Clearwell ediscovery Platform

Transcription

1 Clearwell ediscovery Platform Identification and Collection Guide 7.1.2

2 Clearwell ediscovery Platform : Identification and Collection Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Last updated: Legal Notice Copyright 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, Clearwell and the Clearwell ediscovery Platform are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/ reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , et seq. "Commercial Computer Software and Commercial Computer Software Documentation", as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement. Symantec Corporation 350 Ellis Street Mountain View, CA

3 Contents About This Guide 7 Related Documents 7 Revision History 8 Obtaining More Product Information 9 Documentation Comments/Feedback? 9 Technical Support 9 Contacting Technical Support 9 Licensing Portal 10 Customer Service 10 Product Documentation 11 Getting Started 13 About Data Identification and Collection 13 Collections Module User Interface 14 Checklist: Before You Begin Logging On 15 Clearwell Collection Workflow 15 Network and Data Map Setup 17 About Data Mapping 17 Supported Source Types 17 Best Practices 18 Network Impact and Performance 18 Clearwell Collection Methodology and Setup 19 Tips, Troubleshooting, and Technical Support 19 Setting Up Your Data Map 20 Before You Begin Source Account Overview 20 Define Source Groups (Optional) 21 Data Discovery Overview 21 Importing Custodians to Your Data Map 22 Adding Destinations for Collected Data 30 Setting up Data Sources 32 About Adding (or Importing) Sources to Your Data Map 32 Required Source Information 33 Import Sources Using Bulk Import (from CSV or Script) 34 Local Domain Exchange Setup 37 Step 1: Create a New Domain Admin Account 37 Step 2: Perform Active Directory Discovery and Import Custodians 40 Step 3: Add Exchange Source to the Data Map 41 Step 4: Test an Exchange Mailbox Collection 42

4 BPOS Exchange/Office 365 Setup 43 Overview 44 Step 1: Create a New Admin Account (for BPOS) 44 Step 2: Perform Active Directory Discovery and Import Custodians (for BPOS) 46 Step 3: Configure the Clearwell Appliance's Outlook Template Profile 47 Step 4: Add the Exchange BPOS Source to your Data Map 53 Step 5: Test an Exchange Mailbox Collection 54 Lotus Domino Server Setup 55 Step 1: Perform Domino Server Discovery 55 Step 2: Add the Domino Source 56 SharePoint Server Setup 57 Add the SharePoint Source 57 File Share and Windows PC Setup 58 Add File Share (or PC) Source 58 Symantec Enterprise Vault (EV) 59 EV Source Considerations Before Setup 59 About EV Discovery 60 Step 1: Perform EV Discovery/Vault Administration 61 Step 2: Add EV Sources 64 Step 3: Update your License 64 Collectors 65 About the Collectors 65 Step 1: Verify Collector License 65 Step 2: Add the Source Account 66 Step 3: Add the Collector Source 67 Step 4: Create a Collection Task 68 Creating and Managing Collections 70 About Collection Activities 70 About OnSite Collections 71 OnSite Collection Reference Card 71 Creating a Collection and Running Tasks 72 Process Overview 72 Create/Add a New Collection 72 Add Tasks to a Collection 73 Filtering Best Practices (for Enterprise Vault Sources) 78 Keyword-Based Collection (Non-EV Sources) 81 Include/Exclude Directories 82 Secure Encryption for OnSite Collection Tasks 87 Create a Collection Template 87 Run (or Schedule) a Collection Task 88 Schedule a Recurring Collection Task 90 Running Custodian Assignments 92 Enterprise Vault Considerations 92 Performing OnSite Collection Tasks 94 Running Collection Reports 94 Collection Reports 94

5 Creating and Managing Holds 97 About EV Hold Activities 97 Prerequisites 97 Creating and Managing Hold Tasks 98 Create a Hold 98 Schedule a Hold 102 Create a Hold and Collection Task 103 View/Report Hold Statistics 104 Edit/Re-Apply a Hold Task 105 Copy a Hold Task 106 Release a Hold 107 EV Holds and Release Guidelines 107 Creating, Analyzing and Processing Collections 109 About Collection Sets and Analytics 109 Creating Collection Sets 109 Analyzing Collection Task Data 112 Viewing Collection Analytics 112 Changing Collection Settings 112 Processing Collection Sets 113 Analyzing Data Across Your Case 114 Viewing Processed Data 114 Collection Administration and Maintenance 119 Managing Collection User Accounts 119 Defining Collections Administration User Accounts 119 Viewing/Editing the Collections Admin Role 121 Running Collections Backups 124 About Collections Backups 124 Configuring the Collections Backup Location 125 Running an On-Demand Collections Backup 126 Scheduled Collections Backups 127 Archiving, Restoring, and Deleting Collections 129 Archiving versus Deleting Collections 129 Restoring an Archived Collection 130 Managing Your Collections License 132 About Reusable Licenses 132 Updating Your License 133 Additional Collections Admin Tasks 138

6 Tips and Troubleshooting 139 Verify Network Setup by Data Source 140 Troubleshooting Exchange Collections 143 Troubleshooting File Server or PC Collections 143 Performing Collections on a File Share Source 144 Troubleshooting Mailbox Connectivity for BPOS Exchange 146 Troubleshooting Collector Sources 147 Enabling Scaleout Mode (for EV Collection) 148 Enable Scaling to Multiple EV Servers 148 Enable Multiple PST Creation 149 Changing Source Accounts 149 Technical Support 150

7 Identification and Collection Guide: About This Guide PAGE: 7 and Collection Guide Identification and Collection Guide Welcome to the Clearwell ediscovery Platform, Identification and Collection Guide. The Clearwell Identification and Collection Guide provides administrators and end users of the identification and collection module within the Clearwell ediscovery Platform with the tools and information for data source setup, identifying, collecting, managing, reporting, and placing holds on data, in addition to collection set analysis. The Identification and Collection module provides administrators with greater visibility and control over the sources required for collecting data used to create a case, and adds more filtering capability which administrators can apply during collection and analysis. This section contains the following sections: About This Guide in the next section Related Documents on page 7 Revision History on page 8 Obtaining More Product Information on page 9 Technical Support on page 9 Product Documentation on page 11 About This Guide This guide provides an overview of the Identification and Collection module, a licensed add-on feature to the Clearwell ediscovery Platform. The sections in this guide describe how to identify and associate data sources, create and run collection tasks, analyze and manage collection, and perform other regular administrative and maintenance tasks. This guide is intended for system and IT administrators, decision makers, and anyone who is interested in understanding how the Clearwell ediscovery Platform leverages data sources using the Identification and Collection feature. Related Documents Refer the following documents for additional information related to Clearwell s Identification and Collection module: Symantec Clearwell ediscovery Platform New Features Overview Symantec Clearwell Identification and Collection Reference Card Symantec Clearwell OnSite Collection Reference Card

8 Identification and Collection Guide: Revision History PAGE: 8 Revision History The following table lists the information that has been revised or added since the initial release of this document. The table also lists the revision date for these changes. Revision Date Sep 2012 March 2012 Feb 2012 Nov 2011 May 2011 Feb 2011 Dec 2010 Sep 2010 New Information Added source support for: Four new collectors (See Supported Source Types on page 17.) EV SharePoint, EV File Share Archives Documented new features: Licensing: Separated from Processing, Analysis & Review module license Enhanced EV Vault and Archive source management Enhanced filtering for EV sources: -to-custodian mapping for journal archiving, message type, retention category, policies, custom attributes Retention and Tag Policy creation and application to EV collections Hold in Place feature (for EV source users) - introduced in 7.1.1, added to this document for Set property to scale EV collection to multiple deployment servers (allowing simultaneous search and retrieval) Added source collection support for Symantec Enterprise Vault (EV) Documented additional new features: Archive/restore collections Collection Reports Documented procedure for obtaining a licence update; formatting changes throughout Added source collection support for: Exchange 2010 (discovery, search, mailbox) SharePoint Web pages Documented new features: Bulk import of custodians via CSV or Script Reusable custodian licensing Keyword-based collection Documented OnSite Collector secure encryption option Added support for: SharePoint with proxy MAC (for OnSite) collection Documented Folder Exclusion feature Added (to Data Sources list) support for: Microsoft Exchange Cloud Servers (BPOS) Lotus Domino Server (Lotus Notes) Documented new features: Custodian Merge Bulk Import of Sources to data maps Moved OnSite Collection Details to stand-alone reference: Refer to OnSite Collections Reference Card Created guide for new Collections module.

9 Identification and Collection Guide: Obtaining More Product Information PAGE: 9 Obtaining More Product Information To obtain more information, refer to: Symantec products web site Go to Documentation link To obtain the most current online and PDF versions of the documentation, click the Documentation link at the bottom of any page in the Clearwell ediscovery Platform. Online help Click the Help link in the Clearwell user interface to access online help. Documentation Comments/Feedback? Got questions or comments on this guide, or other user documentation? We appreciate your feedback! Feel free to contact us at ClearwellInfoDev@symantec.com Technical Support The primary role of the Clearwell Technical Support team is to respond to our customers to help resolve technical issues affecting features or functionality of the Clearwell ediscovery Platform. This includes configuration, workflow, and internal system issues, but does not include assistance with legal-related or case-specific queries. For additional help with technical issues, refer also to Clearwell s Knowledge Base content available online at: For information about Symantec's support offerings, visit our Web site at: Contacting Technical Support Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the system on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product version and patch level Service tag number Available memory, disk space, and NIC information Operating system Problem description: Affected case name Screenshots demonstrating behavior Accurate reproduction steps Error messages and log files

10 Identification and Collection Guide: Technical Support PAGE: 10 Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes Note: You must have administrative access to the system in order to perform most troubleshooting. Be sure to have this available, as well as a system/network administrator resource in the event access is required. To contact Clearwell Technical Support, use any of the following methods: Customer Support Portal (Clearwell Products) Phone Toll-Free (North America): Clearwell ( ) Licensing Portal If your Clearwell product requires registration or a license key, access our Licensing Portal: Symantec Licensing Portal Customer Service To contact Symantec Customer Care, use any of the following methods: Customer Care Portal (Non-Technical Support) Enterprise Products Phone Toll-Free (North America): For other regions: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Non-technical pre-sales questions Issues that are related to manuals

11 Identification and Collection Guide: Product Documentation PAGE: 11 Product Documentation The table below lists the administrator and end-user documentation that is available for the Clearwell ediscovery Platform product. Clearwell ediscovery Platform Documentation Document Installation and Configuration Installation Guide Upgrade Overview Guide Upgrade Guide Utility Node Guide Native Viewer Installation Guide Distributed Architecture Deployment Guide Getting Started Comments Describes prerequisites, and how to perform a full install of the Clearwell software application Provides critical upgrade information, by version, useful prior to upgrading an appliance to the current product release Describes prerequisites and upgrade information for the current customers with a previous version of the Clearwell software application For customers using utility nodes, describes how to install and configure appliances as utility nodes for use with an existing Clearwell software setup Describes how to install and configure the Brava Client for native document rendering and redaction for use during analysis and review in Clearwell Provides installation and configuration information for the Review/ Processing Scalability feature (7.x) in a distributed architecture deployment Navigation Reference Card Provides a mapping of the Clearwell user interface (7.x) compared to 6.x Clearwell QuickStart Guide Reviewer QuickStart Guide User and Administration Legal Hold Guide Identification and Collection Guide Case Administration Guide System Administration Guide Load File Import Guide User Guide Export and Production Guide Transparent Predictive Coding Guide Describes basic appliance and case configuration A reviewer's reference to using the Analysis & Review module in Clearwell Describes how to set up and configure a Clearwell appliance for Legal Holds, and use the Legal Hold module as an administrator in Clearwell Describes how to prepare and collect data for processing, using the Identification and Collection module Describes case setup, processing, and management, plus pre-processing navigation, tips, and recommendations. Includes processing exceptions reference and associated reports, plus file handling information for multiple languages, and supported file types and file type mapping Includes system backup, restore, and support features, configuration, and anti-virus scanning guidelines for use with Clearwell Describes how to import load file sources into Clearwell Describes how to perform searches, analysis, and review, including detailed information and syntax examples for performing advanced searches Describes how to use, produce, and troubleshoot exports Describes how to use the Transparent Predictive Coding feature in Clearwell to train the system to predict results from control data and tag settings

12 Identification and Collection Guide: Product Documentation PAGE: 12 Clearwell ediscovery Platform Documentation Document Reference and Support Collection OnSite Collection Review and Redaction Keyboard Shortcuts Production User Rights Management Online Help A quick reference card of how to collect data in Clearwell A quick reference for performing OnSite collection tasks Reviewer's reference card of all redaction functions A quick reference card listing all supported shortcuts Administrator's reference card for production exports A quick reference card for managing user accounts Includes all the above documentation (excluding Installation and Configuration) to enable search across all topics. To access this information from within the Clearwell user interface, click Help. Release Release Notes Comments Provides latest updated information specific to the current product release For the latest product information:

13 Getting Started : About Data Identification and Collection PAGE: 13 Identification and Collection Guide Getting Started Use this section to help guide you through verifying your setup, and what to do after logging on to the Clearwell ediscovery Platform. In this section: About Data Identification and Collection in the next section Collections Module User Interface on page 14 Checklist: Before You Begin... in the next section Logging On on page 15 Clearwell Collection Workflow on page 15 About Data Identification and Collection Clearwell's Identification and Collection module allows you to: keep a catalog of multiple data sources (such as File Shares, PCs, Exchange servers, SharePoint and Lotus Domino servers, Symantec Enterprise Vault archives, among others) in your data map set up Collection Tasks, which create copies of data from these data sources, grouped into Collections place and manage holds on data (from EV sources) move the data through Processing and Analysis by creating Collection Sets archive and restore collections as needed to optimize data storage and custodian licenses report on collection data with summary and error reports, run as jobs and/or available in Microsoft XLS formats Typically, IT builds the Data Map and supplies the proper account credentials and locations for relevant data sources. (Refer to the Identification and Collection Network Setup Guide). However, a Collection Admin with appropriate permissions, can add as many data sources to the Data Map as needed, and perform multiple collections from these sources.

14 Getting Started : About Data Identification and Collection PAGE: 14 Collections Module User Interface There are two views of the Collections module: All Collections, or a single collection within a selected case. To view collections across all cases on the appliance, click All Cases on the top navigation bar, then click All Collections: Figure: Collections Module: All Collections view The module you select is highlighted in orange. From the All Collections view, a Collections Admin can manage Collection Sets, Sources (collection data), Source Accounts, Source Groups, (preservation) Destinations, and Task Templates across all cases in the Clearwell appliance. Note: Only the Collections Admin user has access to view collections and all related sub-tasks. To view collections and related tasks in a specific case, click the drop-down to select a case, or select Create a new case. Figure: Collections Module: Within a Selected Case (No Collections) When a case is selected (within the Collections module), a Collections Admin can view the same set of sub-tasks (before a collection is created). Each case can have only one collection. Once the collection is created, the Collections Admin can view only the collection associated with the selected case. Click Create Collection to start a new collection. See Create/Add a New Collection on page 72.

15 Getting Started : Checklist: Before You Begin... PAGE: 15 Checklist: Before You Begin... Use the following checklist to verify your setup before you begin working with the Clearwell Identification and Collection module: Clearwell appliance is properly installed. Refer to the Clearwell ediscovery Platform Installation Guide to verify your installation and configuration. Network is set up for data collection. Refer to the Identification and Collection Network Setup Checklist and Network Setup Guide for information about how to set up your IT environment and ensure your network is ready for mapping your source data. Data Map and Collections License is installed. See Managing Your Collections License on page 132 to check for license information, including the number of custodian licenses currently available for use. (Custodian licenses are reusable.) Change/update account, Help, and Support link information. See Logging On in the next section. Logging On The first time you log on, be sure to: 1. Change the account password. Note: The password is the same on every Clearwell appliance. Leaving the default password opens your system up to vulnerabilities. 2. Update the Need Help? link on the Login page. 3. Update the Support link. Clearwell Collection Workflow Follow these basic steps of identification and collection in this guide to prepare your data sources for case creation and management: Data Mapping. Create and manage source accounts, add sources, custodians, and destinations to your data map. (See Network and Data Map Setup on page 17.) Collections. Create collections, add collection tasks, run and schedule data collection, perform onsite collection. (See Creating and Managing Collections on page 70.) Collection Sets. Analyze and process collected data by creating collection sets and assigning to a case. (See Creating, Analyzing and Processing Collections on page 109.) For more information about this workflow, refer to the Collection Workflow Reference. Occasionally, you may also want to set Collections user permissions, perform collections and data map backups, check Collections licensing information, and perform other maintenance tasks. See Collection Administration and Maintenance on page 119.

16 Getting Started : Clearwell Collection Workflow PAGE: 16

17 Network and Data Map Setup : About Data Mapping PAGE: 17 Identification and Collection Guide Network and Data Map Setup This section describes how to ensure your network is properly set up before mapping your data sources to the Clearwell Platform. About Data Mapping on page 17 Best Practices on page 18 Setting Up Your Data Map on page 20 About Data Mapping Through the Identification and Collection module, administrators can set up a data map by associating all available data sources in preparation for collection. Supported Source Types Clearwell supports the following source types for identification and collection. Source Types Source Version / Type Supported Details Network File Shares Personal Computers Windows Network, and OnSite collection Mac Off-network only / OnSite collection Note: For information about collecting data from non-network sources, see About OnSite Collections on page 71. Microsoft Servers Exchange (Windows) BPOS Exchange or Office 365 Lotus Domino Server SharePoint with Proxy Web page sources Symantec Enterprise Exchange (EV) Mailbox and Vault (EV) Lotus Domino (EV) Journaling Archives (Sources and Archives) SharePoint Archive (EV) File System Archive (EV) OpenText Livelink 9.2 sp1 or later (up to as of April 2012) When creating a collection with a Livelink source, keyword search is available for files, but not available for volumes. Interwoven WorkSite NT (HP Autonomy imanage) DeskSite or FileSite 8.x Interwoven DeskSite or FileSite 8.x client must be installed locally by the enterprise user on the Clearwell appliance Note: The client version must match the server version in use. EMC Documentum Content Server 5.3 Foundation Services Collector Content Server or later Foundation Classes Collector Xerox Docushare 4.0 or later IBM FileNet Content Manager 8

18 Network and Data Map Setup: Best Practices PAGE: 18 Best Practices This section outlines the best practices which Network administrators and ediscovery practitioners should consider before setting up your network environment to use the Identification and Collection module in Clearwell. IMPORTANT! Read this section first, before completing the tasks in the following sections, according to the source type(s) you are setting up for identification and collection. Network Impact and Performance Clearwell's Identification and Collection Module (IC Module) is an ediscovery solution, allowing customers to search, filter, and collect data from various data sources. Collection can happen directly (via an OnSite collection onto an external hard drive) or across the network. Network collections can come from multiple data sources, including Microsoft Exchange Server, Lotus Domino Server, File Shares, Symantec Enterprise Vault (EV), SharePoint, and various collector sources. (See all Supported Source Types on page 17). Collections are performed on-demand, only when the user starts a specific Collection Task. The Clearwell IC Module is not maintaining or updating a persistent index of data at these data sources. Network impact is limited to the scope of the specific collection tasks. For most ediscovery use cases, these tasks can and should be targeted at individual subsets of data at these sources, rather than the entire source. For example: collecting a single or a small number of specific Exchange mailboxes collecting a user s Public File Share folder SharePoint collections leveraging Clearwell s federated search feature This submits the search request to SharePoint s own index, and Clearwell will collect (and occupy the network for) just the positive results.

19 Network and Data Map Setup : Best Practices PAGE: 19 Clearwell Collection Methodology and Setup In consideration of network impact and performance, Clearwell's collection filters are applied intelligently - scanning for metadata matches first, and then performing (the more networkintensive) keyword scanning second. The number of simultaneous collection tasks and threads are limited across all collections. These limits are adjustable, and can be set by a Clearwell solutions consultant, services professional, or support. Recommended Numbers of Collection Tasks & Threads by Source Type Supported Source Type Local Exchange Server Local SharePoint Source Account Requirements 5 max parallel tasks, 1 thread per task 10 max parallel tasks, 500 max threads per task Notes Each task must be single-threaded, this is a MAPI limitation Source Setup (by Source Type) See also Tips and Troubleshooting on page 139.) Lotus Domino Server FileShares PC on the network PC and Mac (for OnSite Collection) Single-threaded 10 max parallel tasks, ~128 max threads per task (same as FileShares) No throttle. To collect multiple mailboxes truly in parallel simultaneously, the user needs to create separate Exchange Sources, each one attached to a different Source Account. You can do this for up to 5 mailboxes, depending on the appliance specs and whether the Exchange server has set limitations # of threads actually is dynamically configured based on # of CPUs (same as FileShares) These are direct-to-drive collections, typically not done over the network Tips, Troubleshooting, and Technical Support For troubleshooting information in this guide, see Tips and Troubleshooting on page 139, and refer to the appropriate section depending upon the source type.

20 Network and Data Map Setup: Setting Up Your Data Map PAGE: 20 Setting Up Your Data Map As you prepare to add sources to your data map, check the overview information and network setup references in this section first to ensure you have what you need to get started. Before You Begin... Ensure your network is properly set up before adding sources: Review Best Practices on page 18 for setting up your network. See Verify Network Setup by Data Source on page 140. Determine the sources and accounts needed for setup: See Source Account Overview in the next section See Define Source Groups (Optional) on page 21. See Data Discovery Overview on page 21. As needed, add (or import) custodians to the data map, and specify destinations and policies: See Importing Custodians to Your Data Map on page 22 See Adding Destinations for Collected Data on page 30. Source Account Overview A source account is the authentication used to control access to the Preservation Destination (where collected data will be stored). From the Collections > Source Accounts screen, administrators can create multiple accounts if the network setup requires different authentication accounts to access source data. IMPORTANT! If you plan to collect from a Symantec EV source, be sure to use an Active Directory username and password that can navigate EV topology and searches using the EV Admin Console. Use this account for both the EsaEvCrawlerService logon and your EV collection source account. Make sure that the account belongs to the Local Administrators group on the Clearwell appliance. For more information, refer to Symantec Enterprise Vault (EV) on page 59, or check with your Clearwell system administrator. From your list of sources, you can use the Filter List menu to view accounts Name, Description, User, or accounts currently In Use (enabled accounts are listed by default) and apply additional filter parameters. To change or enable/disable an account, click the source account name, change the account settings, and click Save.

21 Network and Data Map Setup : Setting Up Your Data Map PAGE: 21 Define Source Groups (Optional) As part of adding sources to your data map, you can (optionally) create customized groups for your sources. Source groups can help organize larger data maps containing multiple sources. You can assign a specific source group to each data source, then filter or search for sources within a specific group. To add a source group 1. From the Collections module, click Source Groups. 2. Click Add to open the New Group window. 3. Enter a name for the source group, and a description (optional). An asterisk (*) indicates a required field. 4. Click OK to submit the new group, or click Cancel to discard your changes. Data Discovery Overview Data discovery populates your data map with employee data, called custodians when it becomes available for collection. Typically, servers represent a critical source of data from which to collect. To add servers to your data map, be sure to perform discovery on Active Directory or Lotus Domino (for Lotus Notes sources) first. Note: Check with your system administrator to verify whether discovery may have already been done on servers during network setup of your collections environment. From System > Servers, you can select one or more sources you want to discover. Select from four main server/archive sources (which may contain source types within, such as Symantec EV): Active Directory Shows domain sources available for discovery (or click to add a domain if the domain source exists, but does not appear on the list.) Verify that the sources to be added are part of your Active Directory Forest. See Setting up Data Sources on page 32 for detailed steps to perform discovery depending on Exchange source type. HP IAP Shows HP IAP archive sources available for discovery. Alternatively, click Add if the HP IAP source exists, but does not appear on the list.) When finished, click Start Discovery.

22 Network and Data Map Setup: Setting Up Your Data Map PAGE: 22 Symantec EV Shows results for all Enterprise Vault sources and archives from discovery. To discover a new EV vault directory, you must have the Directory Server Host Name. Under Policies, rules can be applied to EV sources later, when specifying filter criteria in preparation for collection. See Symantec Enterprise Vault (EV) on page 59. Lotus Domino Shows Lotus Domino server sources available for discovery (or click to add if the Domino server source exists, but does not appear on the list.) See Lotus Domino Server Setup on page 55. To perform discovery and/or start adding sources, continue with steps in Setting up Data Sources on page 32 for each specific source type you want to add. Importing Custodians to Your Data Map There are several ways to add custodians: Import multiple custodians at once, or individually, either from Active Directory, or from a CSV or Script file. To import using CSV or script, refer to the format requirements in this section. Note: Custodians in Clearwell s Processing and Review (PAR) module are not case-sensitive. As a result, custodians in the Identification and Collection (IC) module may be merged with similar custodian names in PAR. For example, the IC custodians joe admin, Joe admin, and Joe Admin, who are all considered unique in IC, are treated as the same custodian in PAR. Thus, when you add a collection set (created in IC) containing the custodian joe admin to a PAR case that contains another custodian Joe Admin they are merged as one custodian. However, if that same PAR case contained no similarly-named custodians, and all three IC custodians were added to the case, they will be considered unique. In any case, to ensure your IC custodians remain unique, you can either specify custodian names with a numeric designation, or simply unmerge custodians in PAR. Merging/Unmerging Custodians Later, after your selected custodians have been added to a case, you can use the Custodian Merge feature to resolve any same-name, or similarly-named custodians (that represent the same source or individual). Alternatively, use the Unmerge feature to keep Collection Set custodian names unique if similarly-named (representing other individual) custodians already exist. For more information, refer to "Merging Custodians" in the Case Administration Guide.

23 Network and Data Map Setup : Setting Up Your Data Map PAGE: 23 To add custodians 1. From the All Cases view, click Employee List. (Alternatively, within a case under the Collections module, click Sources, then from the Custodian box, click Edit Custodians, then Add. See also on page 30.) 2. From the Employee List, determine if you want to: A. Import multiple custodians. See To add custodians by bulk import (option A) on page 23. B. Add custodians individually. See To add a custodian individually (option B) on page 28. To add custodians by bulk import (option A) 1. From the Custodians window, click Import and select one of the following options: A. Active Directory (see Importing Custodians from Active Directory in the next section for details): From Active Directory (select individual custodians to add) Import All From Active Directory (add all custodians at once) B. From File (see Importing Custodians from CSV or Script on page 24 for format requirements): From CSV (enter CSV file name and path, or browse to location) From Script (enter Script file name and path or browse to location) 2. Upon discovery, click Import All Shown. 3. If your import was successful, all custodians you selected to add or import appear in the list of custodians. Click Save to associate the new custodians to the selected source, or click Cancel to discard your changes.

24 Network and Data Map Setup: Setting Up Your Data Map PAGE: 24 Importing Custodians from Active Directory Upon Active Directory discovery, only the first 100 custodians are displayed at a time. Use the Filter List menu to view by Custodian, User Name, or Address and apply additional filter parameters. Importing Custodians from CSV or Script The Collections Admin can automatically populate the Employee List by providing a CSV or script file which meets specific requirements for bulk import into Clearwell. Before importing your custodians, ensure your CSV file or script meets the following requirements. Note: When importing custodians from a file, the names are added in the system similar to a processed job. To view the status of your CSV or Script file import, click the Jobs link at the top of the screen. If an error occurs during import, a warning icon appears next to the link. Click the book icon in the Status column to view details in the job status log. CSV Import Format Requirements The CSV file should be provided in the following format: 1. Header row - First row of the file, consisting of the column names (in any order), separated by commas. The following column names should be specified: Note: An asterisk (*) indicates a required field. CSV Import Format Requirements Column Name Format Max Limit Example Name* UTF John Doe Domain UTF symantec File owner name UTF John Doe

25 Network and Data Map Setup : Setting Up Your Data Map PAGE: 25 CSV Import Format Requirements Column Name Format Max Limit Example File owner SID UTF Title UTF Analyst Division UTF Sales Location UTF-8 California Phone Number UTF-8 No limit Hired Date MM/DD/YYYY 10 05/02/2010 Terminated Date MM/DD/YYYY 10 08/10/2011 UTF-8 John@symantec.com johnie@symantec.com Primary (Integer) Index Note: with index 0 in the list of s will be displayed as primary: John@symantec.com Escalation Manager Unique ID System Admin UTF TRUE/FALSE (FALSE by default) 5 FALSE Unique ID* UTF Employee Record - Each of the following rows will be interpreted as an employee record, with each attribute separated by a comma. The number of fields in each row must match the number of columns in the header row. The following rules apply to attributes or columns in a CSV file for Employee List bulk import: CSV Import Format Requirements Attribute or Column Rule(s) Column names Case-Sensitive; (must be typed as shown in Table 1.) Can be written in any order Domain Column File owner name Column (Optional) Must be present with File owner name column (or both columns must be absent). Cannot be individually selected. Values must also be consistent in both columns if present (empty or populated). (Same rules apply as for Domain column.)

26 Network and Data Map Setup: Setting Up Your Data Map PAGE: 26 CSV Import Format Requirements Attribute or Column Fields containing line breaks (CRLF), double quotes, and commas Adding multiple values Rule(s) Must be enclosed in double quotes. ( " ) If using double quotes to enclose fields, a double quote appearing inside a field must be preceded with another double quote. Example: employee one, mc adams. When adding multiple values to a field, the values should be separated by commas (,) Example: Unique Domain and File owner name values Unique IDs Domain and File Owner Name pairs must be unique across all employees. This does not apply to records with empty Domain and File Owner Name values. If an employee entry contains the same Unique ID as another employee entry, the following rules will apply: New employee s , File owner name, File owner SID, and Domain column fields will be appended to the existing employee s entry. All other columns will be replaced. Example:

27 Network and Data Map Setup : Setting Up Your Data Map PAGE: 27 Script Import Requirements An asterisk (*) indicates a required field. Script Import File Format Requirements Column Name Format Max Limit Example Name* UTF John Doe Domain UTF symantec File owner name UTF John Doe File owner SID UTF Title UTF Analyst Division UTF Sales Location UTF-8 California Phone Number UTF-8 No limit Hired Date MM/DD/YYYY 10 05/02/2010 Terminated Date MM/DD/YYYY 10 08/10/2011 UTF-8 John@symantec.com johnie@symantec.com Primary (Integer) Index Note: with index 0 in the list of s will be displayed as primary: John@symantec.com Escalation Manager Unique ID System Admin UTF TRUE/FALSE (FASLE by default) 5 FALSE Unique ID* UTF Script File Format and Location All CSV formatting requirements also apply to those used for bulk import. However, to ensure security while running executable (.exe) files, all scripts must be stored in the folder: D:\customerScript\bulkImport. Appliance users should ensure that access to this folder is restricted to authorized users, since running executables on the Clearwell appliance can pose significant security threats to the system. Note: Unless the file is an executable (.exe), then it should contain the location of the executable used to run it (as shown in the first line of the following example). Example script: #!c:\perl\bin\perl.exe print "Name, ,Unique ID\n"; print "John Doe,JohnDoe\@johnDoe.com,1122\n"; print "Johnnie Doey,JohnnieDoey\@johnnieDoey.com,1122";

28 Network and Data Map Setup: Setting Up Your Data Map PAGE: 28 To add a custodian individually (option B) 1. From the All Cases > Employee List screen, click Add. Note: The bottom section will be visible only if your enterprise has a Legal Holds module license installed, and the logged on user must have appropriate permissions. 2. Specify the following information. An asterisk (*) indicates a required field. Adding a Custodian Field Custodian* Title Division Unique ID Location Description Enter the name of the custodian (up to 35 characters). The name is not case sensitive. Enter the custodian s title (if applicable). Enter the custodian s division or department (if applicable). Enter an identification number or code unique to this custodian. Enter a location. Enter the custodian s account. (Example: jsmith@acm .com). By default, the icon is selected to indicate that this is the primary address. Click the icon to add additional addresses for this custodian.

29 Network and Data Map Setup : Setting Up Your Data Map PAGE: 29 Adding a Custodian Field Phone Number Enter a phone number for the custodian. Click the icon to add additional phone numbers for this custodian. Escalation Manager (Legal Hold users only) Hired / Terminated Owner Info. (Domain, Owner Name, SID) System Admin for Legal Hold (Legal Hold users only) Legal Hold History (Legal Hold users only) Description 3. Click Save to associate the new custodian to the selected source, or click Cancel to discard your changes. 4. Click Close to close the Custodians window. Enter or browse for the name of this custodian s manager to whom legal hold notifications should be escalated. Enter the date of hire and termination, or click the calendar icon to select a date. Enter the Domain name, owner name, and the Security Identifier. Note: The owner name will only be collected (when filtering for collection) if the Windows user for the collection is running as the source account (or EsaApplicationService user if there is no account on the source), and it is in the domain where the owner name is kept. Select this check box if this custodian s role is a System Administrator, for use in customizing Legal Hold notifications. Displays summary of Legal Hold activity associated with this custodian. (Includes names of Legal Holds and Notifications, and date notifications were last sent.)

30 Network and Data Map Setup: Setting Up Your Data Map PAGE: 30 Adding Destinations for Collected Data After setting up an authentication account, add a Preservation Destination, the location where you want collected data to be copied. You can add multiple destinations to manage storage across geographical locations and by priority. To add a destination 1. From the Collections module, click Destinations. 2. Later, use the Filter List menu to view accounts by Destination, Description, or Account (enabled accounts are listed by default), and apply additional filter parameters. 3. To add a new source account: A. Click Add to open the Add Destinations page. B. Specify the following information. An asterisk (*) indicates a required field. Source Data Destination Field Account Path* Description Description Enter the name of the source account you created, or click Browse to select one from the list of accounts. Enter the path to the location where the collected data will be stored. Click the button to select a File Share or remote directory. Click Check Free Space to verify data storage capacity. Enter a description for this source account (up to 255 characters). C. Click Save to submit the destination, or click Cancel to discard your changes.

31 Setting up Data Sources: About Adding (or Importing) Sources to Your Data Map PAGE: 32 Network Setup Guide Setting up Data Sources Follow the steps in this section (by source type) to perform the tasks necessary to set up your organization's IT environment for Identification and Collection using Clearwell. For a general overview about adding (any) sources: About Adding (or Importing) Sources to Your Data Map on page 32 Required Source Information on page 33 Import Sources Using Bulk Import (from CSV or Script) on page 34 To start adding sources (by source type) refer to the appropriate section: Local Domain Exchange Setup on page 37 BPOS Exchange/Office 365 Setup on page 43 Lotus Domino Server Setup on page 55 SharePoint Server Setup on page 57 File Share and Windows PC Setup on page 58 Symantec Enterprise Vault (EV) on page 59 Collectors on page 65 About Adding (or Importing) Sources to Your Data Map Identify the sources of data (where the data will be collected from), or populate your data map automatically using the bulk import feature. Typical sources may include File Shares, Exchange Servers, SharePoint, Lotus Domino Servers, or remote locations such as a personal computer. Note: If you are adding a Symantec Enterprise Vault source, follow the steps in Symantec Enterprise Vault (EV) on page 59. From the Collections module, click Sources, then Add. (FileShare is shown in this example.) You will need to add a source for each type of data source--the storage device and location from which you want to collect data. Later, you will create collection tasks for each of these sources to begin collecting the data.

32 Setting up Data Sources: About Adding (or Importing) Sources to Your Data Map PAGE: 33 Note: Additional fields will be shown for EV source types, such as Site and Archive Type, and for collectors, such as Repository and Object Store. (For any EV source type, see Symantec Enterprise Vault (EV) on page 59.) Also note: For EV collection, Clearwell can run federated searches across all sites, however, the searches are specific to the Vault Site. If searches must be run across multiple sites, different Collection Sources must be created for each site, allowing collection tasks to be created and run for each of the sites. If you are adding a collector, but the collector does not appear in this list, or if you have a trial license you want to use, go to System > License and click Update License. Follow the on-screen instructions in the Update License Wizard to upload or copy/paste an available license for the appropriate collector(s). Required Source Information Depending on which type of sources you add, you will need to specify the following information. An asterisk (*) indicates a required field. Source Data Field *Source Name Description *Type *Site *Archive Type *Location (Host name/ip) Account *Repository Description Type the name of your data source (up to 35 characters). Enter a description of the source (up to 255 characters). Enter or select the source type. (Example: PC). (EV Source only): Enter the site and select an archive type to be used for this EV source. For example, entering the site: EVVAULTSITE and selecting the EV Domino mailbox archive allows collections from any mailbox archives in Lotus Domino from within EVVAULTSITE. Note: For details, refer to the Source Setup section and follow the steps in "Symantec Enterprise Vault (EV)" in the Network Setup Guide. Enter the Host name or IP address to the location of the data source. Note: For Collectors, the full HTTP address is required (DocuShare and FileNet collectors, for example): For DocuShare: For FileNet: service identifier> Verify the correct location convention with your system administrator. Click Test to validate the source location as entered. For other sources, enter the path (for example, File Share or PC), or URL (SharePoint, Exchange, Lotus Domino servers) to the location of the data source. Enter the name of the source account you created, or click Browse to select one from the list of accounts. (Documentum Collector Source Only): Enter the name of the repository to use for collection from the Documentum source. (Multiple repositories may exist.) For example: docbank1

33 Setting up Data Sources: About Adding (or Importing) Sources to Your Data Map PAGE: 34 Source Data (Continued) Field Worksite *Object Store (imanage Collector Source Only): Enter the name of the worksite to use for collection from the imanage source. (Multiple worksites may exist.) For example: imgworksite1 (FileNet Collector Source Only): Enter the name of the object store to use for collection from the FileNet source. (Multiple object stores may exist.) For example: FNOS1 Custodian Type the name of the custodian associated with the data source (Example: John R. Smith), or click Browse to select one from the list of custodians. Group Collection Templates and Collection History Description Type the group name associated with the data source, or click Browse to select one from (or add a new one to) the list of groups. Indicates whether a template has been applied to the collection. (Click link to edit collection templates.) View list of collections and task details. Import Sources Using Bulk Import (from CSV or Script) If you have multiple sources to add to your data map, you can import them all at once from a pre-formatted CSV file located in your Active Directory, or from a script (already discovered in Clearwell). For more information about CSV and script formats, see Table Source Import File Format Requirements. Scripts are useful if you frequently update your source list information and want to schedule the script to run periodically. (See Schedule a Script Run on page 36.) To start importing sources, see To import sources (using bulk import) in this section. Bulk Import Format Requirements Before importing your sources, ensure your CSV file or script meets the following requirements. (Header fields can be in any order.) An asterisk (*) indicates a required field. Source Import File Format Requirements Format Requirements Rules Script CSV Write output CSV file in UTF-8 to STDOUT UTF-8