How To Use Nearpoint Ediscovery On A Pc Or Macbook

NearPoint ediscovery Option User's Guide Software Release 4.2

Copyright 2003-2010, Mimosa Systems, Inc. All Rights Reserved. Mimosa Systems, Inc. 3200 Coronado Drive Santa Clara, CA 95054 www.mimosasystems.com The software and each of its components, including the source code, documentation, appearance, structure, and organization are owned by Mimosa and others and are protected under copyright and other laws. Title to the Software and any components or to any copy, modification, or merged portion shall remain with the respective copyright holders, subject to the licenses described in the Mimosa End User License Agreement ("EULA"). The Mimosa Software cannot be distributed without the prior written permission of Mimosa and cannot be copied, except as necessary for back-up purposes. The information contained in this manual is governed by the Limited Warranty expressed in the EULA. For additional third party copyright attributions refer the Additional_Copyrights.pdf document present in the <drive>:\program Files\Mimosa directory. The following are trademarks, or registered trademarks of Mimosa Systems, Inc: Mimosa Mimosa NearPoint Mimosa Systems NearPoint One Pass Protection NearPoint Deployment Advantage NearPoint for SharePoint Microsoft, Windows, Outlook, and Entourage, are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks are the property of their respective owners. Mimosa NearPoint ediscovery Option User's Guide September 16, 2010 NearPoint ediscovery Option User's Guide 1

CONTENTS Preface 5 Audience... 5 Product Documentation and Online Help... 6 Typographical Conventions... 7 Getting Assistance... 7 Getting Started 9 Who's Who in NearPoint ediscovery... 10 New Features in This Release... 11 Launch the ediscovery Client... 12 Quick Tour... 13 Open a Case... 14 Search the NearPoint Archive 15 Perform a Basic Search... 15 Create a Boolean Search String with the Query Builder... 17 Perform an Advanced Search... 18 Email-related Criteria... 19 SharePoint-related Criteria... 20 Files-related Criteria... 22 SMTP-related Criteria... 23 ediscovery Metadata Fields... 24 Point-in-time Criteria... 24 Save a Search... 25 Search within Results... 25 Create a New Search from an Existing One... 26 Work with Scheduled Searches... 27 Create a Scheduled Search... 27 Stop a Scheduled Search... 28 Resume a Scheduled Search... 28 NearPoint ediscovery Option User's Guide i

Contents Modify a Scheduled Search... 29 Delete a Scheduled Search... 29 Review Search Results 31 View the Summary of Search Results... 31 Flag Items for Review... 31 Save a Review List... 33 Review Items... 34 Populate the Review Tab List... 34 Sort the List... 34 Read the Item Content... 35 See Related Items... 35 See Distribution List Members... 35 Apply Tags... 35 Apply Litigation Holds... 36 Attach Comments... 36 Apply a Litigation Hold to Custodian Content Sources... 36 Export Items 39 Create an Export Container... 39 Export and Save Batches of Items... 39 Create and View Reports 41 Generate an Auditor Activity Report... 41 Auditor Activity Report Description... 43 Generate a Case-Specific Tag or Hold Report... 43 Report Descriptions... 44 Work with Reports... 45 Develop Advanced Search Criteria 47 Boolean Operators... 47 Proximity Operators... 48 Wildcard Operators... 48 Numeric Range Search Operator... 49 General Search Tips... 49 Use of Punctuation in Search Criteria... 50 Use of Parentheses in Search Criteria... 51 Troubleshooting ediscovery 53 Installation, Configuration and Start-up... 53 ediscovery Console authentication failed... 53 NearPoint ediscovery Option User's Guide ii

Contents Logon error message about access... 53 Authenticated auditor cannot log on to Server Console... 54 The Mimosa Data Access Service is not running... 54 Search... 55 Content Types field does not display the content types user can search for... 55 No content sources are displayed... 55 Basic search for a specified date fails... 55 Error message on clicking a Search object... 56 Performing a search does not display any results... 56 Cannot hide Deleted Items in Files search results... 56 Search fails for keywords that exceed 32 characters... 56 Search does not find special characters in custom field values... 57 Restore... 58 A message restore operation fails... 58 Glossary of Terms 59 Index 61 NearPoint ediscovery Option User's Guide iii

PREFACE Audience This guide is for the following people: IT staff and others in an organization who install the NearPoint ediscovery Option (NearPoint ediscovery) or designate one or more ediscovery Administrators who will handle electronic discovery work in the organization Legal staff, internal auditors, and others in an organization who set up or use a NearPoint ediscovery environment to search and review archived email or files For more information, see Who's Who in NearPoint ediscovery (on page 10). To use this guide, you must be familiar with basic operations of Microsoft Windows and Windows-based applications. NearPoint ediscovery Option User's Guide 5

Preface Product Documentation and Online Help Product Documentation and Online Help To open online help in the Mimosa ediscovery client, click. The ediscovery Option documentation set includes the following guides: Mimosa ediscovery Option Administrator's Guide Mimosa ediscovery Option User's Guide The NearPoint ediscovery administrator also must be familiar with the NearPoint product, as described in the following guides: NearPoint for Microsoft Exchange Server Compatibility Document NearPoint for Microsoft Exchange Server Installation Guide NearPoint for Microsoft Exchange Server Administrator's Guide NearPoint for Microsoft Exchange Server Dashboard Guide NearPoint Archive Client User's Guide NearPoint Archive Client Quick Start User's Guide The NearPoint Options documentation set consists of the following guides: NearPoint Options Installation Guide NearPoint File System Archiving Option Administrator's Guide NearPoint PST Management Option Administrator's Guide NearPoint Disaster Recovery Option (Using Double-Take) Administrator's Guide NearPoint Disaster Recovery Option (Using Dell EqualLogic) Administrator's Guide NearPoint Disaster Recovery Option (Using NetApp SnapMirror) Administrator's Guide NearPoint ediscovery Option Administration Guide NearPoint ediscovery Option User s Guide NearPoint Intelligent Classification Application User s Guide NearPoint Software Development Kit Mimosa NearPoint for Microsoft SharePoint Installation and Administration Guide Mimosa NearPoint for SMTP Installation and Administration Guide NearPoint ediscovery Option User's Guide 6

Preface Typographical Conventions Typographical Conventions This guide uses the typographical conventions described in the following table. Convention Note: or Tip: Warning: Best Practice: Bold Italic Code Text Red text Indicates Information provided as a note, tip, or advice Information that warns users to avoid error conditions Recommendations and suggestions for best results Names of commands and fields in the user interface Cross-references or names of Web sites and books Command-line instructions and names of registry keys Error conditions Getting Assistance To learn more about Mimosa products, visit our Web site http://www.mimosasystems.com. To contact Support, send an email to support (support@mimosasystems.com) or call one of the following hotline numbers: Country Hotline Number Australia 1.800.01.7279 France 0800.91.2326 Germany 0800.180.3960 New Zealand 0800.448911 North America Customers who have 24x7 support: +1.408.454.4867 All other customers: +1.408.454.4890 United Kingdom 0808.234.1591 0800.051.084 Singapore 800-110-1689 NearPoint ediscovery Option User's Guide 7

Chapter 1 GETTING STARTED Across every industry, organizations must preserve and produce electronic information for legal proceedings and internal investigations. Government inquiries, criminal and civil proceedings, and financial audits are some activities that can force costly and complicated searches of electronic information. NearPoint ediscovery facilitates rapid search and discovery of the following types of NearPoint-archived items: Email, attachments, PST files, and other Microsoft Exchange items, such as tasks and calendar items Files on shared drives (archived using NearPoint for File System Archiving) Files from an organization's SharePoint environment (archived using NearPoint for Microsoft SharePoint) Email captured from an SMTP server that NearPoint uses as a target for journaling (archived using the NearPoint for File System Archiving EML Ingestion feature) Auditors, paralegals, and internal or external legal counsel can search quickly through thousands of emails and documents to find and review the ones that are relevant to a legal matter. After the review, they can export the results for further review and analysis by other tools, or deliver them for use by opposing counsel or court-ready production. NearPoint ediscovery Option User's Guide 9

Getting Started Getting Assistance Who's Who in NearPoint ediscovery The following people use NearPoint ediscovery in an organization: The NearPoint Administrator designates one or more users in the NearPoint environment as ediscovery Administrators and provides an appropriate level of access to archived resources to each. A small organization might have only one ediscovery Administrator who sets up the environment for all legal staff who participate in ediscovery. A large organization might have several ediscovery Administrators, each responsible for ediscovery operations in a geographical location or one or more departments. See Designate an ediscovery Administrator. ediscovery Administrators set up the ediscovery environment for users of the NearPoint ediscovery client that they administer. This setup includes the following tasks: Defining auditor roles, which associate specific users with content sources. Content sources are the locations of archived items from an Exchange environment, an SMTP server that acts as a journaling target 1, or files from file shares 2 or SharePoint 3 hierarchies. Assigning case management permissions to users Defining universal (system-wide) tags and litigation holds that can be used in all cases These tasks are described in "Set Up the ediscovery Environment". ediscovery Case Managers set up cases, which are virtual containers for information about the following items: names of NearPoint ediscovery users who work on the case Permissions assigned to each user in the case Content sources that they can search and review for the case Tags and the holds that they can apply to reviewed items These tasks are described in "Set Up Cases and Case Folders". ediscovery Users work in the context of a case or in the Personal Workspace to perform the following types of tasks: Search for archived content related to a legal matter (see "Search the NearPoint Archive" on page 15) Create review lists of items that they found through the searches (see "Review Search Results" on page 31) Review items and adding tags and holds (see "Review Search Results" on page 31) Export reviewed items for legal production or further processing in other legal discovery applications (see "Export Items" on page 39) Generate and view reports on ediscovery activity or tag and hold use (see "Create and View Reports" on page 41) In addition to their other NearPoint ediscovery responsibilities, ediscovery Administrators and ediscovery Case Managers also can perform ediscovery user tasks. For convenience, this document and the Mimosa NearPoint ediscovery Option User's Guide both describe user tasks. NearPoint ediscovery Option User's Guide 10

Getting Started Getting Assistance 1 If the organization uses the EML Ingestion feature of NearPoint for File System Archiving 2 If the organization uses NearPoint for File System Archiving 3 If the organization uses NearPoint for Microsoft SharePoint New Features in This Release NearPoint ediscovery release 4.2 introduces the following new features: Reports NearPoint ediscovery provides reports to aid project management: Litigation Hold Report provides both summary information on the number of holds that reviewers placed on items as well as details about the content that they put on hold. Administrators can select the cases and users to include in the report. Tag Report, like the Litigation Hold Report, provides both summary information on the number of tags that reviewers placed on items as well as details about the tagged content. Administrators can select the cases and users to include in the report. Auditor Activity Report summarizes the activity of users who work on a case. It provides a snapshot of what users work on and the types of tags and litigation holds they apply. Item Commenting Users can add comments to reviewed items to provide more information to others who work on the case. Although items might pertain to more than one case, you see the comments related only to the selected case. All users working in a case or case folder can add comments to an item and see the comments that others add. In the Personal Workspace, you see only comments that you add. Custodian Hold This feature enables ediscovery users to place litigation holds on any content sources to which a custodian has access. Use this feature to preserve the content of entire mailboxes or entire cabinets that NearPoint uses to archive files or SharePoint content. When you apply a custodian hold, you do not need to apply holds to individual items during the review process. You can configure custodian holds and they override the original retention period for archived items. Note: You cannot see custodian holds on individual items in the results or review tabs of the search workspace. Also, you cannot see custodian holds in the Litigation Holds Report, which focuses on holds that reviewers apply to individual items. You can view information about custodian holds that you applied to content sources in the Litigation Holds space on the tab for a specific case. NearPoint ediscovery Option User's Guide 11

Getting Started Launch the ediscovery Client Hide Duplicate Items This feature reduces the review workload by displaying a single instance of emails that are exact duplicates in the Results and Review panes of the Search workspace. For example, an email sent to several people appears only once in search results. A user can click Hide Duplicate Items to see just one or multiple instances of the identical emails. To restore hidden duplicates, click the Clear Filter button. Note: This feature is active for email-only searches. NearPoint ediscovery cannot hide duplicates in mixed email and files search results. Search Messages by Custom Properties As part of the advanced search feature, NearPoint ediscovery users can search for messages based on the data in Outlook custom fields. To do so, a NearPoint administrator first must use the NearPoint Configuration Tool to enable indexing of Outlook custom properties. For more information, see "Enable Search of Outlook Custom Properties". Launch the ediscovery Client To launch the NearPoint ediscovery client, complete the following steps: 1. Double-click the NearPoint ediscovery desktop icon, or click Start, and then select Programs > Mimosa Systems > NearPoint Options > Mimosa ediscovery. 2. In the authentication dialog box, type your domain and user name in the format domain_name\user_name. 3. Enter your password. 4. (Optional) To have NearPoint ediscovery save this information for your next log on, enable the Remember User Name and Domain option. 5. Click OK. The NearPoint ediscovery client opens. NearPoint ediscovery Option User's Guide 12

Getting Started Quick Tour Quick Tour The NearPoint ediscovery client console puts the features that you need in one interface. The permissions that the ediscovery Administrator grants you determine the features that you see in the client. The first thing that you see after you open NearPoint ediscovery is your Home tab, which lists the main functions of the client application. Here you can select a case or case folder to work on, or click Open Personal Workspace (if your ediscovery administrator has enabled this feature) to review items outside a case context. The following illustration shows what is visible to a user who has permission to search, review and export items within cases and case folders. NearPoint ediscovery Option User's Guide 13

Getting Started Open a Case First, to choose a functional area to work in, click one of the space buttons. The items in the navigation pane, which change according the space button that you select, are nodes or groups of related items on which you can perform the same kinds of actions. To show the list of items contained in that node, click the plus sign next to a node. All information related to a case or case folder or your Personal Workspace view is displayed on a tab. Each tab has a toolbar with features relevant to the current context. In procedures related to search, review, and export, the pane to the right of the navigation pane is typically called the workspace related to a particular space button, for example, the search workspace. The content of the workspace varies depending on the features that you use. For example, when you use the Searches workspace, it displays subtabs on which you can define search criteria, view search results, or apply tags and litigation holds as you review individual items. Open a Case To open a case, complete the following steps: 1. Launch the ediscovery client. The Case Explorer in the right pane lists the cases that the a case manager has assigned to you. Tip: Move the cursor over the case name to see a brief description of the case. 2. Click the name of the case you want to work on. The Browse Case Folders list in the right pane displays the case and any case folders that have been assigned to you. 3. In the Browse Case Folders list, double-click a case or case folder. A tab for this case or case folder opens. The bottom of the left pane contains space buttons for each features that you have permission to use. NearPoint ediscovery Option User's Guide 14

Chapter 2 SEARCH THE NEARPOINT ARCHIVE The ediscovery Option provides powerful search capabilities for quickly finding results based on simple or complex search criteria. You can run searches manually when required, or on a defined schedule. Perform a Basic Search Prerequisite: You must have the Create Search permission to perform this task. A basic search lets you find archived content based on keywords (with or without Boolean and other operators) and date criteria. For email searches, the basic search matches your criteria in the message body, attachments, and header information (Subject, From, To, Cc, and Bcc). To perform a basic search for archived items, complete the following steps: 1. Click the Searches space, if it is not already highlighted. 2. Click Create New Search. The right pane displays the search-related workspace. The Search subtab is selected by default. 3. In the Select Search Option drop-down list, verify that Basic Search is selected (default). 4. Under Content Types, select one or more of the following check boxes: Email Outlook items such as emails, contacts, appointments, and calendar items. SharePoint Documents archived in cabinets created using NearPoint for SharePoint. Files Files archived in cabinets created using NearPoint for File System Archiving. SMTP SMTP-transferred email archived in cabinets using the EML Ingestion feature of NearPoint for File System Archiving. 5. If you are working in a case or case folder, click Select Content Sources. or If you are working in the Personal Workspace, complete the following steps: NearPoint ediscovery Option User's Guide 15

Search the NearPoint Archive Perform a Basic Search a. Select an auditor role that grants access to the content sources you must search. The ediscovery Administrator creates Auditor Roles. Contact your NearPoint ediscovery administrator for more information about specific roles. b. Click Select Content Sources. The Define Search Scope dialog box opens and lists the Available Content Sources (sources of archived content that you can search). 6. Scroll down the list of content sources and select the ones you want to search. Tip: To search only a subset of content sources in a high-level container (for example, selected mailboxes in a mail store), click the Browse button (...) next to a content source name to open the Browse Content Sources dialog box and select only the specific content sources you want to search. Tips: To select a continuous block of content sources, click the first content source while pressing the Shift key, and then click the last one in a block. Release the Shift key. To select multiple items anywhere in the list, press and hold the Ctrl key, and then click the items. 7. Click Add. The content sources that you chose are displayed in the Selected Content Sources list. 8. Click Save. 9. From the drop-down list under Keywords and Boolean Terms, select one of the following options: Any of these words to search for items that contain any of the keywords you specify All of these words to search for items that contain every one of the keywords you specify Note: To create multi-condition search strings, use the Adv. Boolean Search or Boolean Search options. For more information, see Use the Query Builder for Boolean Searches (see "Create a Boolean Search String with the Query Builder" on page 17) or Develop Advanced Search Criteria (on page 47). 10. In the text box, enter one or more keywords or phrases, using the following guidelines: Enter multiple keywords or phrases separated by a space. Enclose multi-word phrases in quotation marks. Enter a plus sign (+) before a word or phrase to indicate that the word or phrase must be present in an item to be returned as a search result. NearPoint ediscovery Option User's Guide 16

Search the NearPoint Archive Create a Boolean Search String with the Query Builder Enter a minus sign (-) in front of a word or phrase to exclude results that contain the word or phrase. Example: With the All of these words option, the search string +"first class mail" +postage -meter would return results that contain "postage" and "first class mail" but not "meter". 11. In the Date Search section, from the drop-down list in the left field, select one of the following options: Today, Yesterday, Last Week, Last two weeks, Last month, Last three months or Last six months Search for items archived within these periods relative to the current date. Equals Specify a particular date. Click in the date field to open a calendar, and then navigate to and click the date of interest. After or Before Search for items dated before or following a specific date. In between Enter a range of dates. 12. If you selected Equals, After, Before or In between: a. Click in the date field to open a calendar. b. Navigate to and click the date (two dates for the In Between option) of interest. 13. Click Search. You receive a message on the Results tab that indicates that the search is in progress. The Results tab lists items that match your search criteria, and the lower pane displays the first found item. Create a Boolean Search String with the Query Builder The Query Builder leads you through the process of creating complex Boolean search strings with correct syntax. To create a Boolean search string using the Query Builder, complete the following steps: 1. In the Keywords and Boolean Terms drop-down list, select Adv. Boolean Search. 2. Click Query Builder Wizard, a button that appears at the right of this section after you select the Adv. Boolean Search option. The Query Builder wizard opens. 3. Type a search term in the Search for items that contain field. 4. From the Add Condition drop-down list, choose an option that describes a conditional relationship between the specified search term and a second search term that you will enter. A new line is added to the window. NearPoint ediscovery Option User's Guide 17

Search the NearPoint Archive Perform an Advanced Search 5. In the field below the condition name, enter another search term that has the chosen conditional relationship to the first term. 6. Repeat steps 4 and 5 until you have described all the conditions between terms that you want to search for. The full search query that specifies all conditions for the search is shown at the bottom of the query builder window. Tip: To delete a condition, click the X button next to it. 7. Click OK. The advanced Boolean search query string is added in the Text Search Criteria section of the search workspace. Perform an Advanced Search Prerequisite: You must have the Create Search permission to perform this procedure. You begin an advanced search the same way as you begin a basic search (see "Perform a Basic Search" on page 15), except that from the Select Search Option drop-down list, you select Advanced Search. Note: Select Advanced Search before you define any criteria. NearPoint ediscovery deletes any criteria that you define before you choose the Advanced Search option. After you select Advanced Search, extra search criteria sections appear. You can use any or all of these sections to define search criteria. The sections that follow describe how to define each type of advanced criteria. NearPoint ediscovery Option User's Guide 18

Search the NearPoint Archive Perform an Advanced Search Email-related Criteria In Email Items To specify email-related search criteria, complete the following steps: 1. From the list on the left, select specific Outlook items for which you want to search (for example, messages or contacts), or click All. 2. Under Select email attributes to include in search, choose attributes of the selected email item types. For example, for messages, you can search specific parts such as Subject, Attachments, Body, or All. For calendar items, you can search attributes such as Required, Optional, and Recurrence. Note: If you select multiple Outlook items, the attributes list shows only those attributes that are common to all the selected items. 3. Under Email Direction, choose one or more of the following options: All Email items sent or received on all internal or external email addresses. External Inbound Email items with an external domain in the From and one or more internal domain email addresses in the To, Cc, or Bcc fields. External Outbound Email items in which the email address in the From field contains an internal domain and one or more email addresses in the To, Cc, or Bcc fields contain an external domain. Internal Email items sent from an internal domain email address to one or more internal domain email addresses. Foreign Email items for which both the senders and recipients are from an outside organization and have email addresses from external domains. This is typical when PST files are requested from an associated organization and archived by NearPoint. Advanced Search Criteria: Email To specify advanced email-related search criteria, complete the following steps: 1. Click Add Search Criteria. 2. From the context menu, choose an email field: From, Create Time, Received Date, Size, or Custom Properties. Note: The Custom Properties option is available only if your NearPoint administrator has enabled indexing of Outlook custom fields. Contact your ediscovery administrator if you need to search messages by custom properties. NearPoint ediscovery Option User's Guide 19

Search the NearPoint Archive Perform an Advanced Search A row is added to specify a criterion related to the selected field. The following figure shows the rows that are added for each of the email fields. 3. To search using text-based attributes, complete the following steps: a. Click and choose the way in which the search text that you enter must match the attribute: Equals The results must exactly match the search text. Contains The search text can occur anywhere in the item attribute. b. Specify one or more search terms that the attribute must match. 4. For date-based attributes, click and choose a point in time. 5. For size-based attributes, click and choose from Equals, Greater than, Less than or In between, and then enter a value in kilobytes (KB). 6. For custom properties, select the specific custom property to search for from the drop-down list. Note: You can specify exclusion criteria the same way as the search criteria. When NearPoint ediscovery runs a search, each item that matches a specific exclusion criterion is not included in search results. SharePoint-related Criteria In SharePoint Items To specify SharePoint-related search criteria, complete the following steps: 1. From the list on the left, select the SharePoint items (documents, pictures, and so on) that you want to search. 2. Under Select file attributes to include in search, select the attributes for which you want to search: NearPoint ediscovery Option User's Guide 20

Search the NearPoint Archive Perform an Advanced Search Content The readable text of the file. Properties The metadata information such as owner, and date of creation. All Both content and properties. 3. If you are searching for SharePoint items only, specify the related items to include in results: Include Deleted Items and All Versions of Items Search for items that users deleted from the archive and all archived versions, including the most recent archived item versions. Include Deleted Items Search for items that users deleted from the archive and most recent archived item versions. Exclude Deleted Items and all Versions of Items Search for the most recent archived item versions only. Note: This option is not available for combined email and SharePoint item searches. Advanced Search Criteria: SharePoint To specify advanced SharePoint-related search criteria, complete the following steps: 1. Click Add Search Criteria. 2. From the context menu, choose a SharePoint item attribute: Title, Created By, Modified By, Creation Date, Modification Date, Content Type or Size. A row is added to specify a criterion related to the selected field. 3. To search using text-based attributes, complete the following steps: a. Click and choose the way in which the search text that you enter must match the attribute: Equals The results must exactly match the search text. Contains The search text can occur anywhere in the item attribute. b. Specify one or more search terms that the attribute must match. 4. For date-based attributes, click and choose a point in time. 5. For size-based attributes, click, select from Equals, Greater than, Less than or In between, and then enter a value in kilobytes (KB). Note: You can specify exclusion criteria the same way as the search criteria. When NearPoint ediscovery runs a search, each item that matches a specific exclusion criterion is not included in search results. NearPoint ediscovery Option User's Guide 21

Search the NearPoint Archive Perform an Advanced Search Files-related Criteria In Files Items To specify file-related search criteria, complete the following steps: 1. From the list on the left, select the file types that you want to search. 2. Under Select file attributes to include in search, select the attributes for which you want to search: Content The readable text of the file. Properties The metadata information such as owner, and date of creation. All Both content and properties. 3. If you are searching for files only, specify one of the following the items to include in results: Include Deleted Items and All Versions of Files Search for files that users deleted from the archive and all archived versions, including the most recent archived file versions. Include Deleted Items Search for files that users deleted from the archive and most recent archived file versions. Exclude Deleted Items and all Versions of Files Search for the most recent archived file versions only. Note: This option is not available for combined email and file searches. Advanced Search Criteria: Files To specify advanced file-related search criteria, complete the following steps: 1. Click Add Search Criteria. 2. From the context menu, choose a file attribute: Owner, File Name, Size, Creation Date, Archived On, Modification Date, or Last Accessed Date. A row is added to specify a criterion related to the selected field. 3. To search using text-based attributes, complete the following steps: a. Click and choose the way in which the search text that you enter must match the attribute: Equals The results must exactly match the search text. Contains The search text can occur anywhere in the item attribute. b. Specify one or more search terms that the attribute must match. 4. For date-based attributes, click and choose a point in time. 5. For size-based attributes, click, select from Equals, Greater than, Less than or In between, and then enter a value in kilobytes (KB). NearPoint ediscovery Option User's Guide 22

Search the NearPoint Archive Perform an Advanced Search Note: You can specify exclusion criteria the same way as the search criteria. When NearPoint ediscovery runs a search, each item that matches a specific exclusion criterion is not included in search results. SMTP-related Criteria In SMTP Items The list on the left shows Email as the only type of SMTP item that can be searched. Under Select file attributes to include in search, select the attributes for which you want to search: Content The readable text of the email. Properties The metadata information such as From, and Cc. All Both content and properties. Advanced Search Criteria: SMTP To specify advanced SMTP-related search criteria, complete the following steps: 1. Click Add Search Criteria. 2. From the context menu, choose an email field: Subject, From, Sent Date, or Size. A row is added to specify a criterion related to the selected field. 3. To search using text-based attributes, complete the following steps: a. Click and choose the way in which the search text that you enter must match the attribute: Equals The results must exactly match the search text. Contains The search text can occur anywhere in the item attribute. b. Specify one or more search terms that the attribute must match. 4. For date-based attributes, click and choose a point in time. 5. For size-based attributes, click, select from Equals, Greater than, Less than or In between, and then enter a value in kilobytes (KB). Note: You can specify exclusion criteria the same way as the search criteria. When NearPoint ediscovery runs a search, each item that matches a specific exclusion criterion is not included in search results. NearPoint ediscovery Option User's Guide 23

Search the NearPoint Archive Perform an Advanced Search ediscovery Metadata Fields You can search for tags and litigation holds that reviewers have added using NearPoint ediscovery. To select tags, complete the following steps: 1. Click Add Search Criteria > Select Tags. 2. Select one of the following options: Any of these tags One of the selected tags must match All of these tags All the selected tags must match 3. Select the tags that you want to look for. To select litigation holds, complete the following steps: 1. Click Add Search Criteria > Select Litigation Holds. 2. Select one of the following options: Any of these holds One of the selected litigation holds must match All of these holds All the selected litigation holds must match 3. Select the litigation holds that you want to look for. Point-in-time Criteria You can limit the scope for searching to only those items that are present in the archive for selected content sources until a specific or relative point in time. For example, you might want to search for email items that were archived up until one week ago. To apply point-in-time criteria to your search, select one of the following options: Current Time (default) Search among items that are currently in the archive for the selected content sources. Yesterday Search among items that were present in the archive for the selected content sources until yesterday. One week ago, Two weeks ago, One month ago, Three months ago, or Six months ago Search among items that were present in the archive for the selected content sources until this amount of time before the current date. Equal to Search among items that were present in the archive for the selected content sources at the specified date. NearPoint ediscovery Option User's Guide 24

Search the NearPoint Archive Save a Search Save a Search Prerequisite: You must have the Save Search permission to perform this procedure. After you run a search with specific criteria and scope, you can save it as a record of what was discovered for the case. Additionally, you can save it to use as a shortcut to create a similar search in the future, with modifications as required. To save a search, complete the following steps: 1. Right-click a search in the list in the left pane and, from the context menu, select Save, or select a search from the list, and then click Save Search on the Search tab. The Save Search dialog box opens. 2. Type a name for the search and a brief description that helps you remember its scope and intent. 3. Click OK. The search appears under My Searches in the navigation pane. Search within Results A search can return a large number of items that fit the specified search criteria. You can add more search criteria to narrow the focus within a set of search results. You can save this search as a child object of the original search. For example, you might search for all emails between User1 to User2. After the search is completed, you save the search as U12_Emails. Now you want to search for emails that contain the word "Holiday". You can perform a search within results operation, and save the search under U12_Emails, as U12_Holiday_Emails. To search within results, complete the following steps: 1. Click the Search space. 2. In the navigation pane, select the search within which you want to perform a further search. 3. On the toolbar, click Search In Results. The Search tab displays the criteria used for the original search. 4. Modify the criteria for your search within results, as required. 5. Click Search. The search runs against the results from the original search. 6. (Optional) Click Save Search to save the search within the results. The search appears under the parent search in the navigation pane. NearPoint ediscovery Option User's Guide 25

Search the NearPoint Archive Create a New Search from an Existing One Create a New Search from an Existing One You can save time when you define searches if you reuse search criteria (keywords, item attributes and so on) or search scope (the set of selected search targets) or both from previous searches. To create a new search from an existing one, complete the following steps: 1. Click the Searches space. 2. From the My Searches list in the navigation pane, select a search that you want to use as the base for a new search. 3. From the Create New Search drop-down list, select one of the following options: Copy criteria from existing search to use the search criteria (search strings and other criteria) from an existing search. Copy scope from existing search to use the search scope (targets) from an existing search. Copy scope and criteria from existing search to use both the search criteria and the scope from an existing search. The Browse Searches dialog box opens. 4. Select the search of interest, and then click OK. Note: Only top-level parent searches can be selected. Depending on the option that you select, NearPoint ediscovery loads the search criteria or scope, or both, from the selected saved search file in the Search tab. The default name of the search is New Search_<number>. 5. Modify the search criteria or scope, if desired. 6. Click Search to run the search. NearPoint ediscovery Option User's Guide 26

Search the NearPoint Archive Work with Scheduled Searches Work with Scheduled Searches NearPoint ediscovery lets you schedule searches to run at set intervals. You also can schedule searches to scan the archive for specific items regularly according to the specified schedule. For example, to search for all items containing the word salary, you could schedule a search for NearPoint ediscovery to run every Monday at 10:00 a.m. that scans all the assigned content sources for items containing that contain the word salary. A scheduled search scans items that have been added to a content source since the last search was conducted. The most recent search results are added to a review list. When you create a scheduled search, you can import criteria from an existing search, or specify new criteria. You can schedule a one-time search or a periodic search. In addition, you can direct NearPoint ediscovery to apply one or more tags and one litigation hold to the results of a scheduled search. Create a Scheduled Search To create a scheduled search, complete the following steps: 1. In the navigation pane, click Scheduled Searches. 2. Click Create New Search. Tip: As with regular searches, you can Create a New Search from an Existing One (on page 26). 3. Define search criteria as described in Perform a Basic Search (on page 15) or Perform an Advanced Search (on page 18). 4. Click the Properties tab. 5. (Optional) In the Automated Review Action section, select one or more tags that you want to apply to results returned by this scheduled search. 6. (Optional) From the list of holds, select one hold that you want to apply the results that this scheduled search returns. 7. In the Review List section, click Select Review List. The Select Review List dialog box opens with the Create new review list option selected by default. 8. Complete one of the following steps: Type a name and a description of the review list you want to create. or To add the results of the scheduled search to an existing review list, select Use an existing review list, and choose the review list you want from the list. 9. Click OK. 10. In the Search Schedule section, choose one of the following options: NearPoint ediscovery Option User's Guide 27

Search the NearPoint Archive Work with Scheduled Searches Periodic scanning for newly created content Select this option to perform the search at a repeated interval, and specify the frequency by choosing Daily, Weekly or Monthly. Specify a start date and time. One time scanning for historical content Select this option to run the search only once. Specify the date and time in the fields below this option. 11. Click Save Search. The Save Search dialog box opens. 12. Type a name and a description for the scheduled search, and then click OK. 13. To view details of the scheduled search, click the Jobs tab. NearPoint ediscovery runs the scheduled search according to the schedule and details displayed on the Jobs tab. 14. To see search results, click the Review Lists space, and then, under My Review Lists, select the review list you specified for the scheduled search. The Results tab displays results of the search. Stop a Scheduled Search To stop a search, complete the following steps: 1. Click Scheduled Searches > <Search name> in the navigation pane. 2. Click Stop Search. A dialog box opens. 3. To confirm that you want to stop running the search on the defined schedule, click Yes. On the Jobs tab for the selected scheduled search, the status changes to Schedule Suspended, meaning that NearPoint ediscovery will no longer run the search according to the schedule. Resume a Scheduled Search You can resume a scheduled search that you suspended. The first scheduled search that ediscovery runs after you resume the scheduled search scans all items that were added since NearPoint ediscovery performed the last scheduled search. To resume a scheduled search, complete the following steps: 1. In the navigation pane, click Scheduled Searches > <Search name>. 2. Click Start Search. A dialog box opens. 3. To confirm that you want to resume running the search on the defined schedule, click Yes. On the Jobs tab for the selected scheduled search, the status changes to Schedule Resumed, meaning that the search will start to run according to the schedule. NearPoint ediscovery Option User's Guide 28

Search the NearPoint Archive Work with Scheduled Searches Modify a Scheduled Search To modify a scheduled search, complete the following steps: 1. In the navigation pane, click Scheduled Searches > <Search name>. 2. Click Modify. The Save Search dialog box opens. 3. Edit the name and description of the search, and then click OK. 4. Use the Search and Properties tabs for the selected scheduled search to modify search criteria and schedule details. 5. Click Save Search. The modified schedule for the search takes effect at the time of the next scheduled search execution. Delete a Scheduled Search To delete a scheduled search, complete the following steps: 1. In the navigation pane, click Scheduled Searches > <Search>. 2. Click Delete. You receive a message that prompts you to confirm that you want to delete the selected search. 3. To delete the scheduled search, click Yes. NearPoint ediscovery Option User's Guide 29

Chapter 3 REVIEW SEARCH RESULTS The following sections describe features you can use to examine the results of NearPoint ediscovery searches. View the Summary of Search Results The Search Summary in the search workspace provides information that can help you plan your review effort. To view the summary of search results, complete the following steps: 1. After you run a search, click the Summary tab. The tab displays summary information about the search results, including the number and total size (in kilobytes) of each type of item found in each content source. 2. (Optional) Click one of the following buttons on the toolbar to capture the summary search results: Print Preview previews the printed summary report Print prints the summary Export to PDF saves the data to a PDF file Flag Items for Review Searches can find items that meet your search criteria but that are not relevant to the legal matter. The Results pane lists search results in the order that they were found. You can preview items and add tags, holds, and comments on both the Results tab and the Review tab. However, if you mark (flag) items to examine more closely on the Results tab, you can use the sorting and other features available only on the Review tab to organize results for a more efficient review. To flag items for review, complete the following steps: 1. To view the list of items found through a search, click the Results tab. The Results list shows the first batch of search results (up to 100) in a scrollable list. If there are more results, click Next to display the next batch of results. NearPoint ediscovery Option User's Guide 31

Review Search Results Flag Items for Review Create Time For files, the time the file was created on a file server. For email, the time the email was created in a user mailbox. In most cases, this is the time the recipient received the email but, for email imported from PST files, it might differ from Received Time. Received Date Email only. The date and time the message entered the recipient mailbox. Delete Date The date and time at which NearPoint found a newer version of the item. The time value indicates that this version of item is no longer active but a newer version exists. User Delete Date The date and time that NearPoint found that the item no longer exists in the source mailbox or file share. Archived on The time at which NearPoint archived the item. Expiry Date The date on which a user-placed retention hold expires. Set only if the NearPoint administrator configured the Tiered Storage Option (TSO) and items are on a compliance device or the Retention and Classification Option (RCO) is enabled. 2. (Optional) To sort items in the list (alphabetically or in ascending numerical order), click a column heading. Click the column heading again to invert the order. 3. (Optional) To reduce the number of items displayed in the list, apply any of the following filters: To view items of a particular type, in the List Filter drop-down list, choose the type of items you want to see. The list displays only items of the selected type. In the Item History drop-down list, choose either or both of the following options: Exclude History Display only the most recent message in an email thread or the most recent version of a file. Exclude Deleted Display only items that are still present in the content source, not items that users have deleted. To remove all but one instance of email items with identical content, click Hide Duplicate Items. The filtered list is also displayed in the Review tab. Note: Sort and filter operations work on the whole list of results, not only on items on the displayed page. The number of total items that match search criteria is displayed above the list. Tip: Click Clear Filter to view the full results list again. 4. To view the content of an item, click its row in the list. The bottom pane displays the item content. Note: For some types of SharePoint content and for SMTP-transferred messages, only metadata is displayed. For such items, click Open or Print to preview the item content. NearPoint ediscovery Option User's Guide 32

Review Search Results Save a Review List 5. (Optional) To view the item in the application in which it was created (where you can see original formatting), click Open. Note: The appropriate application must be installed on the local computer. 6. (Optional) To print a copy of the selected item, click Print. 7. To flag an item to review, click the flag button in the first column, or click Review Flag > Apply. Tip: Click the flag icon in the column heading to select all items in the list. 8. (Optional) Add comments to list items. For more information, see Attach Comments (on page 36). 9. After you flag all the items you want to review, click the Review tab. All the items you flagged for review are listed on the Review tab. If you used the Hide Duplicate Items feature to hide identical email messages, the Review tab displays the filtered list. On the Review tab, you can sort the results, look at item history (messages only), save a review list, and add tags, comments, and holds. Save a Review List You can review flagged items directly in the Review tab, or you can use the following procedure to save a list of flagged items to examine later or to assign to another reviewer. If you created a review list previously, you can also use this procedure to add more items to that review list. To save a review list, complete the following steps: 1. After you flag items on the Results tab, click the Review tab. 2. Click Save Review. The Select Review List dialog box opens with the Create new review list option selected by default. 3. Complete one of the following steps: Type a name and description of the review list you want to create. or To add the flagged items to an existing review list, select Use an existing review list, and then choose the review list you want from the list. 4. Click OK. NearPoint ediscovery Option User's Guide 33

Review Search Results Review Items Review Items Use the Review tab in the Search workspace to read the content of items and assess if they are relevant to a case. The features on this tab let you perform the following actions: Sort the items in the order that is most relevant to your review focus. View related items such as all messages in a particular email thread or all versions of a specific file. Apply tags that indicate which items are relevant to a case or how the review team should handle specific items. Tags are created by your ediscovery administrator or case manager. Apply litigation holds to ensure that items that are relevant to a case are not deleted from the archive by users or by a lapsed retention period. Attach comments to items to provide additional information for your own use or for other reviewers working on the case. Populate the Review Tab List To add items found through searches to the Review tab, complete one of the following steps: If items that you want to review are in a saved review list, complete the following steps: a. Click the Review Lists space. b. In the navigation pane, under My Review Lists, click a review list that you want to work on. The Results tab displays the items in the review list. c. Flag the items from the review list that you want to review, and then click the Review tab. Or To review items that you flagged in the Results tab, click the Review tab. The sections that follow describe the actions you can perform on flagged items in the Review tab. Sort the List From the Sort By drop-down list, select the order in which you want to list the items. Choose from the following options: Title Creator Size Date Tip: To invert the order of the items in the list, click Sort Order. NearPoint ediscovery Option User's Guide 34

Review Search Results Review Items Read the Item Content On the Flagged Items tab, click an item that you want to review. The content of the item is displayed in the Preview tab in the right pane. See Related Items To show other email messages in a conversation thread (and the history of the items), or all versions of a file, click Related Items. Tip: To show the conversation thread across all case content sources, select Across auditees before you click Related Items. The Related Items tab appears next to the Flagged Items tab. It lists items that are related to the item selected in the Flagged Items tab. See Distribution List Members If a selected item was sent to a distribution list, you can find out which other users received the message. To do so, complete the following steps: 1. Click the Distribution Lists tab in the right pane. In the Select Distribution List dropdown list, select a distribution list. 2. Click Display Members. The right pane lists the members. Note: NearPoint ediscovery does not display distribution lists created outside your organization. Distribution List details are only available for messages that were archived with NearPoint version 3.1 or later. Apply Tags When you find an item that is relevant to the case, apply an appropriate tag. To apply a tag to an item, complete the following steps: 1. Select an item, and then click Tags > Apply To Selected > <tag name>. You receive a message that confirms that NearPoint ediscovery applied the tag. 2. Click OK to close the message. The tag name and the name of the user who applied it are listed on the Holds and Tags tab in the right pane. If you are working in a case context, the Holds and Tags tab also displays tags added by other case reviewers. NearPoint ediscovery Option User's Guide 35

Review Search Results Apply a Litigation Hold to Custodian Content Sources Apply Litigation Holds Apply a litigation hold to an item to ensure that users cannot delete it and it will not be deleted if its retention period expires. To apply a hold to an item, complete the following steps: 1. Select an item, and then click Litigation holds > Apply > <hold name>. You receive a message that confirms that the hold is applied to the item. 2. To close the message, click OK. The Holds and Tags tab in the right pane displays the hold name, the name of the user who applied it, and the date the hold was applied. If you are working in a case context, the Holds and Tags tab also displays holds that other case reviewers added. Note: This tab lists only holds that reviewers applied to individual items. It does not list holds that you applied to custodian content sources. For more information, see Apply a Litigation Hold to Custodian Content Sources (on page 36). Attach Comments To attach a comment to an item, complete the following steps: 1. Select the item, and then click Add Comments. The Add Comments dialog box opens. 2. In the text box, type your comment, and then click OK. You receive a message that confirms that the comment was saved. 3. To close the message, click OK. The Comments tab in the right pane displays the comment, the name of the user who applied it, and the date that a reviewer added the comment. If you are working in a case context, the Comments tab also displays comments that other case reviewers added. Apply a Litigation Hold to Custodian Content Sources When you review individual case items, you can add litigation holds that override the NearPoint retention policy for the item. For more information, see Review Items (on page 34). In addition, you can apply litigation holds to all items in a custodian content source at one time. For email, you can apply a hold to an entire mailbox. For files and SharePoint content, you can apply a hold to a NearPoint cabinet that contains the items of interest. To apply a litigation hold to a custodian content source, complete the following steps: 1. While you are working on a specific case, click the Litigation Holds space. 2. In the My Litigation Holds section of the navigation pane, click Case Holds or Universal Holds. 3. From the list of holds in the results pane, select the hold that you want to apply. 4. Click Apply. The Litigation Hold dialog box opens. NearPoint ediscovery Option User's Guide 36

Review Search Results Apply a Litigation Hold to Custodian Content Sources 5. From the list, select the names of custodian content sources to which you want to apply the litigation hold. 6. Click OK. The Details pane displays the list of custodian content sources to which you applied the selected hold. Items from the custodian content sources to which you applied the hold are retained as specified in the hold. Note: NearPoint ediscovery does not display custodian-level litigation holds in the Search workspace (Results or Review tab) or in the Litigation Holds report. NearPoint ediscovery Option User's Guide 37

Chapter 4 EXPORT ITEMS After you review items and find those that are relevant to a legal matter, you can export them to deliver to opposing counsel, to use for court-ready production, or to import into other tools for further review and analysis. The ediscovery Option lets you export PST files of selected email items or ZIP files of selected files. To export items from NearPoint ediscovery, complete the following procedures: 1. Create an Export Container (on page 39) 2. Export and Save Batches of Items (on page 39) Create an Export Container To create an export container, complete the following steps: 1. Click the Exports space. 2. In the ediscovery toolbar, click Create. 3. Type a name and description for the export container. 4. Click OK. The export container appears in the navigation pane under Exports. Tip: You can modify the name and description of an export container. To do so, select it, and then click Modify. Similarly, to remove a selected export container, use the Delete action. When you delete a container, all export batches within it are also deleted. Export and Save Batches of Items To export and save a batch of items, complete the following steps: 1. Click the Searches space or the Review Lists space. 2. Click Export. The Exports dialog box opens. 3. Select one of the following options: Export all results to have the export batch contain all items listed in the search results (Searches space) or all items in the review list (Review Lists space). NearPoint ediscovery Option User's Guide 39

Export Items Export and Save Batches of Items Export flagged items only (default) to have the export batch contain only flagged items. 4. Under Export details, enter the following information: Base Name Type a name for a base file within the container. Save In From the drop-down list, select an export container. Display Name Type the name to display for the export batch. Password To password protect the exported file, type a password. Confirm Password Type the password again. Select PST Version For exported email items, select an Outlook PST file format from the drop-down list. 5. Under Splitting options, select either or both of the following options: Split results by owner to divide items into separate files based on the owner of the items. Retain Folder Structure (default) to keep items in the same nested folder structure that they had in their native environment. 6. (Optional) Enter a value to change the maximum size of the export batches, if desired. Default sizes for exported batches are as follows: ZIP files 19,000 MB Files only 10 GB PST files 2 GB (Outlook 97-2000), 20 GB (Outlook 2003 or later) Mixed content: 2 GB, if the content contains PST files for Outlook 97-2000 10 GB, if the content contains PST files for Outlook 2003 or later 7. Click OK. You receive a message that indicates that the export has started. 8. Click the Exports space. The export batch is listed under the selected export container under Exports. 9. Expand the export container to view the export batches that you added to it. If you select an export batch, all PST and ZIP files that you created in the selected batch are listed in the results pane. 10. Click a PST or ZIP file to save it on your local computer. Note: Use WinZip to open ZIP files after export. NearPoint ediscovery Option User's Guide 40

Chapter 5 CREATE AND VIEW REPORTS The sections that follow explain how to use the NearPoint ediscovery reporting features. Prerequisite: To use NearPoint ediscovery reporting features, you must have the Access Reports permission. Generate an Auditor Activity Report Prerequisite: You must have the Access Reports permission to perform this procedure. To generate an Auditor Activity Report, complete the following steps: 1. In the NearPoint ediscovery client, click the Home tab. 2. Click Reports. The results pane shows lists of general and case-specific report types. 3. Double-click Auditor Activity Report. The Auditor Activity Report window opens. 4. Under Date, click the calendar buttons in the From Date and To Date boxes and choose a start and end date for the reporting period. 5. In the lists in the Report Filters section, select the tags or holds, the content sources, and the auditors that you want to include in the report. To choose all items in a list, select the check box at the top of the column. 6. In the Report Filters section, set the scope of reviewers and activities to include in the report. To do so, complete the following steps: a. In the Auditors list, select the name of each auditor that you want to include in the report. b. In the Activity Targets list, select each activity target (group of activities) that you want to include. As you select Activity Targets, NearPoint ediscovery adds corresponding actions to the Activity Types list. Tip: To choose all items in a list, select the check box at the top of the column. NearPoint ediscovery Option User's Guide 41

Create and View Reports Generate an Auditor Activity Report Activity Target Search Case Administration ediscovery Search Query Review Lists Authentication ediscovery Administration Exports Message Activity Types Search performed Case Created, Case Modified, Case Deleted, Renamed a Tag, Deleted a Tag, Shared Tag with Auditors, Renamed a Hold, Deleted a Hold, Shared Hold with Auditors, Case Status Changed, Case Manager Changed Search Query Saved, Renamed a Search Query, Deleted a Search Query Saved to a Review List, Renamed a Review, Deleted a Review User Login Permissions Changed, Role Created, Role Modified, Role Deleted, Universal Tag Created, Universal Tag Modified, Universal Tag Deleted, Universal Hold Created, Universal Hold Modified, Universal Hold Deleted Files Retrieved, Exported Messages/Files View c. In the Activity Types list, select each activity type that you want to include. 7. Click Run Report. NearPoint ediscovery generates the report and displays it in the lower portion of the window. Tip: To view more of the report, click the double arrow in the Parameters heading to collapse the Parameters section. For information about the content of the report, see Auditor Activity Report Description (on page 43). For information about how to view, print, and export the report, or how to save the report parameters, see Work with Reports (on page 45). NearPoint ediscovery Option User's Guide 42

Create and View Reports Generate a Case-Specific Tag or Hold Report Auditor Activity Report Description The Auditor Activity Report is a chronological list of activities that users performed using the NearPoint ediscovery client. The report lists the activity that each user performed, the object on which the user performed the activity, and the object type. For search activities, the Details column provides a link to details about the search. This search report displays the total number of results found, the search criteria, and the content sources that each reviewer searched. Generate a Case-Specific Tag or Hold Report Prerequisite: You must have the Access Reports permission to perform this procedure. To generate a case-specific Tag Report or Litigation Hold Report, complete the following steps: 1. In the NearPoint ediscovery client, click the Home tab. 2. Click Reports. The results pane shows lists of general and case-specific report types. 3. In the Case Reports list, double-click Tag Report or Litigation Hold Report. The window for the report type that you selected opens. 4. In the Parameters section, next to the ediscovery Case field, click Select. The Case Selection dialog box opens. 5. Select a case, and then click OK. The Report Filters section of the window is populated with a list of tags (for the Tag Report) or holds (for the Litigation Holds Report), content sources, and reviewers associated with the selected case. 6. Under Date, click the calendar buttons in the From Date and To Date boxes and choose a start and end date for the reporting period. 7. Select a report type: Summary Report or Detailed Report. 8. In the lists in the Report Filters section, select the tags or holds, the content sources, and the auditors that you want to include in the report. To choose all items in a list, select the check box at the top of the column. 9. Click Run Report. NearPoint ediscovery generates the report and displays it in the lower portion of the window. Tip: To view more of the report, click the double arrow in the Parameters heading to collapse the Parameters section. For more information about the content of the reports, see Report Descriptions (on page 44). NearPoint ediscovery Option User's Guide 43

Create and View Reports Generate a Case-Specific Tag or Hold Report For more information about how to view, print, and export the report, or how to save the report parameters, see Work with Reports (on page 45). Report Descriptions Tag Report: Summary The summary Tag Report displays a section for each tag. In each section, it displays a pie chart that summarizes the number of tags of that type that all auditors applied to email items and files in the case. In addition, for each reviewer, the report displays the number of tags that each reviewer applied to each item type within a content source. Tag Report: Detailed The detailed Tag Report has the same sections as the summary report. In addition, it lists the title, date, size, group name, and location of each tagged item, as well as the date and time that the auditor applied the tag. Litigation Hold Report: Summary The summary Litigation Hold Report displays a section for each litigation hold. In each section, it displays a pie chart that summarizes the number of holds of that type that all auditors applied to email items and files in the case. Also, for each auditor, the report displays the number of holds they applied to each item type within a content source. Litigation Hold Report: Detailed The detailed Litigation Hold Report has the same sections as the summary report. In addition, it lists the title, date, size, group name, and location of each item on which the hold was placed, as well as the date and time that the auditor applied the hold. NearPoint ediscovery Option User's Guide 44

Create and View Reports Work with Reports Work with Reports Use the features of the report window to perform the following actions on reports that you generated. Button First Page Previous Page Current Page Next Page Last Page Action Show the first page. Show the previous page. Current page of total number of pages. Type a page number to view that page. Show the next page. Show the last page. Layout Refresh Print Print Click this button to toggle between a screen view and a preview of the print layout. Use the drop down list to change the size of the print layout view. Update the page view. Open the Print dialog box to print the report. Export Page Setup Text to Find Open the Page Setup dialog box to set print specifications. Export the report as to a Microsoft Excel, PDF, or TIFF file. Note: You must have the appropriate software installed on the target report location to view reports exported to the various file types. Type a keyword in the text box, and then click Find Text to find the keyword in the report. After one instance is found, the Find Next button is available. NearPoint ediscovery Option User's Guide 45

Appendix A DEVELOP ADVANCED SEARCH CRITERIA This section provides information about the following types of search operators: Boolean operators Proximity operators Wildcard operators Numeric range search operators In addition, it provides general search tips on how to use punctuation to help achieve optimal search results. Boolean Operators Boolean operators help you form a search criterion by connecting two or more words to search for in an item. Operator AND Description Finds items that contain all of the words linked with AND. Example: review AND meeting OR Finds items that contain any one of the words linked with OR. Example: review OR brainstorming OR meeting OR discussion AND NOT Finds items that do not contain the word following the AND NOT operator. Example: weekend AND NOT holiday. You can combine any or all of these Boolean operators to create a search criterion. For example, to search for items that contain the terms "review" and "meeting" but do not contain the term "conference", you use the following search criterion: review AND meeting AND NOT conference NearPoint ediscovery Option User's Guide 47

Develop Advanced Search Criteria Proximity Operators Proximity Operators Proximity operators enable you to look for a word that is close to another. NearPoint measures proximity by the number of words that separate the two words. For example, in the phrase "dog cat bird fish," "dog" and "cat" have a proximity of one, while "dog" and "fish" have a proximity of 3. Operator w/n where n is a positive number pre/n where n is a positive number not w/n where n is a positive number Description Finds items that contain terms that you often use close to each other, but not always in the same order. For example, the search criterion review w/5 meeting could find items that contain the following strings: Review Meeting, Review and approval meeting, or meeting for the purpose of reviewing Finds items in which a term occurs within a specified number of words before the other term. For example, you remember that the word meeting occurred before review, so you use the following search criterion: review pre/5 Meeting Finds items in which a term does not appear within a specified number of words from another term. For example, if you want to find items with the word crisis, but you do not want items about a financial crisis, you use the following search criterion: crisis not/5 financial Wildcard Operators Wildcard operators can help you find patterns of letters or words. Operator Description? Matches a single character. For example, a search criterion such as appl? finds items that contain the words apple and apply. * Matches any number of characters. For example, a search criterion such as appl* finds items that contain the words, application, apply, and applause. NearPoint ediscovery Option User's Guide 48

Develop Advanced Search Criteria Numeric Range Search Operator Numeric Range Search Operator To search for a range of numbers, use the ~~ operator. For example, if you were to enter 1000~~2000 in a search criterion, NearPoint ediscovery retrieves items that contain numbers in the range 1000 to 2000. General Search Tips When you type search criteria, consider the following guidelines: The words and the operators that you use in the search criteria are not case sensitive. Do not type quotation marks (" "). Do not include the following types of words in search criteria: Prepositions, such as in, on, at, and to. Articles, such as the, a, an, and some. Pronouns, such as he, she, them, it, and you. During a search, NearPoint ediscovery ignores these and other words that occur frequently in the English language. NearPoint ediscovery Option User's Guide 49

Develop Advanced Search Criteria Use of Punctuation in Search Criteria Use of Punctuation in Search Criteria Except for hyphens and underscores, NearPoint ediscovery replaces all punctuation marks in search criteria with spaces. For example, when you enter the word, "Employee's," NearPoint ediscovery treats as two words: "Employee" and "s." Any search for the character, 's' would retrieve words that contain "Employee's" and any search for "Employee's" would retrieve words that contain the single character, 's.' Similarly, if you enter, "101(a)2(i)," NearPoint ediscovery reads it as "101 a 2 i ". If you replace punctuation characters with the "?" wildcard character, NearPoint ediscovery will not read a search term as two or more words. The following characters are treated as punctuation: Characters treated as punctuation! $ ' +,. ; < = > [ ] ^ ` {} The following characters have special meaning for NearPoint ediscovery. Avoid using them in search criteria. Characters to avoid in search criteria? * () " / & % # ~ ~~ ## : NearPoint ediscovery Option User's Guide 50

Develop Advanced Search Criteria Use of Parentheses in Search Criteria Use of Parentheses in Search Criteria You can use combinations of several Boolean operators and several proximity operators in search criteria. Type parentheses around search terms and operators that you want NearPoint ediscovery to consider together, as shown in the following examples. Examples (review or meeting) and Thursday Review and (Meeting or Thursday) (Review or Meeting) w/5 Thursday Description Finds items that contain the word "review" or the word "meeting" along with "Thursday." Finds items that contain the word "Review", and either one of the terms "Meeting" or the word "Thursday." Finds items that contain the word "review" or the word "meeting" if they occur within five words before or after the word "Thursday." NearPoint ediscovery Option User's Guide 51

Appendix B TROUBLESHOOTING EDISCOVERY Installation, Configuration and Start-up This section lists issues with NearPoint ediscovery and explains how to resolve them. The issues are grouped by main product functions. ediscovery Console authentication failed Explanation: If you enter an incorrect user name, password, or domain, authentication fails. Resolution: Ensure that you specify the correct user name, password, or domain. To verify your authentication details, contact your NearPoint administrator. Logon error message about access When you try to log on to the ediscovery client, you receive the following error message: You do not have access to this service. Explanation: This error occurs under the following conditions: An unauthorized user tries to log on to ediscovery. The ediscovery Web service is not running properly. The Mimosa Data Access Service is not running properly. Resolution: Ensure that you meet the following conditions in your ediscovery environment: You have permission to use the ediscovery Console. The ediscovery Web service is installed and running. The Mimosa Data Access Service is running. To restart the service, complete the following steps: a. On the computer that has the ediscovery Server installed, open the Run window. b. Type the following command, and then click OK. services.msc NearPoint ediscovery Option User's Guide 53

Troubleshooting ediscovery Installation, Configuration and Start-up c. Right-click Mimosa Data Access Service, and then, from the shortcut menu, select Restart. Authenticated auditor cannot log on to Server Console An authenticated auditor cannot log on to the ediscovery Server Console. Explanation: This error occurs if the auditor is not authenticated to log on locally on the ediscovery Server. Resolution: To resolve this error, on the ediscovery Server, complete the following steps: 1. Click Start, and then select Programs > Administrative Tools > Local Security Policy. 2. In the left pane, select Security Settings > Local Policies > User Rights Assignment. 3. In the right pane, double-click Allow log on locally. 4. To add the auditor to authenticate for local log on, click Add User or Group. 5. To apply the changes, click Apply. 6. To check that the auditor can now log on to the application, try to log on to the ediscovery Server. The Mimosa Data Access Service is not running Explanation: Due to some.net issues, this error can occur. Resolution: To resolve this error, complete the following steps: 1. On the machine that has the ediscovery Server installed, open the Run window. 2. Type eventvwr, and then click OK. The Event Viewer opens. 3. If you see an error message that states "Root element is missing ", restart the Mimosa System Rules and Asset Management Service. To do so, complete the following steps: a. On the computer that has the ediscovery Server installed, open the Run window. b. Enter services.msc, and then click OK. c. Right-click Mimosa System Rules and Asset Management Service and then, from the shortcut menu, select Restart. NearPoint ediscovery Option User's Guide 54

Troubleshooting ediscovery Search Search Content Types field does not display the content types user can search for When you perform a search, the Content Types field does not display the content types that you can search for. Explanation: This condition occurs if the Mimosa Data Access Service and Mimosa System Rules and Asset Management Service are not running or have encountered an error. Resolution: Exit the ediscovery Console and restart the services. To do so, complete the following steps: 1. On the computer that has the ediscovery Server installed, open the Run window, enter services.msc, and then click OK. 2. Right-click Mimosa System Rules and Asset Management Service and select Restart from the shortcut menu. 3. Right-click Mimosa Data Access Service and then, from the shortcut menu, select Restart. No content sources are displayed When you define criteria for a search, the ediscovery client does not display content sources (users and/or cabinets) for the selected auditor. Explanation: If the selected auditor has no targets assigned, no targets are selected in the Select Targets dialog box. This condition occurs if the Mimosa Data Access Service is not running or encounters an error. The ediscovery client cannot populate the content sources list. Resolution: Ensure that you meet the following conditions in your ediscovery environment: The ediscovery user is assigned a role that has assigned content sources. For more information, contact your NearPoint administrator. Ensure that the Mimosa Data Access Service is running properly. For error messages, check the data access logs for the following function: _BasePolicy_GetAffiliateIndexesWithMailboxesAsUsers. For more information, contact Iron Mountain Support. Open the ediscovery client logs to check for error messages. For more information, contact Iron Mountain Support. Basic search for a specified date fails Explanation: You receive an error message if you have not indexed and archived email/file items for the specified date. Resolution: Ensure that you specify dates for which NearPoint has archived email/file items. NearPoint ediscovery Option User's Guide 55

Troubleshooting ediscovery Search Error message on clicking a Search object After you click a Search object in the left pane, you receive the following message: Search results above in the hierarchy are changes and please refresh your current search. Explanation: If you run a parent search again, it updates the results list. You receive this message if the child searches are not synchronized with the updated parent search results. Resolution: Run all child searches again to synchronize them with the updated parent search results. Performing a search does not display any results Explanation: You receive this message if no email/file items have been archived and indexed for the selected dates, or if the Mimosa Data Access Service is not functioning. Resolution: Ensure that you meet the following conditions in your ediscovery environment: The email/file items that you want to find have been archived and indexed during the selected dates. The Mimosa Data Access Service is up and running. Cannot hide Deleted Items in Files search results This issue applies to searches of files only. The List Filter button does not hide Deleted Items found in the search results of of files searches. Explanation As of NearPoint ediscovery release 3.5.0, NearPoint no longer supports exclusion of Deleted Items using the post-search list filter. Workaround None. Search fails for keywords that exceed 32 characters ediscovery searches fail if any word in the search criteria contains more than 32 characters. Explanation: The default maximum length of any keyword that you use to perform an ediscovery search is 32 characters. Resolution: To use longer keywords in searches, contact your NearPoint Administrator to edit the maximum number of characters allowed for keywords setting (under the Global/MailboxIndexer node). NearPoint ediscovery Option User's Guide 56

Troubleshooting ediscovery Search Search does not find special characters in custom field values A user search of custom fields in which the custom field values have either of the following special characters returns no results: and (checkbox). Explanation: These two characters are not supported in XML. Resolution: Do not use these characters in custom field values. NearPoint ediscovery Option User's Guide 57

Troubleshooting ediscovery Restore Restore A message restore operation fails A message restore operation fails, and you receive one of the following error messages: or Unable to open this message. Please try later or contact your system administrator. Cannot open file C:\Documents and Settings\npadmin\Local Settings\Temporary Internet Files\Conten...The file may not exist, you may not have permission... Explanation: This error occurs if the scratch volume on the NearPoint system exceeds its upper threshold. Resolution: To modify the scratch volume threshold, contact your NearPoint administrator. NearPoint ediscovery Option User's Guide 58

GLOSSARY OF TERMS C cabinets See content source. content source Container of content that NearPoint archives, which includes all objects in the Active Directory hierarchy, all objects in the Exchange hierarchy, and objects in cabinets, which are virtual containers created to archive content using NearPoint for File System Archiving or NearPoint for SharePoint. L litigation hold Lock applied to archived items required for litigation preparedness or a legal matter. This hold overrides the retention period applied to the items through an archiving policy. custodian Person who owns the content of a mailbox, mail folder, file share, file folder, SharePoint location, or other content source. D DAG Database Availability Group. A set of up to 16 Microsoft Exchange Server 2010 Mailbox servers that provide automatic database-level recovery in the event of a database, server, or network failure. Mailbox servers in a DAG monitor each other for failures. NearPoint ediscovery Option User's Guide 59

INDEX A A message restore operation fails 58 Advanced Search Criteria Email 19 Files 22 SharePoint 21 SMTP 23 Apply a Litigation Hold to Custodian Content Sources 36 Apply Litigation Holds 36 Apply Tags 35 Attach Comments 33, 36 Audience 5 Auditor Activity Report Description 42, 43 Authenticated auditor cannot log on to Server Console 54 B Basic search for a specified date fails 55 Boolean Operators 47 C cabinets 59 content source 59 Content Types field does not display the content types user can search for 55 Create a Boolean Search String with the Query Builder 16, 17 Create a New Search from an Existing One 26, 27 Create a Scheduled Search 27 Create an Export Container 39 Create and View Reports 10 CREATE AND VIEW REPORTS 41 custodian 59 D DAG 59 Delete a Scheduled Search 29 Develop Advanced Search Criteria 16 DEVELOP ADVANCED SEARCH CRITERIA 47 duplicates 31 hide duplicate email items 31 redisplay hidden 31 E ediscovery Console authentication failed 53 ediscovery Metadata Fields 24 Email-related Criteria 19 Error message on clicking a Search object 56 Export and Save Batches of Items 39 Export Items 10 EXPORT ITEMS 39 F Files-related Criteria 22 filtering 31 clear filter 31 filter items 31 Flag Items for Review 31 NearPoint ediscovery Option User's Guide 61

Index G General Search Tips 49 Generate a Case-Specific Tag or Hold Report 43 Generate an Auditor Activity Report 41 Getting Assistance 7 GETTING STARTED 9 I In Email Items 19 In Files Items 22 In SharePoint Items 20 In SMTP Items 23 Installation, Configuration and Start-up 53 L Launch the ediscovery Client 12 litigation hold 59 Litigation Hold Report Detailed 44 Summary 44 Logon error message about access 53 M Modify a Scheduled Search 29 N New Features in This Release 11 No content sources are displayed 55 Numeric Range Search Operator 49 O Open a Case 14 P Perform a Basic Search 15, 18, 27 Perform an Advanced Search 18, 27 Performing a search does not display any results 56 Point-in-time Criteria 24 Populate the Review Tab List 34 PREFACE 5 Product Documentation and Online Help 6 Proximity Operators 48 NearPoint ediscovery Option User's Guide 62 Q Quick Tour 13 R Read the Item Content 35 Report Descriptions 43, 44 REPORTS 41 Restore 58 Resume a Scheduled Search 28 Review Items 34, 36 Review Search Results 10 REVIEW SEARCH RESULTS 31 S Save a Review List 33 Save a Search 25 Search 55 Search does not find special characters in custom field values 57 Search fails for keywords that exceed 32 characters 56 Search the NearPoint Archive 10 SEARCH THE NEARPOINT ARCHIVE 15 Search within Results 25 See Distribution List Members 35 See Related Items 35 SharePoint-related Criteria 20 SMTP-related Criteria 23 Sort the List 34 Stop a Scheduled Search 28 T Tag Report Detailed 44 Summary 44 The Mimosa Data Access Service is not running 54

Index TROUBLESHOOTING EDISCOVERY 53 Typographical Conventions 7 U Use of Parentheses in Search Criteria 51 Use of Punctuation in Search Criteria 50 V View the Summary of Search Results 31 W Who's Who in NearPoint ediscovery 5, 10 Wildcard Operators 48 Work with Reports 42, 44, 45 Work with Scheduled Searches 27 NearPoint ediscovery Option User's Guide 63