Following Up on The Clues You're Looking at a Cloud Attachment and a Free Exchange Utility

How would a Reviewer identify that an "attachment" is from a link?

In this issue:

• Note on enabling Loop

• Cloud Attachment or Not?

• Using MFCMApi to investigate an Exchange Online mailbox

Before we get started looking at some Purview metadata fields and a tool I use to deep-dive into an Exchange Online mailbox to help me understand where the gaps are when it comes to doing eDiscovery from Exchange using the M65 native tools, I wanted to share this post from Tony Redmond on an undocumented change he discovered for enabling Loop. We have spent some time talking about Loop, and this does seem like an easier option than the official document I shared previously.

Cloud Attachment or Not?

The next bit of information I want to look at came to me as I was discussing linked attachments with Craig Ball in the comments of last week’s newsletter. I mentioned that while the edits of a document post being shared are likely not to change whether the document is responsive or not, as Craig rightly pointed out, I would still like to see the technology make it obvious to a reviewer that the attachment they are looking at has been edited, but in the meantime, we’d have to settle for educating attorneys about that fact using the clues that exist.

Today, I want to share the clues I would teach them, and take suggestions you may have:

1. If the review involves Teams messages, we can assume the attachment is always a cloud attachment, was always collected from the link today, and may have been edited.

   1. There’s no mechanism to attach a copy of a document to a Teams message, so unless the collecting party has been auto-tagging shared items, we can move forward assuming the attachment may have been edited. (Modified dates would confirm the latest date/time)

2. For email, we’re looking at a couple of fields that tell me that’s it a link and not an attachment, and that it has been edited: