Question
An Exchange email has a neutral subject and an attachment encrypted by a Microsoft Purview sensitivity label. Investigators know the attachment contains a target phrase, but the phrase query returns no hit. How should they preserve and examine it?