Ediscovery–“enabling deduplication”

In a previous post, I showed you how to perform discovery on an Exchange 2010 organization.  We unticked ‘Enable deduplication’ on the results.  I will show you the results if we had have ticked ‘Enable deduplication’.

And the results:

You can see that the results are indeed deduplicated, but it can also make the actual investigation of data more difficult.  In this case, we can see that ‘Corey’ sent an email to ‘Omar’ with the keyword ‘passcode’.  However we can’t see that data in ‘Omar’s’ mailbox.  In the previous post, we could identify that more easily.