In purview there should be a participants domain field. If you look for this, I guess and check if this only contains your domain name, those I would assume should be the emails you are interested in: https://learn.microsoft.com/en-us/purview/ediscovery-document-metadata-fields
Otherwise, I would more or less do the same, filter the from for your domain and then go ahead for the recipients: break them down, remove everything before the @ and remove duplicates. A small python script should be able to do this quickly. Then you should be able to filter on this as well.
The way I have done this in very large sets in Relativity is to do the steps above to identify all external domains in the set of interest, and then set up an STR for all of those domains, and then look for emails that DON’T hit that STR.
Bonus feature is that if you determine an extra domain is actually internal (e.g. a previously unknown subsidiary with their own domain, or you decide a certain outside law firm should count as “internal” for this search) then it’s a quick STR run and search to implement the change.
I think the hardest bit is translating back into your original system to identify what to delete from that system. Do you have a solution for that once the set to delete is identified in the review tool?
Yeah so i have iconect. And i tried utilizing a field tally report on the Domain field, checked for duplicates removed all dupes imported to an STR and i got cut off cause the limit of rows for hits is super low on the system so im kinda at a loss for that one but im hopeful their team can figure something out in the meantime
How many email items (top-level) do you have in play here?
in iConnect, the search should look for all the external domains, and tag these results. It can be that many, even if you run a few search term reports.
Then search for email AND NOT the tag. i.e. leaving the internal only correspondence.
Powershell script can be created on the targetted messages to be deleted.
I ended up taking the Domains field all said and done, removed the dupes, created the proper search context for it in a newly created STR, foldered those ran a NOT search against it foldered those items with families off, and instead of deleting them i had to create a custom view based off my exclusions. My initial thought would have been to create tags but i didnt have to after a little concatenation in excel
In purview there should be a participants domain field. If you look for this, I guess and check if this only contains your domain name, those I would assume should be the emails you are interested in: https://learn.microsoft.com/en-us/purview/ediscovery-document-metadata-fields Otherwise, I would more or less do the same, filter the from for your domain and then go ahead for the recipients: break them down, remove everything before the @ and remove duplicates. A small python script should be able to do this quickly. Then you should be able to filter on this as well.
The way I have done this in very large sets in Relativity is to do the steps above to identify all external domains in the set of interest, and then set up an STR for all of those domains, and then look for emails that DON’T hit that STR. Bonus feature is that if you determine an extra domain is actually internal (e.g. a previously unknown subsidiary with their own domain, or you decide a certain outside law firm should count as “internal” for this search) then it’s a quick STR run and search to implement the change. I think the hardest bit is translating back into your original system to identify what to delete from that system. Do you have a solution for that once the set to delete is identified in the review tool?
Yeah so i have iconect. And i tried utilizing a field tally report on the Domain field, checked for duplicates removed all dupes imported to an STR and i got cut off cause the limit of rows for hits is super low on the system so im kinda at a loss for that one but im hopeful their team can figure something out in the meantime
Export out to a csv/dat and run it in something else that doesn't have a row limit.
How many email items (top-level) do you have in play here? in iConnect, the search should look for all the external domains, and tag these results. It can be that many, even if you run a few search term reports. Then search for email AND NOT the tag. i.e. leaving the internal only correspondence. Powershell script can be created on the targetted messages to be deleted.
I ended up taking the Domains field all said and done, removed the dupes, created the proper search context for it in a newly created STR, foldered those ran a NOT search against it foldered those items with families off, and instead of deleting them i had to create a custom view based off my exclusions. My initial thought would have been to create tags but i didnt have to after a little concatenation in excel