Security and Compliance eDiscovery message read column not accurate
When we run a Ediscovery report on user that has had account compromised or Legal hold. Legal wants to know if certain messages have been read. Support is saying that the report is not reliable. Need the ability as admin to see if an email was read and when.
Unfortunately, the ‘Is Read’ column in the Export file ‘Results.csv’ is not a fully reliable way to know if an email or document was read by an end user. There are several reasons for that:
- Depending on the email client application, one can read, and then mark the message as Un-read, and then perform the Export and Download of the mailbox. In this case the ‘Is Read’ column will be “FALSE” but the message would have been read.
- One can use or write an email client that downloads emails and attachments from the Exchange server to local machine, disconnects from server and Internet, and read them offline. In this case the ‘Is Read’ column will be “FALSE” for all these docs, but they have actually been read (in this case the messages would be marked as Delivered but not necessarily as Read).