I need to preserve and export mailboxes from two former employees for an active legal dispute. A small mailbox exported successfully through Purview, but a roughly 38 GB mailbox repeatedly fails when downloading large export chunks. I then tried syncing the mailbox to Outlook, creating an OST, repairing it with ScanPST, copying messages into a new PST, and manually dragging folders while offline. Different folders fail with attachment, corruption, private-item, or generic errors, and some manual approaches appear to remove messages from the mailbox.
A litigation hold has now been placed on the mailbox, but I'm concerned that continuing to manipulate the Outlook profile or convert the OST could compromise the evidence. I need a reliable way to preserve the mailbox, including recoverable or hidden items, and provide the relevant material to the legal team quickly. Should I keep troubleshooting Purview, use a specialist eDiscovery or forensic tool, or try an OST-to-PST converter?
4 Answers
Before assuming the mailbox itself is corrupt, check the export package and extraction process. Some Windows archive tools have trouble with Purview export packages or unusual attachments; 7-Zip may handle them better. Also verify that the destination uses NTFS or another filesystem that supports very large files, and split the collection into smaller exports instead of trying to create one enormous PST.
If the legal team specifically requires PST files, use a documented eDiscovery workflow or a validated conversion product after preserving the original collection. OST-to-PST tools can sometimes recover usable mail, but they should be treated as a last-resort recovery method, not as proof that the resulting PST is a complete and unmodified copy. Filtering private items or manually copying folders can also omit relevant data, so the scope should be approved by counsel first.
Stop making changes to the mailbox and hand this to an eDiscovery or forensic specialist. Manually moving, deleting, repairing, or converting messages can affect metadata and chain of custody, even if the goal is only to remove corrupted items. Preserve the original source, document everything already done, and let counsel or a qualified examiner determine the collection and export method.
Use Purview eDiscovery as the primary collection method rather than an Outlook OST or PST. Break the search into smaller date ranges, custodians, or batches if a large export fails, and preserve the original export packages and logs. Purview can also include recoverable and other hidden mailbox locations that a normal Outlook profile will not collect.
A client-side export may skip recoverable items or messages that do not sync cleanly. That makes it useful for ordinary mailbox migration, but risky as the authoritative legal collection.
That’s fair. The litigation hold is in place now, and I’m going to stop experimenting on the live mailbox until the legal team or an eDiscovery specialist confirms the next step.