Patent Application
20090187797
1. Technical Field
The invention relates to electronic data discovery. More particularly, the invention relates to software technology for evaluation of the processing, i.e. full text indexing and archive extraction status of digital content collected for electronic data discovery purposes. Still more particularly, the invention relates to a method and apparatus for providing collection transparency information to an end user to achieve a guaranteed quality document search and production in electronic data.
2. Description of the Prior Art
Electronic discovery, also referred to as e-discovery or EDiscovery, concerns discovery in civil litigation, as well as Tax, Government Investigation, and Criminal Proceedings which deals with information in electronic form. In this context, electronic form is the representation of information as binary numbers. Electronic information is different from paper information because of its intangible form, volume, transience, and persistence. Such information is typically stored in a content repository. Also, electronic information is usually accompanied by metadata, which is rarely present in paper information. Electronic discovery poses new challenges and opportunities for attorneys, their clients, technical advisors, and the courts, as electronic information is collected, reviewed, and produced. Electronic discovery is the subject of amendments to the Federal Rules of Civil Procedure which are effective Dec. 1, 2006. In particular Rules 16 and 26 are of interest to electronic discovery.
Examples of the types of data included in e-discovery include e-mail, instant messaging chats, Microsoft Office files, accounting databases, CAD/CAM files, Web sites, and any other electronically-stored information which could be relevant evidence in a law suit. Also included in e-discovery is raw data which forensic investigators can review for hidden evidence. The original file format is known as the native format. Litigators may review material from e-discovery in one of several formats: printed paper, native file, or as TIFF images.
Content Repository Uncertainty with File Indexing Status
A typical content repository, i.e. content storage, has certain problems that impair search results and that may cause problems in EDiscovery
Uncertainty with File Indexing Status
Usually, indexing status of a content repository is estimated in the following ways:
Some systems try to go beyond these two approaches by warning the user what files are still in the indexing queue.
The optimistic approach is entirely unsafe when it comes to importing or indexing very large files. For example, in Oracle 9i it takes up to several minutes to index a very large document, and it takes several seconds to put large files into indexing queue. This makes the optimistic approach undesirable for EDiscovery. Failure to index files causes incorrect search results for both approaches.
None of the applications on the market implement a comprehensive processing status information solution that combines index-ability, indexing status, and container extraction, e.g. opening of such files as zip files, status information.
An EDiscovery Management Application (EMA) is a software program responsible for managing collections and holds, which communicates collection and hold requests to data sources, and which collects content from data sources and stores it in its content repository (see related U.S. patent application Ser. No. 11/963,383, filed on Dec. 21, 2007, Attorney Docket No. PSYS0001, the entirety of which is incorporated herein by this reference thereto). Some files collected into an EMA content repository during the EDiscovery process must undergo full text indexing to allow their contents to become searchable by the end user. However, the following limitations of a typical indexing process should be noted:
AP: I changed the last sentence because otherwise it sounds like we are criticizing some approach, which we are going to reject. Whereas, these are natural limitation of every indexing process.
Extracting files from container files, such as ZIP, CAB, WAR, RAR, EAR file archives, PST, NSF email archives, email message MSG files, and others, collected into an EMA content repository during the collection process creates even more uncertainty when it comes to understanding the processing status of files in the content repository. For example, the following limitations should be noted:
In EDiscovery, failing to find and produce files may result in substantial litigation risks and penalties. This is why it is very important to understand the indexing and extraction status of content collection in EDiscovery precisely. For example, the failure of a defendant to locate an email message that was saved by the plaintiff may be treated by the court as negligent misconduct or an attempt to hide evidence, and may result in heavy penalties.
Both file indexing and container extraction status information should be available to a user performing the file search to allow the user to understand the processing status of the collected content and make decisions on completeness of file search results. Also, because the overall size of the collection may be huge, processing status information must be tailored for the subset of data the user tries to query when a search is performed. Finally, the user should know which files may contain the information specified in the query criteria, although the collection repository cannot search these files; and there should be a way for a user to browse and view files that failed to index, not indexable, or have not been indexed yet and containers that failed to explode or have not been exploded yet manually by viewing the files.
In this context, it would be advantageous to provide collection transparency information to an end user to achieve a guaranteed quality document search and production in electronic data.
An embodiment of the invention displays full text index-ability, indexing, and container extraction status of files in a collection repository in connection with content management in EDiscovery.
As opposed to the optimistic and pessimistic approaches the inventive technique disclosed herein guarantees that the user knows which files failed to index and explode and which files that are not indexable.
As opposed to the optimistic approach, the invention provides a technique that tells the user which files have not been indexed yet, so they are not omitted from the analysis.
As opposed to the pessimistic approach, the invention provides a technique that allows users to start working on the collected files without waiting for the maximum possible indexing period. Further, as opposed to the pessimistic approach, the invention provides a technique that allows users to start working immediately on the collected content, thus avoiding slowing down the work during frequent updates to the content repository.
An embodiment of the invention allows for displaying indexing and extraction status information that is relevant only to the search query, thus minimizing the time needed to analyze the files that are not indexed or not exploded manually.
An embodiment of the invention also allows for automatic and manual update of a list of un-indexable file types based on historical information collected during collection repository operation, thus enhancing the user experience with time and adapting the EMA to new file types.
Finally, an embodiment of the invention allows for keeping both the person who performed the collection and the person who manages the EDiscovery effort informed about the processing status of the collection by sending notifications, displaying alerts, and by providing appropriate views.
For purposes of the discussion herein, the following terms have the meaning associated therewith:
Electronic Data Discovery (e-discovery or EDiscovery) is discovery of electronically stored evidence in civil litigation, as well as tax, government investigation, and criminal proceedings.
EDiscovery Management Application (EMA). A software program responsible for managing the electronic discovery process and storing the collected content in the content repository.
Documents collected for EDiscovery undergo a certain transformation inside the collection repository. Namely:
Sometimes these transformations may fail. For example, when an indexing engine times out and fails to index a file, or when an archive is password protected. Also, these transformations cannot be performed instantly. As a result, after a file import, some of the files that are supposed to be indexed may stay un-indexed, and some containers that are supposed to be exploded may stay un-exploded for a certain period of time. This can create a situation when a user failed to find or view a file that is supposed to be found for the purposes of litigation. For example, a file containing a certain word combination is not displayed in the full text search results because it has not been indexed properly, or even because it has not been extracted from a container. This may cause significant legal consequences, for example, in the situation when a defendant has an obligation to produce a document.
In an embodiment of the invention, the EMA displays the indexing status of files pertaining to a given matter or legal request in the content repository. This display is provided in a processing status area of the search results page. Files in the content repository can be classified, for example, the following way when it comes to full text index-ability and indexing state:
The EMA can extract indexing state and index-ability information from the content repository. For example, in Oracle, index-ability information is stored in a specially defined “IGNORE” field, and indexing status information can be extracted from Oracle Context Views. Note that each database product usually exposes some data that allows a programmer to derive full text indexing status. If some data are unavailable, there are ways to approximate this information.
In another embodiment, the EMA displays the container extraction status of container files pertaining to a given matter or legal request residing in the EMA content repository. This display is provided in a processing status area of the search results page. More generally, summary information is provided on a search results page. Thus, the EMA can read container extraction status from the content repository and display this information as error or warning messages in the processing status area of the content repository view page.
Extraction status can be stored in the EMA content repository in many ways. For example, the Atlas LCC has a status field that is originally set to “N” (not extracted). Once files are extracted from the container, the container extraction status is changed to “Y.” If the extraction failed, then the value is changed to “X.”
In another embodiment, the EMA displays the indexing status and/or container extraction status warnings and errors only for the files that may affect search results. This display is provided in the processing status area of the search results page. In the above described embodiments, the EMA displayed indexing and extraction information against all the files collected for a given legal matter or document discovery request. This information becomes overwhelming when where are many files collected for a given matter and request. Therefore, the EMA can display indexing and extraction status information only for the files that may have affected a current search query. These files include, for example, the files for which the EMA could not evaluate whether the file match certain parts of the search criteria.
To produce guaranteed search results, EMA must display the files that meet all the search parameters, except those that the EMA cannot check because of the file's bad processing status. In the example above, the EMA displays indexing warnings and errors to the end user for all files that failed to index, not indexed yet, and optionally the files that are known as un-indexable that belong to case “John Smith vs. XYZ, Inc”, discovery request “Request 1,” and that were created between Jan. 1, 2005 and Jan. 1, 2006, assuming that these files may contain the information about “John Smith.”
Displaying warnings on un-indexable files is optional because the user may understand that certain files are not subject to a full text search, e.g. JPEG files. Thus, such a warning may not be useful.
The system also displays warnings and errors to the end user for all containers that failed to explode or that have not been exploded yet for the case “John Smith vs. XYZ, Inc” and Discovery Request “Request 1” because these containers may contain files the user tries to search for, i.e. files modified between Jan. 1, 2005 and Jan. 1, 2006 and containing keywords “John Smith,” but there is no way for the EMA to figure that out.
To summarize this, the set of files returned to the end user comprises:
For purposes of the discussion herein, the term file metadata search criteria refers to file properties of the contained files, such as name, extension, size, location, modified date, created date, last accessed date, and the criteria that can be derived during file extraction, such as hash value and digital signature.
In another embodiment of the invention, the EMA displays the list of containers which failed to explode to the user who uploaded the containers into the EMA. Users who performed the collection, i.e. uploaded files to the EMA, can view the processing status of the files they have uploaded to the EMA content repository so they can promptly resolve the issues. For example, they can re-upload zip archives that failed to be exploded because of password protection, or they can provide the password as a note in the collection log.
In another embodiment of the invention, the EMA notifies the user who uploaded containers to the EMA and users responsible for coordinating the EDiscovery effort of the fact that some containers failed to explode.
In another embodiment of the invention, the EMA displays a processing status warning next to a file entry so the user can see what processing problems occurred with each file. This can be done both on a search results page and on a file detail information page.
In another embodiment of the invention, the EMA collects and presents information on what file types are not indexable by collecting the statistics of indexing failure per file type. Indexing failure may happen, for example, for any of the following reasons:
When indexing fails, it is hard to determine the reason. However, there is a need to improve indexing capabilities gradually and minimize false positives by making sure that the EMA does not attempt to index un-indexable files. Usually, the EMA maintains a list of file types that are not supposed to be indexed. However, new file types may arrive and the EMA administrator needs to receive information on whether these file types are indexable or not. This can be done by observing indexing failure statistics. Over time, the EMA collects, for example, the following information per file type:
Based on this information, the system calculates the ratio of indexing failure, which can be described by the following formula:
Ratio of failure of a given type=number of failed files of a given type/number of files of a given type uploaded and attempted to index
This information can be reported to the administrator so that file types having a high ratio can be added to a “do not index” list. For example, if the ratio is close to 1, this is definitely not an indexable file type. If the ratio is between 0.2 and 0.8, here the numbers are arbitrary, indexable and un-indexable file types may have the same file extension. If the ratio is low but not 0, a majority of files of this type are getting indexed, but there may be problems with indexing engine timeout or some files may be corrupt.
Another Formula that may be Used for this Purpose is as Follows:
Ratio of failure of a given type=number of failed files of a given type/number of files of a given type successfully indexed
This formula can be derived from the previous formula. The decision points equivalent to those described above are, for example:
The EMA can automatically (or semi automatically, by presenting the information to the administrator and letting the administrator decide) update the “do not index list” with file types that proved to have high ratio of failure. A high ratio of failure can be determined through comparison against a threshold value. The EMA may also postpone the decision until it achieves a representative sample, i.e. a large enough number files of the same type being uploaded and attempted to index. This makes the statistics credible.
In another embodiment of the invention, the EMA provides a separate view containing the list of files that have questionable status.
Although the invention is described herein with reference to the preferred embodiment, one skilled in the art will readily appreciate that other applications may be substituted for those set forth herein without departing from the spirit and scope of the present invention. Accordingly, the invention should only be limited by the Claims included below.
