How eDiscovery works within SharePoint 2013 is fairly straightforward. It is possible to associate an eDiscovery Center with a search service application. The content is indexed by the search service application and then it can be found by the eDiscovery Center.
When you configure the search service application to crawl file share you will also be able to use it to discover the content of the file shares. You can create a connection to the search service application from Office SharePoint Server 2007, Windows SharePoint Services 3.0 farms, SharePoint 2010 Product farms, and SharePoint 2013 farms.
When you add Exchange Server 2010 to the search service application, you will discover content with Exchange mailboxes from the eDiscovery Center and you can put them on hold. If you archive content from Lync in Exchange, you will also be able to discover Lync content. If your environment offers two isolated search service applications, you must have two eDiscovery Centers in order to discover content across the farms.
With SharePoint Server 2013, you will be introduced to the concept of in place hold. By applying such a hold to a site, your content in those sites will remain in their original location. A user will still have the ability to work with the content but a copy of it will also be placed on hold and preserved. This is a different type of hold style for SharePoint Server 2010. In that version, a user didn’t have the option to change or remove content when it was on hold. The use of in place holds in SharePoint Server 2013 means that other users don’t even have to know if there is a hold in place or not.
An in place hold can be applied at the level of a site, and the preservation hold library is created if one isn’t already in place. Most of the time, users aren’t permitted to view the preservation hold library. It will only be something that site collection administrators are able to access. The search crawler has special permissions to be able to crawl the content in the preservation hold library.
There are circumstances where a user is able to view the preservation hold library. For example, when users are granted permission from the web application level to view all of the content in all site collections within that particular web application.
When a user attempts to change or remove content in a site that is on hold, SharePoint is going to check to see if the content has changed since that hold was applied. If this is the only modification that has occurred since the hold was implemented, then SharePoint will copy the content to the preservation hold library. This makes it possible for the user to then change or remove from the original content.
Any content that is on the site can be copied to the preservation hold library. This includes the content that doesn’t match the filter of the eDiscovery set where that hold originated from. This is true even if the content isn’t a match to the filter of that eDiscovery set that the hold initiated from.
The Information Management Retention timer will clean up and preserve the hold library. There is a timer that runs periodically and compares all of the content in the preservation hold library to the filters for the eDiscovery sets that have put the site on hold. If the content doesn’t match one or more of the filters, the timer job deletes the content from the preservation hold library. There are two important things to keep in mind through this process. The version of content that is current at the time when the hold was applied is the only version that is saved. And if the content is changed several times, then the versions in the middle won’t be preserved.
This allows the overall storage capacity to be used efficiently and most of the time the content in the site won’t change. If it isn’t changed, then it won’t be copied to the preservation hold library.