Office 365™ Cloud Discovery Services

Smart, defensible cloud discovery

​Three-quarters of organizations today have adopted some degree of cloud computing technology. Among these popular technologies are cloud-based productivity and collaboration suites, such as Microsoft Office 365™, which create new data discovery opportunities challenges.​

How we can help

​Deloitte can assist your organization with e-discovery matters involving Office 365. We have proprietary and scalable cloud collection infrastructure, which support our collections, forensics, and analytics services, potentially allowing data to never have to leave the cloud. Use of our infrastructure, along with our defensible processes, can help you efficiently and defensibly process collected data into standard industry formats required for traditional processing and review.

Our phased approach

Cloud discovery and forensics

Deloitte evaluates what data exists in your Office 365 instance and works with you to determine what data needs to be held, analyzed, and collected, and what the cost and time considerations are for each step in the process. We help you define and scope a proportional discovery approach focused on reasonableness and add specificity in responding and objecting to document requests.

Our tools can provide a more sophisticated and tailored approach to discovery. These tools focus on maintaining legacy legal holds, managing future holds, data collection, data processing, and production of Office 365 source data, and have been used successfully to help many companies.

In our cloud discovery lab, we use our extensive forensic capabilities to identify, collect, and analyze data using Microsoft standard interfaces, thereby supporting sensitive investigations in a forensically sound manner.

These capabilities include:
  • Use of Office 365 Compliance Center tools and training of IT, legal, and compliance staff on the use of these tools
  • Collection of email (Exchange), documents (Office, One Drive, SharePoint), media, structured data (SQL Server), compute, and storage (Azure)
  • Forensic preservation of Web sites, user interfaces, and data obtained through application programming interfaces (API) such as Microsoft Graph for Office 365
  • Analysis of cloud artifacts, metadata, and network data for investigative purposes
  • Linkage of cloud-based data with locally collected data from laptops, servers, and mobile devices
  • Social media data mapping and advanced data analytics

Office 365 data processing

Collected data often ends up in a review platform to support discovery requests or investigations. Deloitte has the experience and tools to convert Office 365 data to most industry standard formats, including standard Concordance and Relativity load files. The load files contain all collected metadata, and they maintain linkage between structured and unstructured data.

Defensible disposition

A key part of information lifecycle management is the disposition of data that no longer needs to be retained. Deployment of a cloud platform may be an opportunity for your organization to revisit and refine its data management policies, including disposition.

We can also help:
  • Forensically collect data and associated metadata
  • Plan for the preservation and defensible disposition of Office 365 data
  • Archive data on standard evidence drives in a format that can be processed by Office 365 discovery tools or other leading discovery platforms

Get in touch

Sean Riley

Sean Riley

Principal | Deloitte Risk & Financial Advisory

Sean is a principal in the Discovery practice of Deloitte Transactions and Business Analytics LLP. He has more than 20 years of information technology experience, including data center operations, sys... More

Bryan Foster

Bryan Foster


As a principal in the Discovery practice and Legal Business Services practice of Deloitte Transactions and Business Analytics LLP, Bryan assists legal counsel in managing and conducting eDiscovery rea... More