How To Use Nearpoint Ediscovery On A Pc Or Macbook

Transcription

1 NearPoint ediscovery Option User's Guide Software Release 4.2

2 Copyright , Mimosa Systems, Inc. All Rights Reserved. Mimosa Systems, Inc Coronado Drive Santa Clara, CA The software and each of its components, including the source code, documentation, appearance, structure, and organization are owned by Mimosa and others and are protected under copyright and other laws. Title to the Software and any components or to any copy, modification, or merged portion shall remain with the respective copyright holders, subject to the licenses described in the Mimosa End User License Agreement ("EULA"). The Mimosa Software cannot be distributed without the prior written permission of Mimosa and cannot be copied, except as necessary for back-up purposes. The information contained in this manual is governed by the Limited Warranty expressed in the EULA. For additional third party copyright attributions refer the Additional_Copyrights.pdf document present in the <drive>:\program Files\Mimosa directory. The following are trademarks, or registered trademarks of Mimosa Systems, Inc: Mimosa Mimosa NearPoint Mimosa Systems NearPoint One Pass Protection NearPoint Deployment Advantage NearPoint for SharePoint Microsoft, Windows, Outlook, and Entourage, are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks are the property of their respective owners. Mimosa NearPoint ediscovery Option User's Guide September 16, 2010 NearPoint ediscovery Option User's Guide 1

3 CONTENTS Preface 5 Audience... 5 Product Documentation and Online Help... 6 Typographical Conventions... 7 Getting Assistance... 7 Getting Started 9 Who's Who in NearPoint ediscovery New Features in This Release Launch the ediscovery Client Quick Tour Open a Case Search the NearPoint Archive 15 Perform a Basic Search Create a Boolean Search String with the Query Builder Perform an Advanced Search related Criteria SharePoint-related Criteria Files-related Criteria SMTP-related Criteria ediscovery Metadata Fields Point-in-time Criteria Save a Search Search within Results Create a New Search from an Existing One Work with Scheduled Searches Create a Scheduled Search Stop a Scheduled Search Resume a Scheduled Search NearPoint ediscovery Option User's Guide i

4 Contents Modify a Scheduled Search Delete a Scheduled Search Review Search Results 31 View the Summary of Search Results Flag Items for Review Save a Review List Review Items Populate the Review Tab List Sort the List Read the Item Content See Related Items See Distribution List Members Apply Tags Apply Litigation Holds Attach Comments Apply a Litigation Hold to Custodian Content Sources Export Items 39 Create an Export Container Export and Save Batches of Items Create and View Reports 41 Generate an Auditor Activity Report Auditor Activity Report Description Generate a Case-Specific Tag or Hold Report Report Descriptions Work with Reports Develop Advanced Search Criteria 47 Boolean Operators Proximity Operators Wildcard Operators Numeric Range Search Operator General Search Tips Use of Punctuation in Search Criteria Use of Parentheses in Search Criteria Troubleshooting ediscovery 53 Installation, Configuration and Start-up ediscovery Console authentication failed NearPoint ediscovery Option User's Guide ii

5 Contents Logon error message about access Authenticated auditor cannot log on to Server Console The Mimosa Data Access Service is not running Search Content Types field does not display the content types user can search for No content sources are displayed Basic search for a specified date fails Error message on clicking a Search object Performing a search does not display any results Cannot hide Deleted Items in Files search results Search fails for keywords that exceed 32 characters Search does not find special characters in custom field values Restore A message restore operation fails Glossary of Terms 59 Index 61 NearPoint ediscovery Option User's Guide iii

6

7 PREFACE Audience This guide is for the following people: IT staff and others in an organization who install the NearPoint ediscovery Option (NearPoint ediscovery) or designate one or more ediscovery Administrators who will handle electronic discovery work in the organization Legal staff, internal auditors, and others in an organization who set up or use a NearPoint ediscovery environment to search and review archived or files For more information, see Who's Who in NearPoint ediscovery (on page 10). To use this guide, you must be familiar with basic operations of Microsoft Windows and Windows-based applications. NearPoint ediscovery Option User's Guide 5

8 Preface Product Documentation and Online Help Product Documentation and Online Help To open online help in the Mimosa ediscovery client, click. The ediscovery Option documentation set includes the following guides: Mimosa ediscovery Option Administrator's Guide Mimosa ediscovery Option User's Guide The NearPoint ediscovery administrator also must be familiar with the NearPoint product, as described in the following guides: NearPoint for Microsoft Exchange Server Compatibility Document NearPoint for Microsoft Exchange Server Installation Guide NearPoint for Microsoft Exchange Server Administrator's Guide NearPoint for Microsoft Exchange Server Dashboard Guide NearPoint Archive Client User's Guide NearPoint Archive Client Quick Start User's Guide The NearPoint Options documentation set consists of the following guides: NearPoint Options Installation Guide NearPoint File System Archiving Option Administrator's Guide NearPoint PST Management Option Administrator's Guide NearPoint Disaster Recovery Option (Using Double-Take) Administrator's Guide NearPoint Disaster Recovery Option (Using Dell EqualLogic) Administrator's Guide NearPoint Disaster Recovery Option (Using NetApp SnapMirror) Administrator's Guide NearPoint ediscovery Option Administration Guide NearPoint ediscovery Option User s Guide NearPoint Intelligent Classification Application User s Guide NearPoint Software Development Kit Mimosa NearPoint for Microsoft SharePoint Installation and Administration Guide Mimosa NearPoint for SMTP Installation and Administration Guide NearPoint ediscovery Option User's Guide 6

9 Preface Typographical Conventions Typographical Conventions This guide uses the typographical conventions described in the following table. Convention Note: or Tip: Warning: Best Practice: Bold Italic Code Text Red text Indicates Information provided as a note, tip, or advice Information that warns users to avoid error conditions Recommendations and suggestions for best results Names of commands and fields in the user interface Cross-references or names of Web sites and books Command-line instructions and names of registry keys Error conditions Getting Assistance To learn more about Mimosa products, visit our Web site To contact Support, send an to support (support@mimosasystems.com) or call one of the following hotline numbers: Country Hotline Number Australia France Germany New Zealand North America Customers who have 24x7 support: All other customers: United Kingdom Singapore NearPoint ediscovery Option User's Guide 7

10

11 Chapter 1 GETTING STARTED Across every industry, organizations must preserve and produce electronic information for legal proceedings and internal investigations. Government inquiries, criminal and civil proceedings, and financial audits are some activities that can force costly and complicated searches of electronic information. NearPoint ediscovery facilitates rapid search and discovery of the following types of NearPoint-archived items: , attachments, PST files, and other Microsoft Exchange items, such as tasks and calendar items Files on shared drives (archived using NearPoint for File System Archiving) Files from an organization's SharePoint environment (archived using NearPoint for Microsoft SharePoint) captured from an SMTP server that NearPoint uses as a target for journaling (archived using the NearPoint for File System Archiving EML Ingestion feature) Auditors, paralegals, and internal or external legal counsel can search quickly through thousands of s and documents to find and review the ones that are relevant to a legal matter. After the review, they can export the results for further review and analysis by other tools, or deliver them for use by opposing counsel or court-ready production. NearPoint ediscovery Option User's Guide 9

12 Getting Started Getting Assistance Who's Who in NearPoint ediscovery The following people use NearPoint ediscovery in an organization: The NearPoint Administrator designates one or more users in the NearPoint environment as ediscovery Administrators and provides an appropriate level of access to archived resources to each. A small organization might have only one ediscovery Administrator who sets up the environment for all legal staff who participate in ediscovery. A large organization might have several ediscovery Administrators, each responsible for ediscovery operations in a geographical location or one or more departments. See Designate an ediscovery Administrator. ediscovery Administrators set up the ediscovery environment for users of the NearPoint ediscovery client that they administer. This setup includes the following tasks: Defining auditor roles, which associate specific users with content sources. Content sources are the locations of archived items from an Exchange environment, an SMTP server that acts as a journaling target 1, or files from file shares 2 or SharePoint 3 hierarchies. Assigning case management permissions to users Defining universal (system-wide) tags and litigation holds that can be used in all cases These tasks are described in "Set Up the ediscovery Environment". ediscovery Case Managers set up cases, which are virtual containers for information about the following items: names of NearPoint ediscovery users who work on the case Permissions assigned to each user in the case Content sources that they can search and review for the case Tags and the holds that they can apply to reviewed items These tasks are described in "Set Up Cases and Case Folders". ediscovery Users work in the context of a case or in the Personal Workspace to perform the following types of tasks: Search for archived content related to a legal matter (see "Search the NearPoint Archive" on page 15) Create review lists of items that they found through the searches (see "Review Search Results" on page 31) Review items and adding tags and holds (see "Review Search Results" on page 31) Export reviewed items for legal production or further processing in other legal discovery applications (see "Export Items" on page 39) Generate and view reports on ediscovery activity or tag and hold use (see "Create and View Reports" on page 41) In addition to their other NearPoint ediscovery responsibilities, ediscovery Administrators and ediscovery Case Managers also can perform ediscovery user tasks. For convenience, this document and the Mimosa NearPoint ediscovery Option User's Guide both describe user tasks. NearPoint ediscovery Option User's Guide 10

13 Getting Started Getting Assistance 1 If the organization uses the EML Ingestion feature of NearPoint for File System Archiving 2 If the organization uses NearPoint for File System Archiving 3 If the organization uses NearPoint for Microsoft SharePoint New Features in This Release NearPoint ediscovery release 4.2 introduces the following new features: Reports NearPoint ediscovery provides reports to aid project management: Litigation Hold Report provides both summary information on the number of holds that reviewers placed on items as well as details about the content that they put on hold. Administrators can select the cases and users to include in the report. Tag Report, like the Litigation Hold Report, provides both summary information on the number of tags that reviewers placed on items as well as details about the tagged content. Administrators can select the cases and users to include in the report. Auditor Activity Report summarizes the activity of users who work on a case. It provides a snapshot of what users work on and the types of tags and litigation holds they apply. Item Commenting Users can add comments to reviewed items to provide more information to others who work on the case. Although items might pertain to more than one case, you see the comments related only to the selected case. All users working in a case or case folder can add comments to an item and see the comments that others add. In the Personal Workspace, you see only comments that you add. Custodian Hold This feature enables ediscovery users to place litigation holds on any content sources to which a custodian has access. Use this feature to preserve the content of entire mailboxes or entire cabinets that NearPoint uses to archive files or SharePoint content. When you apply a custodian hold, you do not need to apply holds to individual items during the review process. You can configure custodian holds and they override the original retention period for archived items. Note: You cannot see custodian holds on individual items in the results or review tabs of the search workspace. Also, you cannot see custodian holds in the Litigation Holds Report, which focuses on holds that reviewers apply to individual items. You can view information about custodian holds that you applied to content sources in the Litigation Holds space on the tab for a specific case. NearPoint ediscovery Option User's Guide 11

14 Getting Started Launch the ediscovery Client Hide Duplicate Items This feature reduces the review workload by displaying a single instance of s that are exact duplicates in the Results and Review panes of the Search workspace. For example, an sent to several people appears only once in search results. A user can click Hide Duplicate Items to see just one or multiple instances of the identical s. To restore hidden duplicates, click the Clear Filter button. Note: This feature is active for -only searches. NearPoint ediscovery cannot hide duplicates in mixed and files search results. Search Messages by Custom Properties As part of the advanced search feature, NearPoint ediscovery users can search for messages based on the data in Outlook custom fields. To do so, a NearPoint administrator first must use the NearPoint Configuration Tool to enable indexing of Outlook custom properties. For more information, see "Enable Search of Outlook Custom Properties". Launch the ediscovery Client To launch the NearPoint ediscovery client, complete the following steps: 1. Double-click the NearPoint ediscovery desktop icon, or click Start, and then select Programs > Mimosa Systems > NearPoint Options > Mimosa ediscovery. 2. In the authentication dialog box, type your domain and user name in the format domain_name\user_name. 3. Enter your password. 4. (Optional) To have NearPoint ediscovery save this information for your next log on, enable the Remember User Name and Domain option. 5. Click OK. The NearPoint ediscovery client opens. NearPoint ediscovery Option User's Guide 12

15 Getting Started Quick Tour Quick Tour The NearPoint ediscovery client console puts the features that you need in one interface. The permissions that the ediscovery Administrator grants you determine the features that you see in the client. The first thing that you see after you open NearPoint ediscovery is your Home tab, which lists the main functions of the client application. Here you can select a case or case folder to work on, or click Open Personal Workspace (if your ediscovery administrator has enabled this feature) to review items outside a case context. The following illustration shows what is visible to a user who has permission to search, review and export items within cases and case folders. NearPoint ediscovery Option User's Guide 13

16 Getting Started Open a Case First, to choose a functional area to work in, click one of the space buttons. The items in the navigation pane, which change according the space button that you select, are nodes or groups of related items on which you can perform the same kinds of actions. To show the list of items contained in that node, click the plus sign next to a node. All information related to a case or case folder or your Personal Workspace view is displayed on a tab. Each tab has a toolbar with features relevant to the current context. In procedures related to search, review, and export, the pane to the right of the navigation pane is typically called the workspace related to a particular space button, for example, the search workspace. The content of the workspace varies depending on the features that you use. For example, when you use the Searches workspace, it displays subtabs on which you can define search criteria, view search results, or apply tags and litigation holds as you review individual items. Open a Case To open a case, complete the following steps: 1. Launch the ediscovery client. The Case Explorer in the right pane lists the cases that the a case manager has assigned to you. Tip: Move the cursor over the case name to see a brief description of the case. 2. Click the name of the case you want to work on. The Browse Case Folders list in the right pane displays the case and any case folders that have been assigned to you. 3. In the Browse Case Folders list, double-click a case or case folder. A tab for this case or case folder opens. The bottom of the left pane contains space buttons for each features that you have permission to use. NearPoint ediscovery Option User's Guide 14

17 Chapter 2 SEARCH THE NEARPOINT ARCHIVE The ediscovery Option provides powerful search capabilities for quickly finding results based on simple or complex search criteria. You can run searches manually when required, or on a defined schedule. Perform a Basic Search Prerequisite: You must have the Create Search permission to perform this task. A basic search lets you find archived content based on keywords (with or without Boolean and other operators) and date criteria. For searches, the basic search matches your criteria in the message body, attachments, and header information (Subject, From, To, Cc, and Bcc). To perform a basic search for archived items, complete the following steps: 1. Click the Searches space, if it is not already highlighted. 2. Click Create New Search. The right pane displays the search-related workspace. The Search subtab is selected by default. 3. In the Select Search Option drop-down list, verify that Basic Search is selected (default). 4. Under Content Types, select one or more of the following check boxes: Outlook items such as s, contacts, appointments, and calendar items. SharePoint Documents archived in cabinets created using NearPoint for SharePoint. Files Files archived in cabinets created using NearPoint for File System Archiving. SMTP SMTP-transferred archived in cabinets using the EML Ingestion feature of NearPoint for File System Archiving. 5. If you are working in a case or case folder, click Select Content Sources. or If you are working in the Personal Workspace, complete the following steps: NearPoint ediscovery Option User's Guide 15

18 Search the NearPoint Archive Perform a Basic Search a. Select an auditor role that grants access to the content sources you must search. The ediscovery Administrator creates Auditor Roles. Contact your NearPoint ediscovery administrator for more information about specific roles. b. Click Select Content Sources. The Define Search Scope dialog box opens and lists the Available Content Sources (sources of archived content that you can search). 6. Scroll down the list of content sources and select the ones you want to search. Tip: To search only a subset of content sources in a high-level container (for example, selected mailboxes in a mail store), click the Browse button (...) next to a content source name to open the Browse Content Sources dialog box and select only the specific content sources you want to search. Tips: To select a continuous block of content sources, click the first content source while pressing the Shift key, and then click the last one in a block. Release the Shift key. To select multiple items anywhere in the list, press and hold the Ctrl key, and then click the items. 7. Click Add. The content sources that you chose are displayed in the Selected Content Sources list. 8. Click Save. 9. From the drop-down list under Keywords and Boolean Terms, select one of the following options: Any of these words to search for items that contain any of the keywords you specify All of these words to search for items that contain every one of the keywords you specify Note: To create multi-condition search strings, use the Adv. Boolean Search or Boolean Search options. For more information, see Use the Query Builder for Boolean Searches (see "Create a Boolean Search String with the Query Builder" on page 17) or Develop Advanced Search Criteria (on page 47). 10. In the text box, enter one or more keywords or phrases, using the following guidelines: Enter multiple keywords or phrases separated by a space. Enclose multi-word phrases in quotation marks. Enter a plus sign (+) before a word or phrase to indicate that the word or phrase must be present in an item to be returned as a search result. NearPoint ediscovery Option User's Guide 16

19 Search the NearPoint Archive Create a Boolean Search String with the Query Builder Enter a minus sign (-) in front of a word or phrase to exclude results that contain the word or phrase. Example: With the All of these words option, the search string +"first class mail" +postage -meter would return results that contain "postage" and "first class mail" but not "meter". 11. In the Date Search section, from the drop-down list in the left field, select one of the following options: Today, Yesterday, Last Week, Last two weeks, Last month, Last three months or Last six months Search for items archived within these periods relative to the current date. Equals Specify a particular date. Click in the date field to open a calendar, and then navigate to and click the date of interest. After or Before Search for items dated before or following a specific date. In between Enter a range of dates. 12. If you selected Equals, After, Before or In between: a. Click in the date field to open a calendar. b. Navigate to and click the date (two dates for the In Between option) of interest. 13. Click Search. You receive a message on the Results tab that indicates that the search is in progress. The Results tab lists items that match your search criteria, and the lower pane displays the first found item. Create a Boolean Search String with the Query Builder The Query Builder leads you through the process of creating complex Boolean search strings with correct syntax. To create a Boolean search string using the Query Builder, complete the following steps: 1. In the Keywords and Boolean Terms drop-down list, select Adv. Boolean Search. 2. Click Query Builder Wizard, a button that appears at the right of this section after you select the Adv. Boolean Search option. The Query Builder wizard opens. 3. Type a search term in the Search for items that contain field. 4. From the Add Condition drop-down list, choose an option that describes a conditional relationship between the specified search term and a second search term that you will enter. A new line is added to the window. NearPoint ediscovery Option User's Guide 17

20 Search the NearPoint Archive Perform an Advanced Search 5. In the field below the condition name, enter another search term that has the chosen conditional relationship to the first term. 6. Repeat steps 4 and 5 until you have described all the conditions between terms that you want to search for. The full search query that specifies all conditions for the search is shown at the bottom of the query builder window. Tip: To delete a condition, click the X button next to it. 7. Click OK. The advanced Boolean search query string is added in the Text Search Criteria section of the search workspace. Perform an Advanced Search Prerequisite: You must have the Create Search permission to perform this procedure. You begin an advanced search the same way as you begin a basic search (see "Perform a Basic Search" on page 15), except that from the Select Search Option drop-down list, you select Advanced Search. Note: Select Advanced Search before you define any criteria. NearPoint ediscovery deletes any criteria that you define before you choose the Advanced Search option. After you select Advanced Search, extra search criteria sections appear. You can use any or all of these sections to define search criteria. The sections that follow describe how to define each type of advanced criteria. NearPoint ediscovery Option User's Guide 18

21 Search the NearPoint Archive Perform an Advanced Search -related Criteria In Items To specify -related search criteria, complete the following steps: 1. From the list on the left, select specific Outlook items for which you want to search (for example, messages or contacts), or click All. 2. Under Select attributes to include in search, choose attributes of the selected item types. For example, for messages, you can search specific parts such as Subject, Attachments, Body, or All. For calendar items, you can search attributes such as Required, Optional, and Recurrence. Note: If you select multiple Outlook items, the attributes list shows only those attributes that are common to all the selected items. 3. Under Direction, choose one or more of the following options: All items sent or received on all internal or external addresses. External Inbound items with an external domain in the From and one or more internal domain addresses in the To, Cc, or Bcc fields. External Outbound items in which the address in the From field contains an internal domain and one or more addresses in the To, Cc, or Bcc fields contain an external domain. Internal items sent from an internal domain address to one or more internal domain addresses. Foreign items for which both the senders and recipients are from an outside organization and have addresses from external domains. This is typical when PST files are requested from an associated organization and archived by NearPoint. Advanced Search Criteria: To specify advanced -related search criteria, complete the following steps: 1. Click Add Search Criteria. 2. From the context menu, choose an field: From, Create Time, Received Date, Size, or Custom Properties. Note: The Custom Properties option is available only if your NearPoint administrator has enabled indexing of Outlook custom fields. Contact your ediscovery administrator if you need to search messages by custom properties. NearPoint ediscovery Option User's Guide 19

22 Search the NearPoint Archive Perform an Advanced Search A row is added to specify a criterion related to the selected field. The following figure shows the rows that are added for each of the fields. 3. To search using text-based attributes, complete the following steps: a. Click and choose the way in which the search text that you enter must match the attribute: Equals The results must exactly match the search text. Contains The search text can occur anywhere in the item attribute. b. Specify one or more search terms that the attribute must match. 4. For date-based attributes, click and choose a point in time. 5. For size-based attributes, click and choose from Equals, Greater than, Less than or In between, and then enter a value in kilobytes (KB). 6. For custom properties, select the specific custom property to search for from the drop-down list. Note: You can specify exclusion criteria the same way as the search criteria. When NearPoint ediscovery runs a search, each item that matches a specific exclusion criterion is not included in search results. SharePoint-related Criteria In SharePoint Items To specify SharePoint-related search criteria, complete the following steps: 1. From the list on the left, select the SharePoint items (documents, pictures, and so on) that you want to search. 2. Under Select file attributes to include in search, select the attributes for which you want to search: NearPoint ediscovery Option User's Guide 20

23 Search the NearPoint Archive Perform an Advanced Search Content The readable text of the file. Properties The metadata information such as owner, and date of creation. All Both content and properties. 3. If you are searching for SharePoint items only, specify the related items to include in results: Include Deleted Items and All Versions of Items Search for items that users deleted from the archive and all archived versions, including the most recent archived item versions. Include Deleted Items Search for items that users deleted from the archive and most recent archived item versions. Exclude Deleted Items and all Versions of Items Search for the most recent archived item versions only. Note: This option is not available for combined and SharePoint item searches. Advanced Search Criteria: SharePoint To specify advanced SharePoint-related search criteria, complete the following steps: 1. Click Add Search Criteria. 2. From the context menu, choose a SharePoint item attribute: Title, Created By, Modified By, Creation Date, Modification Date, Content Type or Size. A row is added to specify a criterion related to the selected field. 3. To search using text-based attributes, complete the following steps: a. Click and choose the way in which the search text that you enter must match the attribute: Equals The results must exactly match the search text. Contains The search text can occur anywhere in the item attribute. b. Specify one or more search terms that the attribute must match. 4. For date-based attributes, click and choose a point in time. 5. For size-based attributes, click, select from Equals, Greater than, Less than or In between, and then enter a value in kilobytes (KB). Note: You can specify exclusion criteria the same way as the search criteria. When NearPoint ediscovery runs a search, each item that matches a specific exclusion criterion is not included in search results. NearPoint ediscovery Option User's Guide 21