Microsoft Office 365 Data Overview

Once ingested into a Nuix case, the data from Microsoft Office 365 is organized in a logical hierarchical structure that provides a clear view of the information.

Within the user-defined evidence container, a Microsoft Graph directory is generated for each Microsoft Office 365 connection. This directory contains all data ingested from the Azure tenant organized into the following folders:

• Teams
• Users
• Organizational Contacts
• SharePoint

The following diagram illustrates the typical data structure that is created when performing an ingestion using the Nuix Connector for Microsoft Office 365 endpoint.

+Microsoft Graph
|  +--Teams
|  |  +--TeamX
|  |  |  +--Channels
|  |  |  |  +--ChannelA
|  |  |  |  |  +--Chat Conversation
|  |  |  |  |  |  +--Chat message
|  |  |  |  |  |  |  |--Chat message attachment
|  |  |  |  |  |  +--Chat message
|  |  |  |  +--ChannelB
|  |  |  +--Calendars
|  |  |  |  +--Calendar event
|  |  |  |  |  |--Calendar event attachment
|  |  +--TeamY
|  |
|  +--Users
|  |  +--User1
|  |  |  +--Calendars
|  |  |  |  +--Calendar event
|  |  |  |  |  |--Calendar event attachment
|  |  |  +--Chats
|  |  |  |  +--Chat conversation
|  |  |  |  |  +--Chat message
|  |  |  |  |  |  |--Chat message attachment
|  |  |  +--Contacts
|  |  |  |  +--Contact or folder
|  |  |  |  |  |--Contact
|  |  |  +--Exchange
|  |  |  |  |--Recoverable items
|  |  |  |  +--Top of information store
|  |  |  |  |  +--Mail folder
|  |  |  |  |  |  +--Sub mail folder
|  |  |  |  |  |  |  |--Recursive containing more sub-folders and/or emails
|  |  |  |  |  |--Email
|  |  +--User2
|  |
|  +--Organizational Contacts
|  |  |--Org contact
|  |
|  +SharePoint
|  |  +--Site1
|  |  |  |--Drive1
|  |  |  +--List1
|  |  |  |  |--List item1
|  |  |  +--SubSite1
|  |  |  |  +--Drive2
|  |  |  |  |  +--Folder1
|  |  |  |  |  |  |--Item1
|  |  |  |  |  |--Item2
|  |  |  |  |--List2
|  |  |  |  |--SubSite2
|  |  +--Site2

As with all data that is ingested using the Nuix Engine, the contents of the evidence set is analyzed to ensure that all content as well as available metadata is extracted into the case.

The following table identifies the Mime-types that are used to classify Microsoft Office 365 data.