Background
When the company is large, and there is no need to collect data on all users, you should use cases.
...
The table structure is defined here: https://agatsoftware.atlassian.net/wiki/x/CIBzzQ (for internal use)
eDiscovery cases page
This page allows you to create a case. You need to enter the user and dates when creating a case, and you can add comments on the case.
...
On this page, you can also delete the case review set, which will delete all records from the eD. The case record will still be left for auditing .If you choose to destroy a case, and the case record status will also be deletedset to “Deleted”. When destroying a case, the user, time, and case information will be inserted into security auditing.
Example
Go to Admin Portal>eDiscovery>eDiscovery Cases
...
Press on “ADD“, enter the UPN of the user whose messages you want to view, choose the messages dates and leava a comment if you like
...
Press “SAVE“ and you should see that the record has been added to the list
...
Press on “Link to eDiscovey“ and all the messages sent/received by the user during the selected times will appear:
...