I need to preserve and export mailboxes from two former employees for an active lawsuit. One mailbox exported successfully through Purview, but the other is roughly 38 GB and repeatedly fails during large PST exports with errors involving unsupported attachments, corrupt folders, private items, and generic failures.
I tried downloading the mailbox through Purview, syncing it to Outlook Classic, creating a full OST, running SCANPST, copying folders into a new PST, and manually dragging messages while the test computer was offline. Some operations work temporarily, but others stop after a few messages or fail on folders that appear empty. I'm concerned that continuing to manipulate the mailbox could alter the evidence or allow changes to sync back to Microsoft 365.
A litigation hold has now been placed on the mailbox. What is the safest and most defensible way to preserve and export the data? Should I keep troubleshooting Purview, use a specialist e-discovery tool or examiner, restore from a backup, or consider an OST-to-PST converter?
5 Answers
Use Purview eDiscovery with the appropriate hold and export workflow rather than Outlook’s local cache. A client-generated OST or PST may omit hidden and recoverable folders, including deleted or purged content, and it does not provide the same level of defensibility. If the export fails, split the collection into smaller date ranges, custodians, or queries and preserve the export logs.
The key question is not just how to create a PST; it’s what the attorneys and processing platform actually require. Some workflows accept individual messages or a provider-native export instead of one huge PST. Confirm the required scope, format, hidden-folder requirements, and handling procedure with counsel or the e-discovery vendor before spending more time on unsupported Outlook workarounds.
Breaking the request into smaller time periods can help with technical limits, but it should be done as part of the documented collection plan rather than by manually dragging messages between folders.
Stop making changes to the live mailbox and bring in an e-discovery or digital-forensics specialist. Manually moving messages, deleting items that cause export errors, repairing an OST, or converting formats can undermine the evidence and make chain of custody difficult to defend. Preserve the original source, document every action, and let the legal team decide what format and scope are required.
That’s fair. I placed the litigation hold and disconnected the test profile, but I’m going to stop experimenting with the mailbox itself and get the legal team involved before doing anything else.
If the organization has a Microsoft 365 backup or archive product, ask whether it can produce a point-in-time mailbox export. That may avoid relying on a partially synchronized Outlook profile, but it still needs to be handled under the legal hold and documented as an evidence collection. A commercial OST/PST converter might recover readable mail, but it should not be treated as the primary litigation collection method without validation.
Large exports often fail because of individual oversized or malformed messages, problematic attachments, private items, or a damaged mailbox object. Those issues may explain why copying folders appears to work while a complete export does not. Don’t simply remove the troublesome items from the source; identify and isolate them through the approved discovery process so the exceptions are documented and preserved.
Also check whether the downloaded export archive is being opened with a tool that supports it. Some built-in archive utilities report valid Purview exports as corrupt, while a compatible extractor may open them normally.