(12) Ulllted States Patent (10) Patent N0.: US 8,250,037 B2 Andersen et a]. (45) Date of Patent: Aug. 21, 2012

Transcription

1 US B2 (12) Ulllted States Patent (10) Patent N0.: US 8,250,037 B2 Andersen et a]. (45) Date of Patent: Aug. 21, 2012 (54) SHARED DRIVE DATA COLLECTION TOOL 1 gélgle et a1~ l FOR AN ELECTRONIC DISCOVERY SYSTEM,, 7,451,103 B1 JemanZe et a. 11/2008 Boyle et 31 (75) Inventors: David M. Andersen, Charlotte, NC 7,451,139 B2 7,765,181 B2 11/2008 N b 7/2010 Tflflmjs et al (US); Emerson D. Miller, Charlotte, NC 7,895,229 B1 2/2011 Paknad (Us) 8,073,729 B2 12/2011 Kisin et a / A1 12/2002 ReitZ - _ / A1 12/2002 Ellis (73) Assrgnee. Bank ofamerlca Corporation, mun/ Al 8/2003 Thomas et a1 Charlotte, NC (Us) 2003/ A1 9/2003 Zhu et al. ( * ) Notice: Subject to any disclaimer, the term of this (Connnued) $2318 ifsi gltde llfsrdadjusted under 35 FOREIGN PATENT DOCUMENTS... y a s. y EP A2 4/2001 (21) App1.No.: 12/627,996 (Continued) (22) Filed: Nov. 30, 2009 OTHER PUBLICATIONS _ Singapore Patent Application No Search Report and (65) Pnor Pubhcatlon Data Written Opinion mailed Sep. 5, US 2010/ A1 Sep. 30, 2010 (Continued) Related US. Application Data Primary Examiner i Kuen Lu (60) Provisional application No. 61/164,276,?led on Mar. (74) Azwrney, Agenz, or Firm i Michael A, Springs; Moore 27, and Van Allen, PLLC; PadoWithZ Alce (51) Int. Cl. (57) ABSTRACT G06F 7/00 (200601) Embodiments of the invention relate to systems, methods, G06F 17/30 ( ) d d f. d 1. d. 52) U 5 Cl 707/641_ 707/802 an computer program pro~uct~s or rmprove e ectronrc 1s ( _' ' ' """ "_' """ "_""""""""""" " covery. Embodrments herern drsclosed provrde for an enter (58) Field of ~Classi?cation Search /641 prise Wide electronic management Server that provides for See apphcanon?le for Complete Search hlstory' data to be identi?ed, located, retrieved, preserved, searched, (56) References Cited reviewed and produced in an e?icient and cost-effective man ner across the entire enterprise system. In addition, by struc U.S. PATENT DOCUMENTS turing management of e-discovery based on case/matter, cus todian and data and providing for linkage between the same, further ef?ciencies are realized in terms of identifying, locat ing and retrieving data and leveraging results of previous e-discoveries With current requests. 6,119,137 A 9/2000 Smith et al. 6,601,108 B1 7/2003 Marmor 6,658,625 B1 12/2003 Allen 6,941,361 B1 9/2005 Fink et al. 7,076,543 B1 7/2006 Kirti et a1. 7,124,249 B1* 10/2006 Darcy / Claims, 14 Drawing Sheets 1 209

2 US 8,250,037 B2 Page 2 US. PATENT DOCUMENTS 2003/ A1 10/2003 Tameda et al. 2004/ A1 * 5/2004 Seidenberg et al / / A1 12/2004 Adelstein et al. 2005/ A1 4/2005 ShimiZu et al. 2005/ A1 7/2005 HoshiZawa 2005/ A1 8/2005 Morris et al. 2006/ A1 5/2006 Nakamura et al. 2006/ A1 7/2006 Lee et al. 2006/ A1 11/2006 Seier et al. 2007/ A1 2/2007 Lee et al. 2007/ A1 3/2007 Erickson et al. 2007/ A1 4/2007 Brannon et al. 2007/ A1 5/2007 McCreight et al. 2007/ A1 7/2007 Ross 2007/ A1 9/2007 Harbin et al. 2007/ A1 9/2007 Sun 2007/ A1 2007/ A1 2008/ A1 2008/ A1 2008/ A1 2008/ A1 2008/ A1 2008/ A1 2008/ A1 2008/ A1 2009/ A1 2009/ A1 2009/ A1 11/2007 Finkelman et al. 12/2007 Schunemann 1/ 2008 CombaZ 2/ 2008 Ghielmetti et al. 3/ 2008 Komaki 4/ 2008 Garrett 7/ 2008 Wilson 10/2008 Stratton 11/2008 Paknad et al. 11/2008 Simpson et al. 1/2009 Asher et al. 1/2009 Newell et al. 2/2009 Searl et al. 2009/ A1 5/2009 Paknad 2009/ A1 6/2009 Fahey 2009/ A1 6/2009 Paknad et al. 2009/ A1 7/2009 Kates 2009/ A1 2010/ A1 2010/ A1 2010/ A1 2010/ A1 2010/ A1 2010/ A1 11/2009 Kisin et al. 1/2010 SaltZman et al. 2/2010 Tischler et al. 4/2010 Kisin et al. 4/2010 Ogawa et al. 8/2010 Losey 9/2010 Quinn, Jr. 2011/ A1 2/2011 Paknadetal. 2011/ A1 7/2011 Paknadetal. FOREIGN PATENT DOCUMENTS EP A2 1/2003 WO 01/27765 A1 4/2001 WO A2 2/2002 WO A2 9/2002 WO 03/ A1 8/2003 WO A2 10/2004 WO A2 1/2006 WO A2 3/2006 W0 WO 2006/ A2 3/2006 WO A2 5/2006 WO 2007/ A2 4/2007 WO A2 7/2007 W0 WO 2007/ /2007 WO A1 1/2008 WO A2 6/2008 W0 WO 2008/ A2 6/2008 OTHER PUBLICATIONS Singapore Patent Application No Search Report and Written Opinion mailed Sep. 5, Singapore Patent Application No Search Report and Written Opinion mailed Sep. 27, US. Appl. No. 12/534,375,?led Aug. 3,2009. U.S. Appl. No. 12/614,059,?led Nov. 6, US. Appl. No. 12/618,430,?led Nov. 13,2009. U.S. Appl. No. 12/618,443,?led Nov. 13,2009. U.S. Appl. No. 12/627,791,?led Nov. 30, US. Appl. No. 12/627,890,?led Nov. 30, US. Appl. No. 12/696,653,?led Jan. 29, US. Appl. No. 12/702,641,?led Feb. 9,2010. U.S. Appl. No. 12/729,987,?led Mar. 23, US. Appl. No. 12/730,780,?led Mar. 24, US. Appl. No. 12/730,785,?led Mar. 24, US. Appl. No. 12/730,790,?led Mar. 24, US. Appl. No. 12/730,792,?led Mar. 24, US. Appl. No. 12/730,799,?led Mar. 24, US. Appl. No. 12/730,807,?led Mar. 24, US. Appl. No. 12/730,818,?led Mar. 24, US. Appl. No. 12/730,821,?led Mar. 24, US. Appl. No. 12/730,840,?led Mar. 24, US. Appl. No. 12/730,848,?led Mar. 24, US. Appl. No. 12/730,851,?led Mar. 24, US. Appl. No. 12/731,657,?led Mar. 25, J. Barlow, L. Bean andd.d. Hott: Employee Spy Software: Should You Use It? The Journal of Corporate Accounting & Finance, Docu ment No. XP , pp. 7-12; Retrieved from the Internet: URL: onlinelibrary.wiley.com/ 1 0i1002/ icaf / abstract [retrieved on Sep. 17, 2010]. Dan Manson et al.: Is the Open Way a Better Way? Digital Forensics using Open Source Tools, Proceedings of the 40 Hawaii Interna tional Conference on System Sciences-2007 [dated Jan. 1, 2007]; 10 pages total. Anonymous: EDRM LegalTech 2009 Luncheon Presentation, E.D.R.M.iThe Electronic Discovery Reference Model; Document No. XP LegalTech Lunch & Learn, Feb. 3, 2009, LegalTech New York; Retrieved from the Internet: URL:http//edrm. net/002/wp-content/uploads/2009/09/edrmilegaltech.pdf [retrieved Sep. 17, 2010]. Extended European Search Report dated Sep. 22, 2010 for European Application No. EP Ciravegna et al.: User-System Cooperation in Document Annota tion based on Information Extraction Proceedings of the 13th International Conference on Knowledge Engineering and Knowl edge Management. BuchholZ et al.: On the Role of File System Metadata in Digital Forensics, Journal of Digital Investigation, vol. 1(4), pp , Dec. 1, Golden et al. Scalpel: A Frugal, High Performance File Carver 2005 Digital Forensic Research Workshop (DFRWS) New Orleans, LA. Manson et al.: Is the Open Way a Better Way? Digital Forensics using Open Source Tools. System Sciences, HICSS th Annual Hawaii International Conference On, IEEE, PI, Jan. 1, ISBNz Berinato: The Rise of Anti-Forensics http/ article/print/ Jun. 8, Anonymous: EDRM LegalTech 2009 Luncheon Presentation E.D. RM. The Electronic Discovery Reference Model Feb. 9, Retrieved from the Internet: plugins/download-monitor/download.php? id:6. Singapore Patent Application No Search Report and Written Opinion mailed Aug. 3, Singapore Patent Application No Search Report and Written Opinion mailed Aug. 3, Singapore Patent Application No Search Report and Written Opinion mailed Aug. 3, Singapore Patent Application No Search Report and Written Opinion mailed Aug. 3, Singapore Patent Application No Search Report and Written Opinion mailed Aug. 15, Singapore Patent Application No Search Report and Written Opinion mailed Aug. 19, Singapore Patent Application No Search Report and Written Opinion mailed Aug. 24, Singapore Patent Application No Search Report and Written Opinion mailed Aug. 25, Singapore Patent Application No Search Report and Written Opinion mailed Aug. 25, SysTools Software, Export NotesiNotes Migration T001, 2008, available online: / Process Text Group, ABC Amber BlackBerry Converter, 2008, available online:

3 US 8,250,037 B2 Page 3 Search Report and Written Opinion for Singapore Application No mailed Jan. 3, Search Report and Written Opinion for Singapore Application No mailed Jan. 3, Search Report and Written Opinion for Singapore Application No mailed Jan. 3, Search Report and Written Opinion for Singapore Application No mailed Feb. 10,2012. Second Written Opinion for Singapore Application No mailed Mar. 14, Second Written Opinion for Singapore Application No mailed Mar. 14, Second Written Opinion for Singapore Application No mailed Mar. 14, Second Written Opinion for Singapore Application No mailed mar. 14,2012. Danish Patent and Trademark Of?ce. Singapore Examination Report mailed Mar. 15, Applicant: Bank of America Corporation. Singapore Patent Application No DKPTO SE No. SE v. English Language. 10 pages. Date of Examination Report: Mar. 12,2012. Danish Patent and Trademark Of?ce. Singapore Examination Report mailed Mar. 15, Applicant: Bank of America Corporation. Singapore Patent Application No DKPTO SE No. SE y. English Language. 10 pages. Date of Examination Report: Mar. 12, Second Written Opinion for Singapore Application No mailed Mar. 21, European Of?ce Action for Application No dated Apr. 2 5, European Of?ce Action for Application No dated Apr. 2 5, European Of?ce Action for Application No dated Apr. 2 5, European Of?ce Action for Application No dated Apr. 2 5, European Of?ce Action for Application No dated Apr. 2 5, European Of?ce Action for Application No dated Apr. 2 5, European Of?ce Action for Application No dated Apr. 2 5, European Of?ce Action for Application No dated Apr. 2 5, European Of?ce Action for Application No dated Apr. 26, European Of?ce Action for Application No dated Apr. 26, European Of?ce Action for Application No dated Apr. 27, Second Written Opinion for Singapore Application No dated Apr. 5, European Of?ce Action for Application No dated Apr. 26, European Of?ce Action for Application No dated Apr. 26, European Of?ce Action for Application No dated Apr. 26, European Of?ce Action for Application No dated Apr. 25, European Patent Of?ce. European Of?ce Action dated Apr. 26, European Application No Name ofapplicant: Bank of America Corporation. English Language. 10 pages. European Patent Of?ce. European Of?ce Action dated Apr. 26, European Application No Name ofapplicant: Bank of America Corporation. English Language. 10 pages. European Patent Of?ce. European Of?ce Action dated Apr. 26, European Application No Name ofapplicant: Bank of America Corporation. English Language. 10 pages. European Patent Of?ce. European Of?ce Action dated Apr. 26, European Application No Name ofapplicant: Bank of America Corporation. English Language. 10 pages. European Patent Of?ce. European Of?ce Action dated Apr. 25, European Application No Name of Applicant: Bank of America Corporation. English Language. 10 pages. European Patent Of?ce. European Of?ce Action dated Apr. 25, European Application No Name ofapplicant: Bank of America Corporation. English Language. 10 pages. European Patent Of?ce. European Of?ce Action dated Apr. 25, European Application No Name ofapplicant: Bank of America Corporation. English Language. 11 pages. European Patent Of?ce. European Of?ce Action dated Apr. 27, European Application No Name ofapplicant: Bank of America Corporation. English Language. 10 pages. European Patent Of?ce. European Of?ce Action dated Apr. 25, European Application No Name ofapplicant: Bank of America Corporation. English Language. 10 pages. European Patent Of?ce. European Of?ce Action dated Apr. 25, European Application No Name ofapplicant: Bank of America Corporation. English Language. 10 pages. European Patent Of?ce. European Of?ce Action dated Apr. 25, European Application No Name ofapplicant: Bank of America Corporation. English Language. 10 pages. European Patent Of?ce. European Of?ce Action dated Apr. 26, European Application No Name ofapplicant: Bank of America Corporation. English Language. 10 pages. Great Britain Intellectual Property Of?ce. GB Examination Report dated Apr. 23, Great Britain Application No. GB Name of Applicant: Bank of America Corporation. English Lan guage. 3 pages. Hewlett Packard. HP Open Wew Storage Data Protector Concepts Guide. Release A Manufacturing Part Number: B English Language. Jul Hungarian Intellectual Property Of?ce. Written Opinion mailed Apr. 5, Hungary Application No Name ofapplicant: Bank of America Corporation. English Language. 8 pages. Date of Written Opinion: Mar. 21, Hungarian Intellectual Property Of?ce. Written Opinion mailed Apr. 5, Hungary Application No Name ofapplicant: Bank of America Corporation. English Language. 8 pages. Date of Written Opinion: Mar. 29, * cited by examiner

4 US. Patent Aug. 21, 2012 Sheet US 8,250,037 B2 EE {0352 3:92am a 226m 62% :mem 3:92am 3H % 952m OIH C) :85 62mm. E9982 a

5 US. Patent Aug. 21, 2012 Sheet 2 0f 14 US 8,250,037 B2 Electronic Discovery Server L Profile Scanning Tool m Mapping Tool 11 File Browsing Tool m Computer Watching Tool 117 User Interface 118 FIG. 2

6 US. Patent Aug. 21, 2012 Sheet 3 0f 14 US 8,250,037 B2 Database Server Jig Uni?ed Directory/Custodian Database 122 Case Database 1g Ongoing Collections Database 2Q FIG. 3 Collections Server 130 Local Collection Tool 132 File Server Collection Tool 134 Active Collection Tool 13 Discovery Site Collector Tool 138 FIG. 4

7 US. Patent Aug. 21, 2012 Sheet 4 0f 14 US 8,250,037 B2 COLLECTIONS SERVER 130. /I COMMUNICATION DEVICE 1301 # PROCESSING DEVICE 1302 t MEMORY DEVICE 1303 COMPUTER READABLE INSTRUCTIONS 1304 DISCOVERY SITE COLLECTOR TOOL 138 DATASTORE 1307 FIG. 5

8 US. Patent Aug. 21, 2012 Sheet 5 0f 14 US 8,250,037 B2 FIG. 6 F 5 V INQUIRY IS SENT TO A CUSTODIAN FROM THE E-DISCOVERY MANAGER ASKING FOR THE LOCATION OF THE DATA ON THIRD PARTY SHARED DRIVES I CUSTODIAN SENDS A RESPONSE TO THE E-DISCOVERY MANAGER INDICATING THE LOCATION OF THE DATA ON THE SHARED DRIVE (E.G. THROUGH A URL OR OTHER LOCATION IDENTIFIER) I DISCOVERY SITE COLLECTION TOOL 138 USES THE LOCATION IDENTIFIER TO IDENTIFY THE DATA IN THE THIRD PARTY SHARED DRIVE THAT IS OF INTEREST I DISCOVERY SITE COLLECTION TOOL 138 COLLECTS THE PRIMARY DATA BASED ON THE URL OR OTHER LOCATING IDENTIFIER I DISCOVERY SITE COLLECTION TOOL 138 COLLECTS THE METADATA ASSOCIATED WITH THE PRIMARY DATA INVOLVED IN THE COLLECTION, 1510 I DISCOVERY SITE COLLECTION TOOL 138 REASSEMBLES THE DATA COLLECTED INTO USABLE DATA WITH A NAME THAT CAN BE IDENTIFIED AND SEARCHED BY THE E-DISCOVERY SYSTEM 1512 I DISCOVERY SITE COLLECTION TOOL 138 IDENTIFIES LINKS AND THE E-DISCOVERY MANAGER SENDS A FOLLOW UP INQUIRY FOR ANY LINKS DISCOVERED DURING THE DATA COLLECTION I IF THE DATA ASSOCIATED WITH THE LINKS ALSO NEEDS TO BE CAPTURED THE DISCOVERY SITE COLLECTION TOOL 138 (OR OTHER COLLECTION TOOLS) WILL RETRIEVE THE PRIMARY DATA AND METADATA AND RECONSTRUCT THE DATA I THE RECONSTRUCTED DATA CAN THEN BE ASSOCIATED WITH THE PROPER CASE, CUSTODIAN, OR ASSOCIATED DATA IN THE ELECTRONIC DISCOVERY MANGER SERVER

9 US. Patent Aug. 21, 2012 Sheet 6 0f 14 US 8,250,037 B2

10 US. Patent Aug. 21, 2012 Sheet 7 0f 14 US 8,250,037 B2 F56.

11 US. Patent Aug. 21, 2012 Sheet 8 0f 14 US 8,250,037 B2

12 US. Patent Aug. 21, 2012 Sheet 9 0f 14 US 8,250,037 B2 2 ME R2 82 D U B U U D DUE! CIDUCI DD _ 32 SN.

13

14

15

16 US. Patent Aug. 21, 2012 Sheet 13 0f 14 US 8,250,037 B2 2% Nvm vw.umra NOWN 8m 05 % won wow

17 US. Patent Aug. 21, 2012 Sheet 14 0f 14 US 8,250,037 B2

18 1 SHARED DRIVE DATA COLLECTION TOOL FOR AN ELECTRONIC DISCOVERY SYSTEM CLAIM OF PRIORITY UNDER 35 U.S.C. ll9 The present Application for Patent claims priority to Pro visional Application No. 61/ 1 64,276 entitled Electronic Discovery System?led Mar. 27, 2009, and assigned to the assignees hereof and hereby expressly incorporated by refer ence herein. FIELD In general, embodiments of the invention relate to meth ods, systems and computer program products for electronic discovery and, more particularly, managing the collection of data from custodians in an enterprise. BACKGROUND Electronic discovery, commonly referred to as e-discovery, refers to any process in Which electronic data is sought, located, secured and searched With the intent of using it as evidence in a legal proceeding, an audit, a securities investi gation, a forensics investigation or the like. E-discovery can be carried out o?line on a particular computer or it can be accomplished in a network environment. The nature of digital data makes it extremely Well-suited for investigation. In particular, digital data can be electroni cally searched With ease, Whereas paper documents must be scrutinized manually. Furthermore, digital data is dif?cult or impossible to completely destroy, particularly if the data is stored in a network environment. This is because the data appears on multiple hard drives, and because digital?les, even if deleted, generally can be undeleted. In fact, the only reliable means of destroying digital data is to physically destroy any and all hard drives Where it is stored. In the process of electronic discovery, data of all types can serve as evidence. This can include text, image, calendar event data, databases, spreadsheets, audio?les, multimedia?les, Web sites and computer programs. Electronic mail (i.e., ) can be an especially valuable source of evidence in civil or criminal litigation, because people are often less care ful in these exchanges than in hard copy correspondence such as Written memos or postal letters. E-discovery is an evolving?eld that goes far beyond mere technology. It gives rise to multiple issues, many of Which have yet to be resolved. For example, identifying data required to satisfy a given discovery request, locating the appropriate set of data that has been identi?ed, and retrieving the data once it has been identi?ed and located all pose prob lems in and of themselves. This is especially evident if the data that is being identi?ed, located and retrieved comes from an evolving or disparate enterprise, such as a corporation that has experienced mergers, acquisitions, downsizing and the like. Mergers and acquisitions mean that the technology infrastructure across the enterprise may vary, at least in the interim. HoWever, e-discovery must be able to locate and retrieve data from these disparate technology infrastructures in a timely fashion, sometimes Within days of When the merger/ ac qui siti on occurs. In addition to identifying, locating and retrieving digital data, the most critical part of any electronic discovery is the preservation of data, Which involves maintaining an original source copy and storing it for preservation purposes or further processing. This too becomes a daunting task for the enter prise system that encompasses a myriad of different technol US 8,250,037 B ogy infrastructures and the like. Therefore, a need exists to improve the identi?cation, location, retrieval and preserva tion processes, especially in instances in Which the enterprise system includes disparate technology infrastructures and the like. As previously noted, e-discovery, as opposed to conven tional discovery of printed materials, provides for the ability to?lter or search the data so as to reduce the volume of data to only that Which is relevant to the request. Such searching is typically accomplished by determining a speci?c date range for the request, providing key Words relevant to the case and the like. Improvements in the area of searching are greatly in need to further add ef?ciency to the overall e-discovery pro cess. Once data has been retrieved, preserved and, in some instances, searched the electronic data may be reviewed by the requesting entity, such as a law?rm, securities commis sion or the like. While large requests are generally suited for online review, the manner in Which the data is presented for review adds ef?ciency to the review process and ultimately drives the cost of the review process. Therefore, improve ments in the manner in Which data is presented for review are also desirable as a means of increasing ef?ciency and reduc ing costs. Lastly, once the digital data has been reviewed, data iden ti?ed as relevant may need to be produced in a tangible format for further analysis or legal evidentiary purposes. The pro duced documents must be properly identi?ed and include necessary redactions and con?dentiality markings. Up until now, e-discovery management has been con ducted on a case-by-case basis, meaning all tasking and work flow related to the e-discovery is based at the case level. Such management does not allow for?ner granularity in the man agement of a case or for links to exist between different cases for the purpose of leveraging the e-discovery related to one case to another new or pre-existing case. Therefore, a need exists to improve the manner in Which cases are managed and, in particular, how tasking and Work?oW are managed depend ing on case requirements and the like. SUMMARY Embodiments of the invention relate to systems, methods, and computer program products for electronic discovery and, in particular, improvements in electronic discovery that allow for electronic discovery to be e?iciently and cost-effectively employed across a diverse enterprise. Generally, one embodiment of the invention is a data col lection tool, also described herein as a discovery site collector tool, Which is used for identifying and gathering data located on shared drives, such as third party shared drives. An e-dis covery manager, through the use of the electronic discovery system, sends an inquiry to a custodian (eg a user of com puter systems Within an entity that may have data necessary for discovery) requesting the location of data on any shared drives. If any data exists, the custodian Will respond by send ing a location identi?er to the e-discovery manager indicating the node location at Which the data is located on the shared drive. In some embodiments this identi?er is a uniform resource locator ( URL ), or in other embodiments the iden ti?er is an assigned identi?cation number or other location identi?er that provides the data collection tool With the loca tion of the data. The data collection tool, through the use of the location identi?er, is con?gured to capture the data, Which includes the data at the identi?ed node location, as Well as all of the data stored under that node location Within the hierar chal structure of the shared drive. In some embodiments the

19 3 data is not usable in its captured state, especially if it is located on third party shared drives. Therefore, the data collection tool Will also capture metadata associated With the data and reconstruct the data into the proper form so it can be used by the electronic discovery system. One embodiment of the invention is a method of collecting data from a shared drive for an electronic discovery system. The method comprises identifying the location of data at a node in a shared drive, Wherein the data is data at the node location and all of the associated hierarchal data located below the node, using a processing device operatively coupled to a memory device and a communication device, and con?gured to execute computer-readable program code. The method further comprises capturing the data from the shared drive using the processing device and transferring the data to the electronic discovery system using the processing device. In further accord With an embodiment of the invention the method comprises identifying metadata associated With the data captured from the shared drive using the processing device. The method further comprises capturing the metadata associated With the data captured from the shared drive using the processing device. Thereafter, reconstructing the data captured from the shared drive into accessible data for the electronic discovery system by utilizing the information con tained in the metadata using the processing device. In accordance With another embodiment of the invention reconstructing the data captured from the shared drive into accessible data further comprises renaming the?le names of the data captured into names that are consistent With and searchable by the electronic discovery system. In yet another embodiment of the invention the method further comprises sending an inquiry to a custodian request ing the location of the data on the shared drive using the processing device. In accordance With another embodiment of the invention the method further comprises receiving from a custodian a location identi?er indicating the node location of the data on the shared drive using the processing device. In further accord With an embodiment of the invention the method further comprises identifying links to other data located outside of and associated With the data captured using the processing device. In accordance With another embodiment of the invention the method further comprises sending a follow up inquiry to a custodian presenting the links to the other data to the cus todian using the processing device, Wherein the custodian is asked if the other data should be captured. In yet another embodiment of the invention the method further comprises receiving from a custodian information indicating Whether the other data should be captured and transferred to the electronic discovery system using the pro cessing device. Another embodiment of the invention is a method of col lecting data from a shared drive for an electronic discovery system. The method comprises identifying metadata associ ated With data captured from a shared drive, using a process ing device operatively coupled to a memory device and a communication device, and con?gured to execute computer readable program code. The method further comprises cap turing the metadata associated With the data captured from the shared drive, using the processing device. Thereafter, the method comprises reconstructing the data captured from the shared drive into accessible data for the electronic discovery system by utilizing the information contained in the metadata, using the processing device. US 8,250,037 B In further accord With an embodiment of the invention reconstructing the data captured from the shared drive into accessible data further comprises renaming the?le names of the data captured into names that are consistent With and searchable by the electronic discovery system. In accordance With another embodiment of the invention the method further comprises using a processing device for identifying the location of the data at the node in the shared drive, Wherein the data captured is data at a node location and all of the associated hierarchal data located below the node. The method further comprises capturing the data from the shared drive, using the processing device. Thereafter the method comprises transferring the data to the electronic dis covery system using the processing device. In yet another embodiment of the invention the method further comprises sending an inquiry to a custodian request ing the location of the data on the shared drive, using the processing device. In further accord With an embodiment of the invention the method comprises receiving from a custodian a location iden ti?er indicating a node location of the data on the shared drive, using the processing device. In accordance With another embodiment of the invention the method further comprises identifying links to other data located outside of and associated With the data captured, using the processing device. In further accord With an embodiment of the invention the method comprises sending a follow up inquiry to a custodian presenting the links to the other data to the custodian using the processing device, Wherein the custodian is asked if the other data associated With the links should be captured. In yet another embodiment of the invention the method comprises receiving from a custodian information indicating Whether the other data should be captured and transferred to the electronic discovery system, using the processing device. Another embodiment of the invention is a collection tool system for collecting data from a shared drive for an elec tronic discovery system, comprising a memory device, a communication device, and a processing device. The process ing device is operatively coupled to the memory device and the communication device, and con?gured to execute com puter-readable program code to identify the location of the data at a node in a shared drive, Wherein the data is the data at the node and all of the associated hierarchal data located below the node. The processing device is further con?gured to execute computer-readable program code to capture the data from the shared drive and transfer the data to the elec tronic discovery system. In further accord With an embodiment of the invention the processing device is further con?gured to execute computer readable program code to identify metadata associated With the data captured from the shared drive. The processing device is further con?gured to execute computer-readable program code to capture the metadata associated With the data from the shared drive. The processing device is further con?gured to execute computer-readable program code to recon struct the data captured from the shared drive into accessible data for the electronic discovery system by utilizing the infor mation contained in the metadata. In accordance With another embodiment of the invention the processing device con?gured to reconstruct the data cap tured from the shared drive into accessible data for the elec tronic discovery system is con?gured to execute computer readable program code to rename the?le names of the data captured into names that are consistent With and searchable by the electronic discovery system.

20 5 In yet another embodiment of the invention the processing device is further con?gured to execute computer-readable program code to send an inquiry to a custodian requesting the location of the data on the shared drive. In further accord With an embodiment of the invention the processing device is further con?gured to execute computer readable program code to receive from a custodian a location identi?er indicating the node location of the data on the shared drive. In accordance With another embodiment of the invention the processing device is further con?gured to execute com puter-readable program code to identify links to other data located outside of and associated With the data captured. In further accord With an embodiment of the invention the processing device is further con?gured to execute computer readable program code to send a follow up inquiry to a cus todian presenting the links to the other data to the custodian, Wherein the custodian is asked if the other data should be captured. In yet another embodiment of the invention the processing device is further con?gured to execute computer-readable program code to receive from a custodian information indi cating Whether the other data associated With the links should be captured and transferred to the electronic discovery sys tem. Another embodiment of the invention is a collection tool system for collecting data from a shared drive for an elec tronic discovery system comprising a memory device, a com munication device, and a processing device. The processing device is operatively coupled to the memory device and the communication device, and con?gured to execute computer readable program code to identify metadata associated With the data captured from the shared drive. The processing device is further con?gured to execute computer-readable program code to capture the metadata associated With the data from the shared drive. The processing device is further con?gured to execute computer-readable program code to recon struct the data captured from the shared drive into accessible data for the electronic discovery system by utilizing the infor mation contained in the metadata. In further accord With an embodiment of the invention the processing device con?gured to reconstruct the data captured from the shared drive into accessible data for the electronic discovery system is con?gured to execute computer-readable program code to rename the?le names of the data captured into names that are consistent With and searchable by the electronic discovery system. In accordance With another embodiment of the invention the processing device is further con?gured to execute com puter-readable program code to identify the location of data at a node in the shared drive, Wherein the data is the data at a node location and all of the associated hierarchal data located below the node. The processing device is further con?gured to execute computer-readable program code to capture the data from the shared drive. The processing device is further con?gured to execute computer-readable program code to transfer the data to the electronic discovery system. In yet another embodiment of the invention the processing device is further con?gured to execute computer-readable program code to send an inquiry to a custodian requesting the location of the data on the shared drive, using the processing device. In accordance With another embodiment of the invention the processing device is further con?gured to execute com puter-readable program code to receive from a custodian a location identi?er indicating a node location of the data on the shared drive. US 8,250,037 B In further accord With an embodiment of the invention the processing device is further con?gured to execute computer readable program code to identify links to other data located outside of and associated With the data captured. In accordance With another embodiment of the invention the processing device is further con?gured to execute com puter-readable program code to send a follow up inquiry to a custodian presenting the links to the other data to the custo dian, Wherein the custodian is asked if the other data should be captured. In yet another embodiment of the invention the processing device is further con?gured to execute computer-readable program code to receive from a custodian information indi cating Whether the other data should be captured and trans ferred to the electronic discovery system. Another embodiment of the invention is computer program product for a collection tool system for collecting data from a shared drive for an electronic discovery system. The com puter program product comprising at least one computer readable medium having computer-readable program code portions embodied therein. The computer-readable program code portions comprising an executable portion con?gured for identifying the location of data at a node in a shared drive, Wherein the data is the data at the node location and all of the associated hierarchal data located below the node, using a processing device operatively coupled to a memory device and a communication device. An executable portion con?g ured for capturing the data from the shared drive, using the processing device. An executable portion con?gured for transferring the data to the electronic discovery system using the processing device. In further accord With an embodiment of the invention the computer program product further comprises an executable portion con?gured for identifying metadata associated With the data captured from the shared drive, using the processing device. An executable portion con?gured for capturing the metadata associated With the data captured from the shared drive, using the processing device. An executable portion con?gured for reconstructing the data captured from the shared drive into accessible data for the electronic discovery system by utilizing the information contained in the metadata, using the processing device. In accordance With another embodiment of the invention the executable portion con?gured for reconstructing the data captured from the shared drive into accessible data, com prises an executable portion con?gured for renaming the?le names of the data captured into names that are consistent With and searchable by the electronic discovery system. In yet another embodiment of the invention the computer program product further comprises an executable portion con?gured for sending an inquiry to a custodian requesting the location of the data on the shared drive, using the process ing device. In accordance With another embodiment of invention the computer program product further comprises an executable portion con?gured for receiving from a custodian a location identi?er indicating the node location of the data on the shared drive, using the processing device. In further accord With an embodiment of the invention the computer program product further comprises an executable portion con?gured for identifying links to other data located outside of and associated With the data, using the processing device. In yet another embodiment of the invention the computer program product further comprises an executable portion con?gured for sending a follow up inquiry to a custodian

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37