More on Recurring Meetings
a.k.a - what happens if I change one event in a series?
As I am often wont to do, I sent the newsletter last week and immediately had another question. Because, of course, my brain couldn’t move on.
I’m not obsessed, honest. Ha!
Before we get to that, however. I have a question for you. Would you be interested in getting together over a Teams channel to discuss M365, eDiscovery, and other related topics with other subscribers? Perhaps even schedule some chats on occasion? (Paid subscribers, I’ve got some ideas just for you as well.) If you are interested, sign up here. If there’s enough interest, we will definitely get this going in the next few weeks.)
As I showed last week, when I sent the invitation to a biweekly meeting and then used the keyword in the title to collect it, my query only returned 4 items. The sent invite, the received invite, and the single instance of the meeting on each calendar.
There was no evidence that the meeting would continue beyond that date.
BUT.
What if I changed one of the future events and sent an update?
So, I went out and changed the January 29 occurrence to the next day, January 30th. Then I ran the query again.
Now there are nine items returned.
The original four, obviously.
Two emails (an updated invite sent and also received)
Three additional calendar items.
The first two items on that list were expected. It was the additional calendar items that had my attention.
Would those show me the details of what changed?
Not so fast…
Isolating the five items where item.class=IPM.Appointment, I was first interested in seeing where they came from.
Two were directly from each user's calendar. Just the way they were previously. They each displayed the meeting start and end dates from the first date of the meeting, January 1.
The other three were in the Recoverable Items portion of the Exchange mailbox.
In other words, they’d been deleted when that scheduling change was made.
Yet they also all displayed metadata showing the start and end dates as January 1st.
Cue the eye-roll.
The only metadata that indicated a change to one recurrence was the updated invite, which shows as being sent on January 11.
That invite, which has a different item class due to being an invite as opposed to a calendar item, does indicate the change:
To sum up, here’s what you can expect for a recurring meeting using the native eDiscovery tools:
Copies of the invitation are in all user mailboxes. (They are usually deleted, however.)
One calendar item per user - metadata only indicating the first occurrence.
If one occurrence is changed, an updated invitation email is sent to all users with the new date and time. (Also likely deleted when accepted.)
Old versions of the calendar item in the sender's mailbox all indicate only the first occurrence.
I’m suddenly looking at one of the items I would least likely consider to be important as an end user, the updated invite, as the only way an eDiscovery professional would be able to determine any future dates of this recurring meeting.
Let’s not start with the number of recurrences that happen on the scheduled date and time that are not indicated in the collection at all!
As I mentioned last week, exporting calendar data from Outlook is the way to go here. Or am I crazy to suggest that?
Have you seen this issue crop up in a real-world case? How have you handled it?