Why Searching Outlook Isn't a Defensible Document Review

A mailbox search finds what one person can see. Discovery asks for the rest.

Searching Outlook for discovery documents is not a defensible review. It is a search of one place, and discovery rarely lives in one place. A 2026 article in the American Bar Association's Law Technology Today listed what Microsoft Copilot can reach for a single user. The list ran to email "going back years," Teams messages and meeting recordings, OneDrive files, and SharePoint libraries across every site that user can see. Outlook's search box was built for the first item on that list.

The same article cited Wolters Kluwer's 2026 Future Ready Lawyer Survey, which found that over 90% of legal professionals use at least one AI tool daily. Lawyers are not short of software. A second 2026 piece in the same publication said the firms getting real value from AI had made verification a documented workflow step, with a named reviewer and a checklist. A defensible review is one whose collection, culling and coding can be explained afterward, step by step, to a party who would prefer it had gone badly.

Set that Copilot list beside an Outlook search and ask how many of those places the search actually opened. The results look complete. Deleted items, other custodians, duplicates and threads simply never arrive, and an export can change the metadata it was supposed to carry. Even the newer AI review tools, which judge each document alone against one set of instructions, inherit whatever the collection quietly left behind.

Can You Just Search Outlook for Discovery Documents?

No. Outlook search is built to retrieve a remembered email, not to support a review, and the manual sorting it leaves behind is priced like manual review: roughly $19K per gigabyte.

A defensible review is one whose scope, method and results can be explained, step by step, to opposing counsel or a judge. Before relying on any mailbox search, I would ask three questions:

1. Can you show in writing what was searched, when, and by whom?
2. Does the set cover every custodian and every held item, or only one person's mailbox?
3. Were duplicates and threads handled, so the same message is coded once and coded the same way?

If any answer is no, the search found email. It did not review it.

A 2025 thread on r/ediscovery shows how quietly this goes wrong. The poster, an attorney with 20 years of practice, explained that the organization exported the entire result set as a PST and left the attorneys to sort it in Outlook, "which is obviously not a review tool." The IT person then said Purview could not run a single search for emails meeting either of two conditions. What was offered instead was two separate searches, with "potentially enormous overlap." One commenter asked the only question that mattered: "If that person is ever deposed as a records custodian what are they going to say?"

Nothing in that exchange was dramatic. A search was refused, then split in two, then handed to an email client. Combining 4 sources points to one pattern: the expensive part of email discovery is seldom finding the messages, it is proving later how they were found.

The common assumption is that a search which returns the right messages has done the work of review. It has not. It has produced a pile, and a pile keeps no memory of how it was made. A kitchen drawer behaves the same way. Finding the receipt you wanted says nothing about what else was in the drawer, or who emptied it last week.

Our platform starts from the opposite end. Originals are immutable and content-hashed, audit trails are append-only, chain of custody is documented, and a fail-closed privilege gate sits in front of production, so the process holds up if opposing counsel challenges it. Enterprise platforms supply that spine; newer AI tools supply cited answers and chronologies. Relevant e-Discovery was built to be both at once, which matters most to firms that have learned a small case is rarely a small review job.

The harder question, which the r/ediscovery thread never quite reached, is what a mailbox search leaves out even when it runs exactly as intended, and Microsoft's own tooling turns out to have a few answers of its own.

What Does a Native Mailbox Search Leave Out?

A native search leaves out held and deleted items, other custodians, and any trail back to source; a proper review links every answer to the exact exhibit it came from.

A native search is a query run inside the email client itself, Outlook or Gmail, against whatever that client happens to display. Three gaps open at once:

• Moved and deleted items. On a mailbox under hold, anything the user moves or deletes is kept in Recoverable Items, outside the ordinary folders, and is retrieved through Purview.
• Other custodians. A mailbox search covers one mailbox. Discovery requests rarely stop there.
• Preservation. Finding an email does not preserve it.

An IT administrator posting to r/ediscovery in May 2025 ran into all three. The organization received such requests about 4-5 times a year, and requestors wanted "any and all mailboxes and sites held that contain the name, email or phrase." A search alone, the poster wrote, had been tried and was "not good enough due to the legal structure." Then the Purview screen allowed only 100 users to be selected for a hold, although Microsoft's documentation, as the poster read it, allowed 2,000 user mailboxes and 2,000 sites in a single hold.

Contrary to how the screen presented it, 100 was not a ceiling. A commenter explained that it was an auto-populated preview, and that more users could be added by searching for them by hand or through PowerShell. Another warned of "severe sanctions in U.S. Federal and State courts" when a hold goes wrong. A third thought Recoverable Items storage was capped at 110GB, enough for a long-tenured custodian to fill.

None of this is exotic. It is the ordinary weather of email discovery. A screen that misstates its own limits will not warn you about what it skipped.

One commenter even offered an untested PowerShell script for bulk holds. Improvised tooling usually begins this way, and home-built review tools tend to break just as quietly, in places nobody thought to check.

Our answer to the source problem is structural. Every output links back to the exact exhibit it came from, so an attorney can verify it with one click before filing, which is the direct answer to the sanctions risk seen in Mata v. Avianca. Where that work runs matters as much. We deploy inside the client's own AWS account, under the client's own keys, a trust posture no consumer AI tool and almost no small-firm tool can match.

The fair test is not a brochure. Relevant e-Discovery asks buyers to bring a messy collection and a hard question, then watch the system read, code and cite their own evidence.

And even a hold that works leaves a second problem in place: the same email, kept in several mailboxes, arrives in the review once for every mailbox that kept it.

What Turns an Email Search Into a Defensible Review?

Move the review into a platform that de-duplicates, threads and logs every step, and keep processing single-tenant or inside your own AWS account, with no vendor retention or model training.

Three steps separate a pile of search hits from a review that can be explained:

1. Collect every relevant custodian, held items included, into one matter instead of one mailbox at a time.
2. De-duplicate and thread the set before anyone codes a document.
3. Record the terms, dates, custodians and exclusions, then validate the results by sampling.

The vocabulary for this already exists. On the Emerging Litigation Podcast in 2024, data scientist Lenora Gray described de-duplication as replacing identical copies with one representative copy, culling as cutting a collection by date range, file type or keyword, and de-NISTing as removing system files. She also explained technology-assisted review (TAR): attorneys code a small set of documents, and an algorithm builds a statistical model, called a classifier, that predicts coding for the rest and attaches a confidence level to each prediction.

Certification is the part a court cares about. Gray explained in 2024 that TAR was usually certified to the other side by random sampling and statistical estimation, in a sentence such as "We recovered at least 80% of the relevant documents from this collection." In 2024, Gray said, e-discovery standards usually required around 80% recall.

The same interview described a head-to-head test, run with a single prompt and no matter-specific tuning, that scored contract attorneys and generative AI against senior-attorney coding. In that 2024 account, the AI found 96% of the relevant documents against 54% for the humans, while its precision was 60% against 91%.

Recall measures what you found. Precision measures what you paid to read. An Outlook search produces neither number.

One review-software vendor makes the procedural point bluntly in its own marketing: under FRCP Rule 30, the opposing party can seek discovery about a party's collection, processing, review and production workflows, and a review platform should propagate tags to duplicates and batch threaded emails with their attachments. The same guide points to the conference that Rule 26(f) requires, where the parties should negotiate search terms and settle preservation, production and privilege questions before the review begins.

Where the processing happens is the last question, and often the first one a client asks. Our processing runs single-tenant, or in your own AWS account under your own keys, so nothing you feed it trains anyone's model or waives privilege. We built it for the solo or small firm with one messy matter and no administrator, the segment Relativity and Everlaw price out, which is why per-matter and annual platform pricing deserve a careful comparison before anyone signs.

On a 2026 podcast, a forensic technology director whose firm sells AI review services asked whether the lawyers understood a method well enough to put it in an affidavit, and a defensible review is one that passes that test. It is a recorded process that collects, de-duplicates, threads and samples, and that someone can explain under oath.

Where Does Email Discovery Go After the Mailbox Search?

Toward documented, multi-source collections reviewed in dedicated tools, where a mailbox search with no written record of terms, dates and custodians behind it grows steadily harder to defend.

In 2019 an Office 365 administrator wrote that every discovery request they received was answered through Content Search alone. By 2026, practitioners advising on Outlook mail were telling colleagues to avoid normal Outlook search for discovery, keep the original export untouched, and write down search terms, date ranges, custodians and exclusions. My reading is simple. The search has not changed much. The paperwork around it has.

The American Bar Association's Law Technology Today made a parallel point about Copilot: knowing what the tool can see, and deciding about that scope deliberately, puts a firm in a "defensible position under Model Rule 1.6." A collection works the same way. Deleted items, other custodians, duplicates, threads and the log either sit inside the record or sit outside it, and an export that alters metadata moves things the wrong way.

A firm that tries a review tool the way a 2026 Law Technology Today article suggested, as a 30-day pilot on one recurring, low-stakes workflow with an owner and a review step, learns its time saved and corrections required before a real deadline arrives. On a 2026 law-firm podcast, Therese Caparo named the three places generative AI now enters document review: surfacing categories of relevant documents early, first-level tagging, and second-level checks on coding consistency and gaps.