SharePoint Server 的 eDiscovery 及就地保留概觀eDiscovery and in-place holds in SharePoint Server

摘要: 了解 SharePoint Server 2016 和 Exchange Server 2016、SharePoint Server 2013 和 Exchange Server 2013 之間的 eDiscovery,以及 eDiscovery Center、eDiscovery 案例、就地保留與匯出。Summary: Learn about eDiscovery across SharePoint Server 2016 and Exchange Server 2016, or SharePoint Server 2013 and Exchange Server 2013, and the eDiscovery Center, eDiscovery cases, in-place holds, and exports.

電子探索或「eDiscovery」是識別並傳送電子資訊的程序,電子資訊可當作辨識項使用。「eDiscovery Center」是網站集合的類型,可當作入口網站,用來管理 eDiscovery 案例。您可從這個中心位置探索 SharePoint 伺服器陣列的內容、Exchange Server 2013 或 Exchange Server 2016、檔案共用內容與其他 SharePoint 伺服器陣列的內容。您可將保留套用到您探索的 SharePoint 與 Exchange 內容。保留可確保將內容複本保留下來,同時仍能讓使用者使用內容。若您識別出必須傳送的指定項目,可依業界標準格式匯出。Electronic discovery, or eDiscovery, is the process of identifying and delivering electronic information that can be used as evidence. The eDiscovery Center, is a type of site collection that serves as a portal for managing eDiscovery cases. From this central location you can discover content in the SharePoint farm, in Exchange Server 2013 or Exchange Server 2016, on file shares, and in other SharePoint farms. You can apply a hold to SharePoint and Exchange content that you discover. The hold ensures that a copy of the content is preserved, while still allowing users to work with their content. When you have identified the specific items that you will have to deliver, you can export them in an industry-standard format.

管理 eDiscovery 案例Managing an eDiscovery case

收到 eDiscovery 新要求時,可在 eDiscovery Center 建立「eDiscovery 案例」。eDiscovery 案例是共同作業網站,您可用來整理 eDiscovery 要求的相關資訊。在 eDiscovery 案例內,您可搜尋內容,將保留套用到內容、匯出內容、檢視與案例相關聯的保留與匯出狀態。When you receive a new request for eDiscovery, you create an eDiscovery case in the eDiscovery Center. An eDiscovery case is a collaboration site that you can use to organize information related to the eDiscovery request. From within an eDiscovery case, you can search for content, apply a hold to content, export content, and view the status of holds and exports that are associated with the case.

eDiscovery 案例的兩個主要元件是「eDiscovery 集」與「查詢」。使用 eDiscovery 集可尋找內容並套用保留。使用查詢可尋找內容並匯出。The two primary components of an eDiscovery case are eDiscovery sets and queries. Use an eDiscovery set to find content and apply a hold. Use a query to find content and export it.

eDiscovery 程序流程eDiscovery process flow

eDiscovery 程序流程

若要尋找並保留內容,請建立 eDiscovery 集。每個 eDiscovery 集皆包含下列項目:To find and preserve content, create an eDiscovery set. Each eDiscovery set contains the following:

  • 來源,也就是搜尋的位置。Exchange 信箱、SharePoint 網站與檔案共用都可以是來源。Sources, which are locations to be searched. Exchange mailboxes, SharePoint sites, and file shares can all be sources.

  • 篩選條件,定義您可搜尋的內容。篩選條件可包含搜尋字詞、日期範圍與作者名稱。A filter, which defines what you are searching for. A filter can include search terms, a date range, and an author's name.

  • 此選項可將就地保留套用到內含符合篩選條件的內容來源。An option to apply an in-place hold to the sources that contain content that matches the filter.

若要尋找並匯出內容,請建立查詢。每個查詢皆包含下列項目:To find and export content, create a query. Each query contains the following:

  • 查詢篩選條件,定義您可搜尋的內容。查詢篩選條件類似 eDiscovery 集的篩選條件,可包含搜尋字詞、日期範圍與作者名稱。但是,查詢的查詢篩選條件也可使用詞幹分析。Query filters, which define what you are searching for. Query filters resemble a filter in an eDiscovery set, and can include search terms, a date range, and an author's name. However, query filters in a query can also use stemming.

  • 要搜尋的來源。Exchange 信箱、SharePoint 網站、檔案共用與 eDiscovery 集都可以是查詢的來源。Sources to be searched. Exchange mailboxes, SharePoint sites, file shares, and eDiscovery sets can all be sources in a query.

執行查詢時,您可查閱找到的項目相關統計資料,您可預覽結果,也可依訊息類型 (適用於 Exchange 結果) 或篩選類型 (適用於 SharePoint 結果) 篩選結果。完成後,您可匯出查詢結果。When you run a query, you can see statistics about the items that were found, you can preview the results, and you can filter the results by message type (for Exchange results) or by file type (for SharePoint results). When you are finished, you can export the results of the query.

您使用查詢匯出的內容已根據 Electronic Data Reference Model (EDRM) 規格格式化,因此可匯入複查工具。匯出可包含下列項目:The content that you export by using a query is formatted according to the Electronic Data Reference Model (EDRM) specification so that it can be imported into a review tool. An export can include the following:

  • 文件:檔案共用會匯出文件。SharePoint Server 會匯出文件與其版本。Documents: Documents are exported from file shares. Documents and their versions can be exported from SharePoint Server.

  • 清單:若清單項目包含在查詢結果中,完整清單會匯出成逗點分隔值 (.csv) 檔案。Lists: If a list item is included in the query results, the whole list is exported as a comma-separated values (.csv) file.

  • 頁面:SharePoint 頁面,例如 Wiki 頁面或部落格並匯出為 MIME HTML (.mht) 檔案。Pages: SharePoint pages, such as wiki pages or blogs, are exported as MIME HTML (.mht) files.

  • Exchange 物件:Exchange Server 信箱的項目,例如工作、行事曆項目、連絡人、電子郵件訊息與附件都會匯出成 .pst 檔。如果 商務用 Skype 對話封存在 Exchange 中,這些對話也可搜尋並匯出。Exchange objects: Items in an Exchange Server mailbox, such as tasks, calendar entries, contacts, email messages and attachments are exported as a .pst file. If Skype for Business conversations are archived in Exchange, those can be discovered and exported, too.

  • 編目記錄錯誤。Crawl log errors.

  • 提供匯出資訊概觀的 XML 資料清單。An XML manifest that provides an overview of the exported information.

eDiscovery 如何在 SharePoint 產品中運作How eDiscovery works in SharePoint products

Search Service 應用程式是 SharePoint Server 搜尋系統的主要元件。您可讓 eDiscovery Center 與 Search Service 應用程式建立關聯。由 Search Service 應用程式編製索引的所有內容都可在 eDiscovery Center 找到。如果您設定 Search Service 應用程式進行編目檔案共用,可使用 eDiscovery Center 尋找檔案共用的內容。若您設定 Search Service 應用程式編目其他網站 (例如使用 SharePoint Server 2010 建立的小組網站),則可使用 eDiscovery Center 尋找該網站的內容。如果是 SharePoint Server 伺服器陣列,您也可以保留內容。如果將 Exchange Server 新增至 Search Service 應用程式作為結果來源,即可從 eDiscovery Center 尋找 Exchange 信箱內的內容,並將信箱予以保留。如果將 商務用 Skype 的內容封存在 Exchange 中,您也可尋找 商務用 Skype 內容。The Search service application is a key component of the search system in SharePoint Server. You can associate an eDiscovery Center with a Search service application. Any content that's indexed by the Search service application can be discovered from the eDiscovery Center. If you configure the Search service application to crawl file shares, you can use the eDiscovery Center to discover content on the file shares. If you configure the Search service application to crawl other websites - for example, a team site that was created by using SharePoint Server 2010 - you can use the eDiscovery Center to discover content on the websites. For SharePoint Server farms, you can also put the content on hold. If you add Exchange Server to the Search service application as a result source, you can discover content within Exchange mailboxes from the eDiscovery Center and put the mailboxes on hold. If you archive content from Skype for Business in Exchange, you can also discover Skype for Business content.

如果您的環境包含兩個獨立的 Search Service 應用程式 (例如 SharePoint Online 與 SharePoint Server 内部部署),您必須要有兩個 eDiscovery Center 才能尋找整個伺服器陣列的內容。If your environment includes two isolated Search service applications - for example, SharePoint Online and SharePoint Server on-premises - you need to have two eDiscovery Centers to discover content across the farms.

獨立的 Search Service 應用程式皆有單獨的 eDiscovery Center。A separate eDiscovery Center for each isolated Search service application.

適用於每個搜尋服務的個別探索中心

「搜尋」系統編目內容時,會建立「搜尋索引」。搜尋索引會儲存資料,用於提供搜尋查詢的結果。搜尋索引也會儲存存取各份內容時所需的權限相關資訊。使用者執行搜尋時,搜尋系統會使用搜尋索引來識別適當的搜尋結果。顯示結果前,Search Service 應用程式會執行「安全性調整」,透過這個程序,系統會將使用者權限與存取搜尋結果連結內容所需的權限互相比較,然後「整理」結果,並對使用者僅顯示其有權限檢視的結果。As the Search system crawls content, it creates a search index. The search index stores data that's used to provide the results for search queries. The search index also stores information about the permissions that are required to access each piece of content. When a user performs a search, the search system uses the search index to identify the appropriate search results. Before displaying the results, the Search service application performs security trimming, by which the system compares the user's permissions to the permissions that are required to access content that search results link to, and then "trims" the results to show only those results that the user has permissions to view.

就地保留In-place holds

SharePoint Server 2013 導入了 就地保留的概念。當您將就地保留套用到網站時,網站的內容仍會保留在原始位置。使用者仍可使用內容,但您當初啟動保留時的內容會保留一份複本下來。此外,如果將就地保留套用到網站,任何在網站被設為保留後才在網站中新增或建立的新內容將可被探索到,且如果遭到刪除也會被保留下來。此外,使用者不需要知道其內容會加以保留。SharePoint Server 2013 introduced the concept of an in-place hold. When you apply an in-place hold to a site, content in the site remains in its original location. Users can still work with the content, but a copy of the content as it was at the time that you initiated the hold is preserved. Additionally, if an in-place hold is applied to a site, any new content that's created or added to the site after it was put on hold will be discoverable, and will be preserved if it's deleted. Also, users don't have to know that their content is on hold.

重要

如果執行 SharePoint Server 的伺服器是使用備用存取對應 (AAM)、主機命名型網站集合或 SSL 終止格式,使用者將無法編輯已套用就地保留的網站之中的網頁。若要允許使用者對所保留網站中的網頁進行編輯,您需要依知識庫文章 896861 中的第 2 個方法所述,停用回送檢查。If SharePoint Server runs on a server that uses Alternate Access Mapping (AAM), host-named site collections, or SSL termination format, then users will not be able to edit web pages in a site that has an in-place hold applied. To allow users to edit pages in sites that are on hold, you need to disable loopback checking as described in Method 2 of KB article 896861.

就地保留會套用到網站層級。若要保留 SharePoint 網站,系統會建立「保留程式庫」(若不存在)。只有網站集合管理員才看得到文件保留庫,因此大部分使用者無法檢視。搜尋編目程式也有特殊權限,可編目文件保留庫的內容。An in-place hold is applied at the level of a site. When a hold is placed on a SharePoint site, a preservation hold library is created, if one doesn't already exist. The preservation hold library is only visible to site collection administrators so most users can't view it. The search crawler also has special permissions to crawl content in the preservation hold library.

注意

有一種情況使用者可檢視保留程式庫。授與 Web 應用程式層級之權限的使用者才可以檢視 Web 應用程式內所有網站集合的所有內容。There is one case in which a user can view the preservation hold library. Users who are granted permissions at the web application level can view all content in all site collections within the web application. For more information about permissions and eDiscovery, see Plan for eDiscovery.

若使用者嘗試修改或刪除保留的網站內容,SharePoint 會先檢查從套用保留後,內容是否已經過修改。如果這是套用保留後的第一次修改,SharePoint 會將內容複製到文件保留庫,然後允許使用者修改或刪除原始內容。請注意,網站中的所有內容皆可複製到文件保留庫,即使內容與啟用保留的 eDiscovery 集篩選條件不相符也一樣。If a user attempts to modify or delete content in a site that's on hold, SharePoint first checks whether the content has been modified since the hold was applied. If this is the first modification since the hold was applied, SharePoint copies the content to the preservation hold library, and then allows the user to modify or delete the original content. Note that any content in the site can be copied to the preservation hold library, even if the content doesn't match the filter of the eDiscovery set that initiated the hold.

如果使用者嘗試刪除文件庫、清單或保留的網站集合,就會收到錯誤。如果使用者嘗試刪除的資料夾包含已保留檔案,也會收到錯誤。如果使用者想要刪除的資料夾包含一個或多個保留的檔案,他們必須先將這些檔案刪除後,才能將資料夾刪除。A user receives an error if they try to delete a library, list, or site collection that's on hold. Users also receive an error if they try to delete a folder that contains a file that's on hold. If users want to delete a folder that contains one or more files that are on hold, they have to delete those files before they can delete the folder.

保存處理和報告計時器工作會產生保留項目的相關報告,並從暫止發行的保留程式庫中移除項目。每天都會執行計時器工作,並在 SharePoint Server 中處理 eDiscovery。The Hold Processing and Reporting timer job generates reports about items on hold and removed item from hold libraries that are pending release. The timer job runs daily and processes eDiscovery in SharePoint Server.

在規劃就地保留時,請考量下列事項:Consider the following when planning for in-place holds:

  • 若要替網站中的內容儲存所有版本,您需要對網站中的文件庫啟用文件版本設定。如需版本設定的詳細資訊,請參閱<啟用和設定清單或文件庫的版本設定>。To store all versions of content in a site, you have to enable document versioning for the document libraries in the site. For more information about versioning, see Enable and configure versioning for a list or library.

  • 如果從保留的網站中刪除文件,而文件版本設定已啟用,則會保留所刪除文件的所有版本。If a document is deleted from a site that's on hold and document versioning is enabled, all versions of the deleted document will be preserved.

  • 如前所述,如果保留網站,則保留網站之後在網站中建立或新增的任何新內容一旦遭刪除,就會被保留。As previously mentioned, if a site is put on hold, any new content that's created or added to the site after it was put on hold will be preserved if it's deleted.

  • 如果文件版本設定未啟用,而且某個項目保留多次,則 SharePoint 會保留每次保留所使用的版本。例如,假設項目的第 27 版是第一次保留網站時所使用的版本,第 51 版是第二次保留時所使用的版本,則第 27 版與第 51 版將保留下來。If document versioning isn't enabled and an item is placed on hold multiple times, SharePoint preserves the version that's current at the time each hold is placed. For example, if version 27 of an item is the most recent when the site is placed on hold the first time, and version 51 is the most recent when the site is placed on hold the second time, versions 27 and 51 are preserved.

  • 實作就地保留時,會有效地運用存放空間。多數網站內容並未變更,未變更的內容不會複製到保留程式庫。Storage space is used efficiently when an in-place hold is implemented. Most content in a site does not change, and content that's not changed is not copied to the preservation hold library.

與 Exchange 整合Integration with Exchange

您可從 SharePoint eDiscovery Center 管理 Exchange Server 2013 和 Exchange Server 2016 的探索程序。您可執行下列動作:You can manage the discovery process for Exchange Server 2013 and Exchange Server 2016 from a SharePoint eDiscovery Center. You can do the following:

  • 加入 Exchange 信箱,當作 eDiscovery 集或查詢的來源。Add Exchange mailboxes as sources to either an eDiscovery set or a query.

  • 預覽在 Exchange 信箱找到的內容。Preview content that's discovered in an Exchange mailbox.

  • 將保留套用到 Exchange 信箱。Apply a hold to an Exchange mailbox.

  • 匯出在 Exchange 信箱找到的內容。Export content that's discovered in an Exchange mailbox.

如果要在 Exchange 信箱找到內容,您必須先在 SharePoint 與 Exchange 間設定信任關係。同時也必須授與 eDiscovery Center 使用者特殊的 Exchange 權限。如需這些工作的詳細資訊,請參閱<在 SharePoint 中設定 eDiscovery>。To discover content in Exchange mailboxes, you must first configure a trust relationship between SharePoint and Exchange. You must also grant specific Exchange permissions to the users of the eDiscovery Center. For more information about these tasks, see Configure eDiscovery in SharePoint Server.