CONQUERING THE CHALLENGE OF SEARCHING CORPORATE DATA

Transcription

1 NUIX INFORMATION PAPER EV CONQUERING THE CHALLENGE OF SEARCHING CORPORATE DATA Authors: Stephen Stewart, Angela Bunting and Eddie Sheehy How Nuix s advanced ediscovery platform normalizes complex semi-structured and unstructured data sets to make them searchable for litigation, information management and information governance purposes.

2 INSIGHT PAPER: CONQUERING THE CHALLENGE OF SEARCHING CORPORATE DATA INTRODUCTION No-one likes to make critical decisions without knowing the facts. However, this is exactly what happens as an unintended consequence of the many ways organizations create, share and store their data. Organizations keep information in a wide variety of systems, each with its own file formats, retention policy and backup strategy. This mishmash of systems, combined with the proliferation of data, makes it a constant challenge to manage information throughout its lifecycle. It can also be difficult for organizations to answer seemingly simple questions such as:» How did client X receive client Y s intellectual property?» When did the product research department suspect that product Q was dangerous?» Can we delete all copies of this document stored in our system?» Where are all the relevant s and documents related to this contract?» How can we search 150 terabytes of random data? This paper will examine the difficulties organizations face when attempting to index and search a range of commonly used but problematic corporate data sets (see Structure is only part of the problem on page 3). These difficult data sets include:» Corporate archives» Encrypted or deleted items» Forensic collections» Lotus Notes and databases» Internet and instant messaging» Microsoft Exchange » Other Microsoft container formats» Microsoft SharePoint» Backup tapes containing any of the preceding data sets. These formats present multiple challenges for indexing and searching challenges that have real-world business implications. For organizations undergoing litigation, the race to find the relevant facts can shape an entire case strategy. An incomplete and inefficient ediscovery process can be costly, time-consuming and potentially destructive to a firm s reputation and value. It can put an organization at a tactical disadvantage, particularly if its opposition can turn up with full and detailed knowledge of the same evidence. Organizations have been known to accept outof-court settlements or fines because it would cost less than finding and producing relevant information that could prove their case. For information managers, auditors, investigators and security professionals, the initial challenge is to understand what information an organization possesses and where it resides. This situation is made worse because most organizations lack the capability to index and search systematically across their pools of unstructured and semi-structured data. The tools organizations commonly use to unlock information such as enterprise search, knowledge management and taxonomies generally cannot meet the requirements of regulatory actions, litigation or internal investigations. These tools are designed to provide rapid but shallow results, and are not completely thorough, accurate or consistent. In addition, they do not typically provide the results in formats or reports that are suitable for the purposes of ediscovery and information management. For example, the search engine Google can return results in seconds across a huge corpus of data: over one trillion web pages. However, it is designed to find the most frequently referenced data. For the purposes of investigations and litigation, the most relevant data can be sparse, single s that are often intentionally written to be obscure. This paper explains how Nuix s software and approach to ediscovery and information governance eliminates or alleviates many of these difficulties by indexing, normalizing and making searchable all of an organization s semi-structured and unstructured data, no matter how large or how complex the data sets. For ediscovery, this means acting from a position of strength, shortening the lifespan of investigations and empowering your legal teams to devise a winning case strategy early, based on knowledge rather than opinion or conjecture. For information managers, it means the ability to make strategic decisions about data by having a complete and thorough understanding of all data, important or otherwise, in their possession. Most organizations lack the capability to index and search systematically across their pools of unstructured and semi-structured data PAGE

3 THE DIFFICULTIES OF DATA If an IT administrator were asked to collect all available data an organization held about a particular person, what sources would he or she check? Most likely the administrator would make copies of user mailboxes on the organization s current system, and any documents from that user s home drive on corporate file shares and the SharePoint document management system. He or she might also copy files on that person s laptop or desktop computer; if that employee had already left the organization, this would likely be impossible. However, this search would only cover a fraction of the available data relating to this person. In a report published in 011, the McKinsey Global Institute estimated that by 009, companies in the United States with more than 1,000 employees stored an average of 00 terabytes of data or up to 00 gigabytes per user. A thorough search that captured all this data might also include files or s in an archive or a legacy system that the organization no longer used. The person may also have stored s on his or her computer hard drive, or used an online service such as Gmail or Hotmail. If the organization uses or used to use Lotus Notes, there could be information stored in Notes databases and personal folders as well as messages. Finally, if the person was trying to hide something, they may have deleted important information or attempted to obscure it in other ways. Searching through all this data is likely to include at least one retired system the administrator isn t familiar with accessing. For some legacy systems, it might even require setting up a server just to be able to read the data. Many older formats are difficult to decipher and require skills beyond those of the average IT administrator. This is especially the case if the documents are required for legal reasons, because they must be collected without altering critical metadata such as the time a file was last accessed or a message sent. It would also be a time-consuming exercise. Since these data sources must be opened in separate proprietary applications, the administrator would have to search through each data type individually. The more systems involved, the more difficult a search would become and the longer it would take. As you can imagine, this situation is not hypothetical. Organizations often need to gather all available information about a particular person or event for use as evidence in a court case, regulatory action, audit or investigation. Just as importantly, many businesses and government agencies also want to manage and draw insights from their data, including the unstructured data in s and documents. This is not possible until the data is normalized through an indexing process that enables organizations to search consistently across all data containers and file types. STRUCTURE IS ONLY PART OF THE PROBLEM Organizations store data in structured formats such as databases; unstructured formats such as documents; and semi-structured formats such as , where some information is held in database fields and some in plain text and attachments. A thorough search must encompass all these data types. Structured formats such as databases and enterprise applications present the least difficulty their main purpose is to allow organizations to search, sort and manipulate the data they contain. Unstructured data stored in document management systems is also easy to search, because these systems are designed to be searchable and to retain metadata. And file shares present no great challenge for searching because they require no special software to read. The most challenging data sets are those that use closed, proprietary formats. To search these formats, many organizations use the original vendor s built-in tools or data interfaces, or a labor-intensive process to convert files to a more readable format. However, neither of these techniques fully preserves information such as look and feel, metadata or custody chain, which can be essential for legal or information governance purposes. Organizations often need to gather all available information about a particular person or event for use as evidence in a court case, regulatory action, audit or investigation PAGE 3

4 INSIGHT PAPER: CONQUERING THE CHALLENGE OF SEARCHING CORPORATE DATA NORMALIZING DATA Data held in corporate servers, databases, systems and file servers is stored in a variety of proprietary formats. The simplest way to think about this is to consider that Adobe Photoshop cannot open Microsoft Word documents and Word can t open Photoshop files. Similarly, Lotus Notes cannot easily access information stored in a Microsoft Exchange Server database and vice versa. To search through these systems, organizations must break down the data containers to smaller components and organize them with an indexing tool. This indexing tool must be able to process the major data containers organizations use regularly and scale to manage large quantities of data. Normalizing data requires an application that can interrogate each file format and proprietary system, and index all this data into a single location. Once data has been normalized, it can be searched faster, more accurately, more thoroughly and more reliably, and used to make informed decisions. rfevm_xz@eioe.com.au Xdkqmwh@Jeuxutko@smj.pnwt.com cnl-mzqy_vswmywaralt@cjj.com.au Fdjate.Zve@ufr.com.au Uwhilgr_Ihs@NrqnhznikeGqhloq.com.au Ukzza.Iuarfojoum@hio.com.au oivi@dxostel.com.au victorh@nuix.com.au AzmvY1@rhy.dbn.au jcakofq@eioe.com.au WLp@lekd.com.au sachin@nuix.com.au Fpojwum.Ly@touswkwej.com.au zidk.szctd@db.com Rajesh.Brown@bank.com.au Sindu.O Reilly@bank.com.au vik@nuix.com.au minh@nuix.com.au Figure 1: Nuix Network Map showing the distribution of relevant s and documents BUSINESS CHALLENGES Without the ability to holistically analyze, search and compare information from many difficult data sources, organizations face a number of business challenges. For ediscovery In-house teams or organizations such as consulting, litigation support and legal firms that offer ediscovery services need a complete, defensible, thorough and repeatable forensic discovery process that stands up to ever-increasing legal scrutiny. The ediscovery process has as much to do with tactics as it does equity or the law. The side with the most efficient and effective discovery process can often win a dispute based on its ability to investigate all the data in its possession and present evidence the other party cannot. If investigators cannot interrogate multiple systems for example a Microsoft Exchange database and a Symantec Enterprise Vault Archive at the same time, they will have to manually and individually break them down to their component pieces, such as messages and documents, which adds greatly to the time, labor and costs involved. It also limits their ability to compare information between the different data sets. For information management and governance Organizations conducting business intelligence, data deduplication or information governance exercises must deal with growing volumes of data and an increasing number of formats. Tools such as corporate archives and business intelligence applications do not allow information management specialists to search thoroughly or apply rules consistently across multiple unstructured data sets. As a consequence, organizations lack confidence that their information management and governance processes are addressing all the data in their possession, or that they are addressing it all with a consistent level of precision. This is particularly important in the case of archiving or deleting data, where organizations need to have a defensible process for deciding what data to keep and what to remove. In addition, if organizations choose to delete data, it is important to ensure they remove all copies of that information and have sufficient audit reporting to demonstrate how they determined what data to delete. Once data has been normalized, it can be searched faster, more accurately, more thoroughly and more reliably, and used to make informed decisions PAGE 4

5 DATA SET CHALLENGES AND SOLUTIONS Many of the formats organizations regularly use for storing data are difficult to index and search for a variety of technical reasons. In many cases, organizations have developed workarounds for their inability to index these formats, but these are often deficient. Direct (To) Indirect (Cc) Hidden (Bcc) Paul Smith <okxkkojm@frisco.com> Victor Vdoqup <victorh@nuix.com.au> 13/01/ /01/ /01/ /01/ For each of the following formats, this paper will discuss technical difficulties and alternative approaches, and examine how Nuix advanced ediscovery technology can address these problems. skhoo@cac.com.au Law, Mary [IT] <Mary.Law@bank.com> imh@substitution-z.com Corporate archives Corporate archives first emerged in the late 1990s as a way for organizations to manage their storage and regulatory compliance needs. Many organizations were required by law to retain data for long periods, but storage hardware was expensive. As these requirements mounted, organizations increased the scope of their archived data. Their goal was to have a single, easily searchable repository for all corporate information. However, most organizations archiving initiatives have failed to deliver this intended business value. By design, archives are intended to store tremendous volumes of information for many years. Because disk drives were once expensive, archiving vendors decided it was best to minimize the size and scope of their indexes. These early design decisions have become a major hindrance to using archives as ediscovery tools. Archives don t index all the necessary information, including a large proportion of the metadata and some data that may be necessary for a defensible legal search. In addition, archives reliance on a large number of small indexes translates to poor search performance. Nuix s advanced ediscovery technology directly indexes all data stored in popular archive formats such as Symantec Enterprise Vault and EMC Xtender. This allows Nuix users to search all data in an archive rather than relying on these products incomplete internal indexes. In fact, a Nuix index will be between 0 and 5 per cent the size of the original data set. Nuix tools collect all available information, including text from all files, s and attachments; all metadata; and information the original manufacturers never expected anyone to look at. Nuix s processing engine is fast and thorough. It can index terabytes of archive content per day from a single server. Hfqdh_Dy@smj.pnmt.com iksjj.nonptbklsj@cddweou.com Hudg Hdzep <zidk.szctd@db.com> Fpojwum.Ly@vouswkwej.com.au akas@jyandmnis.com Uwhilgr_Ihs@NrsnhznikeGbflop.com.au cnl-mzqy_vsmywaralt@cjj.com.au Xdmwh_Jeutcgko@smj.pnwt.com.au Figure : Nuix Event Map showing the distribution of a high-value document within and outside an organization. NUIX AND CORPORATE ARCHIVES» A global financial services group had eight terabytes of Microsoft Exchange databases in a Symantec Enterprise Vault archive. Symantec Enterprise Vault Discovery Accelerator could not interrogate this archive to the level of detail required for an ediscovery exercise. The company used Nuix software, which processed the archives directly and provided real-time ediscovery services. The Nuix application now runs weekly updates to index any new data added to the archive.» The regional branch of an international banking group needed to conduct an in-house review of executive communications, including archived content. The Nuix ediscovery solution was delivered and installed and the team of investigators trained to use it within 4 hours. At the end of the project, the organization retained a Nuix server for ongoing use. Nuix s advanced ediscovery technology directly indexes all data stored in popular archive formats such as Symantec Enterprise Vault and EMC Xtender PAGE 5

6 INSIGHT PAPER: CONQUERING THE CHALLENGE OF SEARCHING CORPORATE DATA Figure 3: Nuix decrypting a Lotus Notes.nsf file during processing. Lotus Notes and databases For many years, Lotus Notes was a market leader with organizations that needed secure internal communications and collaboration spaces. These attributes explain why Notes is still entrenched in a large number of pharmaceutical and financial services firms. The capabilities that made Lotus Notes so appealing its ability to be customized, to replicate from one server to another and to set multiple security levels also cause the greatest headaches for electronic investigations. For example, if users have set privileges on individual messages, these messages can sometimes still be retrieved even if a user believes he or she deleted them. Most ediscovery tools simply cannot extract Lotus Notes content and metadata in full fidelity. Often they do not index Lotus Notes databases, calendars and journal notes, which may contain important evidence. Many of these tools convert Lotus Notes databases to PST files, the personal store format used by the Microsoft Outlook client. This process destroys the original format by altering key metadata and the nature of the messages themselves. Lotus Notes databases are typically encrypted and most investigative tools individually decrypt each user mailbox. This approach is slow and inefficient, adding time to an investigation. If an organization has archived Lotus Notes data, either in a Notes Journal or a third-party archive, this adds another level of challenge, cost and delay for investigators. Nuix stands alone in its ability to provide full access and fidelity to all Lotus Notes content and metadata. This is because Nuix software uses IBM s recommended best practice for addressing Lotus Notes content in its native format: Domino extensible Language (DXL). This methodology gives Nuix indexing software full access to the contents of calendars, databases, discussion databases, document libraries, s, TeamRoom databases and all Notes system databases. Nuix also recognizes and itemizes all standard and user-created Notes folders so investigators can see exactly where a user filed an item. On a high-end server, Nuix can process up to one million Lotus Notes items per hour. On a high-end server, Nuix can process up to one million Lotus Notes items per hour PAGE 6

7 NUIX AND LOTUS NOTES A global financial services organization needed to investigate the Lotus Notes data of more than 50 custodians while ensuring all data remained behind its firewall. It engaged an advisory firm, which implemented a Nuix plug-and-play appliance. The Nuix appliance processed data from current and archived database formats at speeds of more than one terabyte per day. The Nuix tool allowed the investigators to review all available data while preparing for litigation. During the case, as witnesses were deposed, investigators could use the Nuix server to drill down into the most specific and pertinent information. Internet Investigators often find critical evidence in online services such as Gmail, Hotmail or Yahoo! Mail. This can happen when, for example, an employee uses a webmail service to leak confidential information. Being able to extract information from online mail services, provided the organization can access the user s login credentials, can be vital to ediscovery and information governance exercises. However, these services by their nature store information on servers located around the world and outside the control or access of organizations performing investigations. Nuix ediscovery solutions use typical internet protocols such as POP and IMAP to connect to remote servers and download a copy of the entire mailbox, which can then be indexed and searched like any other . A global cosmetics manufacturer engaged a Big Four consulting firm to provide forensic services for a US Foreign Corrupt Practices Act investigation spanning 11 countries. The consultant turned to Nuix because its existing tools couldn t handle the multiple terabytes of Lotus Notes data in various Asian languages. The Big Four firm now uses the Nuix platform as standard in its North American processing services. Figure 4: Nuix collecting internet-based . Most ediscovery tools simply cannot extract Lotus Notes content and metadata in full fidelity PAGE 7

8 INSIGHT PAPER: CONQUERING THE CHALLENGE OF SEARCHING CORPORATE DATA Encrypted or deleted items Deleted items can be the best evidence of wrongdoing. Investigators know the information someone has tried to hide is often the most relevant evidence. In addition to deleting data, people who have something to hide can use a variety of other techniques to obfuscate the truth. For example, they may change the file extensions so they appear to be another document type; some indexing tools skip a file where the content doesn t appear to match the extension. They may also attempt to obscure the location of items by embedding them many layers deep in attached files or compressed folders. Information hidden in these ways can be difficult to access using many common ediscovery and forensic investigation tools, especially those that rely on application programming interfaces (APIs) to retrieve data. Permanently deleted or encrypted s are usually impossible to retrieve using APIs. Figure 5: Nuix allows you to look inside forensic collection formats and choose which elements are required for processing. NUIX AND FORENSIC COLLECTIONS When organizations suspect criminal intent, a quick response is essential. Facing the prospect of criminal activity, organizations often create forensic images of large numbers of systems. However, the tools that create these collections were designed to perform deep analysis of single images, not to rapidly process large of numbers of images in parallel. Adding Nuix technology delivers the ultimate forensic triage. Nuix can index all active files across hundreds of images. After the initial indexing run, investigators can search the entire collection. If they smell smoke, they can use forensic tools to deeply analyze the most relevant images. Nuix technology takes a forensic approach. It can extract deleted messages from Microsoft Exchange databases and offline file storage formats, and index deleted files in a forensic image of a user s hard drive. It examines files at a binary level, rather than guessing at their content from the extension. Nuix can also extract and index information from embedded files more than 100 levels deep. These capabilities enable Nuix users to find s and documents that are hidden, encrypted, deleted or stored in other ways to conceal their identity. Forensic collections Forensic collection technologies generally create an image of every 0 and 1 on any given hard drive. This provides a complete picture of the data, but no meaningful information about the complex containers it may contain, such as servers, SharePoint databases and deleted files. Common forensic collection tools include Guidance s EnCase, Access Data s Forensic Toolkit, and a variety of hardware and software tools that acquire direct disk images. While these tools are very good at their intended purpose capturing a point-in-time image of data without modifying important metadata such as the date a file was accessed their indexing capabilities are limited and don t scale well to large data sets. With Nuix advanced ediscovery software, investigators can view the contents of a forensic collection and select which parts need to be indexed. If the entire collection needs indexing, Nuix can process terabytes per day using a single server. These capabilities enable Nuix users to find s and documents that are hidden, encrypted, deleted or stored in other ways to conceal their identity PAGE 8

9 Microsoft Exchange Microsoft Exchange has emerged as the world s dominant platform. Exchange presents significant challenges for investigators and IT administrators alike because its storage format was never designed to scale to the requirements of large organizations. Its original designers also gave little consideration to the potential need for effective ediscovery, although Microsoft has made improvements in recent years. Microsoft s proprietary file format makes it difficult for ediscovery software to process Exchange databases. As a result, many investigators use a range of laborintensive workarounds. For example, legal teams may ask IT administrators to extract the individual mailboxes of identified custodians into PST files. However, this approach only works well if the database is current and the discovery is confined to a small number of known people. The situation is much more complex when dealing with data from older versions of Microsoft Exchange. To extract information from these databases, IT teams must first recreate the original Microsoft Exchange environment. This process takes specialist expertise, time and money, and needs to be repeated each time investigators want to extract additional information. Nuix advanced ediscovery software can directly process current and legacy Microsoft Exchange databases including all s, attachments, metadata and images at rates of multiple terabytes per day. In the preprocessing stage, investigators can view the structure of an Exchange database and choose which mailboxes to extract and index. Nuix then extracts all relevant text, metadata and images, including permanently deleted or encrypted information. Nuix can extract and index information from embedded files more than 100 levels deep. Though it seems unlikely, important information could be held within an image, in a document embedded in a spreadsheet, attached to an message stored in a PST file, which was compressed and ed to someone else. Investigators can search on all communication fields from, to, carbon copy and blind carbon copy to examine the chain of custody. Nuix software can also identify identical documents in multiple users mailboxes and trace who sent what to whom either within the organization or to external recipients. Figure 6: Nuix can process an entire Microsoft Exchange database or just the mailboxes of custodians of interest. NUIX AND MICROSOFT EXCHANGE A regulator needed to conduct onsite investigations focused around . In some cases, multiple investigators needed to access the same case data simultaneously. It used a Nuix ediscovery solution to quickly process relevant Microsoft Exchange databases, disk images and other unstructured data. A leading advisory group was conducting an onsite fraud investigation for a large global organization, which needed to be completed as quickly as possible. Using Nuix, it directly indexed and searched across the organization s Microsoft Exchange system. It then extracted mailboxes for the relevant custodians and used Nuix to index and analyze forensic images of employees hard drives, which turned out to contain important evidence. A leading advisory group was working for a corporate client in Asia on a regulatory investigation that needed to search two terabytes of Microsoft Exchange databases and archives. The project team used Nuix software on high-specification laptop computers to collect, process, investigate and review data onsite. Nuix extracts all relevant text, metadata and images, including permanently deleted or encrypted information PAGE 9

10 INSIGHT PAPER: CONQUERING THE CHALLENGE OF SEARCHING CORPORATE DATA Microsoft SharePoint Microsoft SharePoint is a powerful framework for collaboration and document management, but can be a nightmare for investigators. While it is relatively simple to extract documents stored in a SharePoint database, some investigations can hinge on being able to demonstrate what a particular person could see on a particular day. Many ediscovery applications require software (an agent) to be installed on the SharePoint server to extract information from the database. IT managers are unlikely to be pleased about installing unknown software on their critical systems, because it may present a security risk or an unacceptable drain on server resources and performance. Requiring an agent makes it impossible to retrieve data from a hosted SharePoint service, because the third-party provider would be at least as wary of installing unknown software on their systems. Some ediscovery applications work with a backup of the SharePoint database. However, this approach does not capture the look and feel of the SharePoint site. It only extracts the raw data and does not enable investigators to present the content as it would have appeared in a user s web browser. In addition, most ediscovery tools only focus on documents and ignore dynamic content such as wikis, blogs, meetings, notifications, links and lists. Other tools are capable of indexing this content but do a bad job of representing it as the user would see it. Nuix advanced ediscovery applications can collect and index SharePoint databases without installing an agent on the server. Nuix s technology can also extract data from SharePoint Online data stored in the cloud. Nuix tools render SharePoint pages with 100 per cent fidelity, in context, producing an exact HTML representation of the page as the user would see it. It also extracts all metadata associated with a given page from the SharePoint database. In other words, Nuix allows investigators to see exactly what a specific custodian could access on a particular day. Figure 7: Nuix is able to collect all SharePoint information. Other Microsoft container formats When conducting investigations, many organizations simply examine the data stored in a central server. However, for organizations where staff members use Microsoft Outlook or Outlook Express to access their , important data can also be stored on users local hard disks. Microsoft Outlook stores data in PST (personal store) and OST (offline store) files; Microsoft Outlook Express stores data in DBX files. For example, it is not uncommon for users to copy or archive older messages to a PST folder on their local hard drive if their main mailbox runs out of space. Some ediscovery applications cannot open OST or DBX files. Others use the Microsoft Messaging Application Programming Interface (MAPI), which can extract text, attachments and a limited set of metadata. MAPI does not return permanently deleted data, which is often critical to an investigation. In addition, MAPI was designed to provide a single connection between a file and a mail server. By default, this limits the performance of extracting data using MAPI. Nuix software extracts all text, metadata and images from Microsoft container formats, including permanently deleted and encrypted information. Nuix extracts this information directly from the binary streams of the container files, rather than using MAPI, which means they can index any content much faster. Nuix tools render SharePoint pages with 100 per cent fidelity, in context, producing an exact HTML representation of the page as the user would see it PAGE 10

11 Backup tapes Information stored in backup tapes creates an ediscovery minefield. Because magnetic tapes deteriorate with age, courts and regulators now give organizations some wiggle room to declare backup tapes inaccessible. Nonetheless, an opposing party could build a compelling case to be allowed to sample these tapes, in case they still contained some readable data. The fear of this possibility has led many organizations to proactively search and analyze their tape repositories. To do so, they must first restore the tapes, then use whatever tools they have available to determine the contents of these tapes. For data in an older format, they may have to rebuild a server capable of reading it. Nuix s ability to index file formats including older Microsoft Exchange and Lotus Notes databases makes it well suited to indexing restored tapes for the purposes of searching or deduplication. This ability eliminates the need to preprocess restored files or rebuild old servers. With Nuix, an organization can simply restore old files or databases to disk, then point the indexing software at the files and allow it to completely index the content. With this index, an organization can search, analyze and deduplicate data. This can be a final step towards disposing of tapes and eliminating the associated liabilities. BUSINESS BENEFITS The ability to directly index difficult data types shortens litigation and investigative lifecycles saving time and costs and potentially avoiding corporate embarrassment. From an information management point of view, it allows mangers to interact with all the data in their care. These capabilities can help organizations improve operational efficiencies and eliminate risks. For ediscovery For organizations engaged in ediscovery exercises, Nuix s advanced capabilities can help them access the facts of the case as soon as possible. By indexing all available data in its original containers, investigators can search efficiently and interactively for key documents within hours or days of collection. This early case assessment in turn empowers legal teams to set a smart strategy based on facts rather than opinions or guesswork. Being able to review all available data and metadata enables investigators to find evidence quickly, Shortening the timeframe of investigations. The ability to process and interrogate all data types from a single tool simplifies workflows. Faster investigations and simplified workflows translate to lower costs for ediscovery teams and their clients. ediscovery teams can use Nuix to export data to any of the most commonly used litigation formats. Nuix tools also enable them to export a sub-case of only the relevant data. They can pass on a Nuix sub-case to investigators, law firms, advisory firms and regulatory authorities, many of which use Nuix as their preferred tool. For information management and governance Organizations gain the ability to make strategic decisions by having a complete and thorough understanding of all important data in their possession. With this understanding, they can:» Extract patterns and insights from semi-structured and unstructured data, such as identifying fraud by searching for trigger words in staff s» Remove redundant data, such as multiple copies of the same stored across numerous daily backups» Delete spam, irrelevant content or valueless items from data stores; in this case Nuix provides a defensible and repeatable process for deleting unneeded data» Ensure information remains where it is supposed to be, for example by testing if employees are storing confidential documents in lesssecure locations, or ing them outside the organization» Conduct company-wide sentiment analysis, alerting managers early to potential problem areas or individuals in the organization» Automatically search for words or phrases that indicate unprofessional behavior or conduct that does not comply with company policies. Nuix also offers storage and processor-efficient indexing that won t disrupt business as usual. These capabilities can help organizations improve operational efficiencies and eliminate risks PAGE 11

12 NUIX INFORMATION PAPER HOW THOROUGH IS NUIX? Nuix s advanced ediscovery and information governance platform:» Interrogates all metadata, text and binary data to forensically identify all relevant information» Keeps intact the chain of custody of each document or message indexed» Stores and analyzes images, extracting text from files such as faxes and Adobe Acrobat PDF documents that contain scanned text» Breaks open the internal structure of file formats, allowing investigators to choose which files, mailboxes or databases they want to look at» Can dig up to more than 100 levels deep into embedded, attached and compressed files. Further reading: The Truth About Indexing: Why fast, powerful and forensically sound indexing is the only way organizations can fully and efficiently manage and search their electronic communications and data stores Lotus Notes Information Paper: How Nuix mitigates the unique challenges posed by Lotus Notes for ediscovery and electronic investigation ABOUT NUIX Nuix is a worldwide provider of information management technologies, including ediscovery, electronic investigation and information governance software. Nuix solutions scale to meet the needs of the smallest or largest organizations, making it faster and easier to undertake investigations and data management activities, no matter the size or complexity of the data sets.nuix customers include the world s leading advisory firms, litigation support providers, enterprises, government departments, law enforcement agencies and all of the world s major corporate regulatory bodies. Asia Pacific EMEA North America sales@nuix.com // nuix.com // twitter.com/nuix Copyright 011 Nuix. All rights reserved.