Export Content Search results from the Office 365 Security & Compliance Center

After a Content Search is successfully run, you can export the search results to a local computer. When you export email results, they're downloaded to your computer as PST files. When you export content from SharePoint and OneDrive for Business sites, copies of native Office documents are exported. There are additional documents and reports that are included with the exported search results. See the More information section in this topic for a description of each of these export-related documents.

Exporting the results of a Content Search involves preparing the results, and then downloading the results to a local computer.

Step 1: Prepare search results for export

Step 2: Download the search results

Before you begin

  • To export search results, you have to be assigned the Export management role in the Office 365 Security & Compliance Center. This role is assigned to the built-in eDiscovery Manager role group. It isn't assigned by default to the Organization Management role group. For more information, see Assign eDiscovery permissions in the Office 365 Security & Compliance Center.

  • See the More information section for a description of the limits for exporting search results.

  • The maximum size of a PST file that can be exported is 10 GB. If you want to change this default size, you can edit the Windows Registry on the computer that you use to export the search results. See Change the size of PST files when exporting eDiscovery search results.

  • When you export search results, the data is temporarily stored in a unique Windows Azure storage area in the Microsoft cloud before it's downloaded to your local computer. Be sure your organization can connect to the endpoint in Azure, which is *.blob.core.windows.net (the wildcard represents a unique identifier for your export). The search results data is deleted from the Azure storage area two weeks after it's created.

  • The computer you use to export the search results has to meet the following system requirements:

    • 32- or 64-bit versions of Windows 7 and later versions

    • Microsoft .NET Framework 4.5

    • A supported browser:

      • Internet Explorer 10 and later versions

        OR

      • Mozilla Firefox or Google Chrome, with the ClickOnce add-in installed

Step 1: Prepare search results for export

The first step is to prepare the search results for exporting. When you prepare results, they are uploaded to an Azure storage area in the Microsoft cloud.

  1. Go to https://protection.office.com.

  2. Sign in to Office 365 using your work or school account.

  3. In the left pane of the Security & Compliance Center, click Search & investigation > Content search.

  4. On the Content search page, select a search.

  5. In the details pane, under Export results to a computer, click Start export.

    Note: If the results for a search are older than 7 days, you are prompted to update the search results. If this happens, cancel the export, click Update search results in the details pane for the selected search, and then start the export again after the results are updated.

  6. On the Export the search results page, under Include these items from the search, choose one of the following options:

    • Export only indexed items

    • Export indexed and unindexed items

    • Export only unindexed items

    For more information about what these options mean, see Unindexed items in Content Search.

  7. Under Export Exchange content as, choose one of the following options:

    • One PST file for each mailbox   Exports one PST file for each user mailbox that contains search results. Any results from the user's archive mailbox are included in the same PST file.

    • One PST file containing all messages    Exports a single PST file (named Exchange.pst) that contains the search results from all source mailboxes included in the search.

      Note: As previously stated, the maximum size of a PST file that can be exported is 10 GB. For both of these options, the search results will be exported in one or more PST files, based on the total size of the search results. If you chose to export the search results in one PST file, the search results from a specific mailbox won't be divided among multiple PST files unless the content from a single mailbox is more than 10 GB.

    • Individual messages    Exports search results as individual email messages, using the .msg format. If you select this option, email search results are exported to a folder in the file system. The folder path for individual messages is the same as the one used if you exported the results to PST files.

  8. Click the Include versions for SharePoint documents to export all versions of SharePoint documents. This option appears only if the content sources of the search includes SharePoint or OneDrive for Business sites.

  9. Click the Enable de-duplication checkbox to exclude duplicate messages. This option appears only if the content sources of the search includes Exchange mailboxes or public folders.

    If you select this option, only one copy of a message will be exported even if multiple copies of the same message are found in the mailboxes that were searched. The export results report (Results.csv) will contain a row for every copy of a duplicate message so that you can identify the mailboxes (or public folders) that contain a copy of the duplicate message. See the More information section for a description of how duplicate messages are identified in the Results.csv log.

  10. Click Start export.

    The search results are prepared for downloading, which means they're being uploaded to the Azure storage area in the Microsoft cloud. When the search results are ready for download, the Download exported results link is displayed under Export results to a computer in the details pane.

Return to top

Step 2: Download the search results

The next step is to download the search results from the Azure storage area to your local computer.

  1. In the details pane for the search that you started the export for, under Export results to a computer, click Download exported results.

    The Download exported results window is displayed and contains the following information about the search results that will be downloaded to your computer.

    • The number of items that will be downloaded.

    • The estimated total size of the items that will be downloaded.

    • Whether indexed or unindexed will be exported. Unindexed items are items that have an recognized format, are encrypted, or weren't indexed for other reasons. For more information, see Unindexed items in Content Search.

    • Whether or not versions of SharePoint documents will be downloaded.

    • The status of the export preparation process. You can start downloading search results even if the preparation of the data isn't complete.

  2. Under Export key, click Copy to clipboard. You will use this key in step 5 to download the search results.

    Important: Because anyone can install and start the eDiscovery Export tool, and then use this key to download the search results, be sure to take precautions to protect this key just like you would protect passwords or other security-related information.

  3. Click Download results.

  4. If you're prompted to install the MicrosoftOffice 365 eDiscovery Export Tool, click Install.

  5. In the eDiscovery Export Tool, paste the export key that you copied in step 2 in the appropriate box.

  6. Click Browse to specify the location where you want to download the search result files.

  7. Click Start to download the search results to your computer.

    The eDiscovery Export Tool displays status information about the export process, including an estimate of the number (and size) of the remaining items to be downloaded. When the export process is complete, you can access the files in the location where they were downloaded.

Return to top

More information

  • Exporting search results from the Security & Compliance Center has the following limits:

    • You can export a maximum of 250 GB of data from a single Content Search. If the search results are larger than 250 GB, consider using date ranges or other types of filters to decrease the total size of the search results.

    • The maximum size of a PST file that can be exported is 10 GB by default. That means if the search results from a user's mailbox are larger than 10 GB, the search results for the mailbox will be exported in two (or more) separate PST files. Additionally, if you choose to export all search results in a single PST file, the PST file will be spilt into additional PST files if total size of the search results is larger than 10 GB. If you want to change this default size, you can edit the Windows Registry on the computer that you use to export the search results. See Change the size of PST files when exporting eDiscovery search results.

    • An organization can export a maximum of 2 TB of data during a single day, and can export a maximum of 10 TB of data during a single week.

    • You can have a maximum of 10 exports running at the same time within your organization.

    • A single user can run a maximum of three exports at the same time.

  • When you export search results, the following reports are included in addition to the search results.

    • Export Summary   An Excel document that contains a summary of the export. This includes information such as the number of content sources that were searched, the estimated and downloaded sizes of the search results, and the estimated and downloaded number of items that were exported.

    • Manifest   A manifest file (in XML format) that contains information about each item included in the search results.

    • ResultsLog   An Excel document that contains information about each item that is download as a search result. For email, the result log contains information about each message, including:

      • The location of the message in the source mailbox (including whether the message is in the primary or archive mailbox).

      • The date the message was sent or received.

      • The Subject line from the message.

      • The sender and recipients of the message.

      • Whether the message is a duplicate message if you enabled de-duplication when exporting the search results. Duplicate messages will have a value in the Parent ItemId column that identifies the message as a duplicate. The value in the Parent ItemId column is the same as the value in the Item DocumentId column of the message that was exported.

      For documents from SharePoint and OneDrive for Business sites, the result log contains information about each document, including:

      • The URL for the document.

      • The URL for the site collection where the document is located.

      • The date that the document was last modified.

      • The name of the document (which is located in the Subject column in the result log).

    • Unindexed Items   An Excel document that contains information about any unindexed items that would be included in the search results. If you don't include unindexed items when you generate the search results report, this report will still be downloaded, but will be empty.

    Note: You can just export these documents without having to export the actual search results. See Export a Content Search report.

  • All search results and the export reports are included in a folder that has the same name as the Content Search. The email messages that were exported are located in a folder named Exchange. Documents are located in a folder named SharePoint.

  • The file system metadata for documents on SharePoint and OneDrive for Business sites is maintained when documents are exported to your local computer. That means document properties, such as created and last modified dates, aren't changed when documents are exported.

  • Keep the following things in mind when you export email search results as individual (.msg) messages:

    • If the file path name of a message exceeds the maximum character limit for Windows, the file path name is truncated. But the original file path name will be listed in the Manifest and ResultsLog.

    • As previously explained, email search results are exported to a folder in the file system. The folder path for individual messages would replicate the folder path in the user's mailbox. For example, for a search named "ContosoCase101" messages in a user's inbox would be located in the folder path ~ContosoCase101\<date of export\Exchange\user@contoso.com (Primary)\Top of Information Store\Inbox.

Return to top

Share Facebook Facebook Twitter Twitter Email Email

Was this information helpful?

Great! Any other feedback?

How can we improve it?

Thank you for your feedback!

×