对话审阅集内的对话。The following sections describe reviewing and exporting conversations in a conversation review set.

查看对话Reviewing conversations

在对话审阅集内,可以使用以下选项促进审阅过程。In a conversation review set, you can use the following options to facilitate the review process.

  • 按对话分组: 将同一对话中的邮件分组在一起,以帮助用户简化和加快审阅过程。Group by conversation: Groups messages within the same conversation together to help users simplify and expedite their review process.

  • 摘要视图: 显示线程对话。Summary view: Displays the threaded conversation. 在此视图中,您可以查看整个对话,还可以访问每封邮件的元数据。In this view, you can see the entire conversation and also access the metadata for each individual message.

    • 查看单个邮件的元数据View metadata for individual messages

    • 下载单个邮件Download individual messages

  • 文本视图: 提供整个对话的提取文本。Text view: Provides the extracted text for the entire conversation.

  • 批注视图: 允许你标记对话的线程视图。Annotate view: Lets you markup a threaded view of the conversation. 对话中所有邮件共享同一批注文档。All messages in the conversation share the same annotated document.

  • 标记: 查看审阅集内的对话时,可以通过单击"编码"面板中的"标记"面板 来查看和应用 标记。Tagging: When viewing conversations in a review set, you can view and apply tags by clicking Tagging panel in the Coding panel.

  • 重新运行对话转换: 将邮件添加到对话审阅集时,将自动运行转换作业以创建线程摘要并注释视图。Rerun conversation conversion: When messages are added to a conversation review set, a conversion job is automatically run to create the threaded summary and annotate views. 如果对话重建作业失败,可以通过单击"操作"> 审阅集创建 对话 PDF 来重新运行此作业。If the Conversation Reconstruction job fails, you can rerun this job by clicking Action > Create conversation PDFs in the review set.

导出对话Exporting conversations

在对话审阅集内,可以设置以下选项来导出对话:In a conversation review set, you can set the following options to export conversations:

导出对话选项

a.a. 元数据选项Metadata options

  • 加载文件: 每个单独的邮件、电子邮件和文档都包含元数据。Load file: Metadata is included for each individual message, email, and document. 对话中每条消息有一行。There is one row for each message in a conversation.

  • 标记: 来自审阅过程的标记包含在元数据文件中。Tags: Tags from your review process are included in the metadata file. 对话中的邮件共享相同的标记。Messages in a conversation share the same tags.

b.b. 对话选项Conversation options

  • 对话文件: 导出对话文件时,批注视图将转换为 PDF 文件并下载到导出文件夹。Conversation files: When you export conversation files, the annotated view is converted to a PDF file and downloaded to the export folder. 一个对话文件中的消息指向同一对话文件的 PDF 版本。Messages in one conversation file point to the PDF version of the same conversation file.

  • 单个聊天消息: 导出单个邮件时,对话中每个唯一的邮件都导出为独立项目。Individual chat messages: When you export individual messages, each unique message in the conversation is exported as a standalone item. 以与邮箱中相同的格式导出文件。The file is exported in the same format that it was saved as in the mailbox. 对于特定对话,您将收到多个 .msg 文件。For a specific conversation, you receive multiple .msg files.

    备注

    如果对会话文件应用了批注,这些批注将不会传输到各个邮件。If you applied annotations to the conversation file, these annotations won't be transferred to the individual messages.

c.c. 其他选项Other options

  • 生成所有导出内容的文本文件: 为从审阅集导出的每个对话生成一个文本文件。Generate text files for all exported content: Generates a text file for each conversation exported from the review set.

  • 将导出的内容替换为修订的 PDF: 如果在审阅过程中生成修订的对话文件,则这些文件在导出过程中可用。Replace exported content with redacted PDFs: If redacted conversation files are generated during the review process, then these files are available during export. 可以通过不选择此选项) 来决定是仅导出本机文件 (,还是将本机文件替换为已修订版本的本机文件 (,方法为选择此选项) (导出为 PDF 文件)。You can decided whether to export only the native files (by not selecting this option) or to replace the native files with the redacted versions of the native files (by selecting this option), which are exported as PDF files.

详细信息More information

若要详细了解如何在高级电子数据展示中查看案例数据,请参阅以下文章:To learn more about how to review case data in Advanced eDiscovery, see the following articles: