ediscovery 5.3.1 Service Pack 8 Release Notes Document Date: July 6, 2015 2015 AccessData Group, Inc. All Rights Reserved Introduction This document lists the issues addressed by this release. All known issues published under previous release notes still apply until listed as Fixed Issues. IMPORTANT INFORMATION General Service Pack 8 includes all fixes and enhancements that were included with Service Packs 1 7. Requirements For general software and hardware requirements, please see http://accessdata.com/solutions/ediscovery/adediscovery/technical. Service Pack 8 requires version 5.3.2.51 of Site Server, which was bundled with Service Pack 5. If you are not running this version, please download the additional Site Server installer from the FTP Site. You will need to uninstall your currently installed version of Site Server before installing this version. 5.3.1 SERVICE PACK FIXED ISSUES The following issues have been resolved in this patch: 5.3.1 Service Pack 8 Fixes w3wp.exe crash on web server (23632) Custom fields are not exported to CSV from custodian tab (26644) When you do a network collection with shares that have the same trailing 10 characters in the name, it causes all sorts of errors. (26658) PSTs will not export properly (29097) Unable to export all emails and attachments (29339) ediscovery 5.3.1 Service Pack 5 has several issues that prevent auto-provision of "phone home" Agents from succeeding (29630) Exporting Reduced PST using the original PST option does not produced desired results (29702) Email files fail to open when exported to AD1 as MSG files (29866) Processing 18+GB PST does not extract any emails (29979) Email files fail to open when exported to AD1 as MSG files where Source is OST (30588) Emails from the parent folder in a PST do not get exported for a PST with multiple level folders when exporting with Reduced PST option (30841) ediscovery 5.3.1 Service Pack 8 Release Notes Page 1
Change Color for Export from Light Green to Orange when it Completes with Errors (31297) 5.3.1 Service Pack 7 Fixes CMIS Configuration (21402) Issue with Processing Evidence (25637) Searching with Date constraints not producing accurate results (21620) Search hits in review are different with the same data set when using de-duplication (24878) Custodian facet counts incorrect because of missing entries in cmn_objectdtsearches table (28446) Native Image goes away after clicking on "Create Image" (28289) Change to default to new EXPORT PST option (28616) 5.3.1 Service Pack 6 Fixes Customer issues. 3.3 db migration to 5.3.1 (16848) Failed Native Exports with PST (15483) Export completion time doesn't match time in logs or observed time (15710) Files missed during workstation collection (16613) Multiple errors reported when retrieving messages from Exchange 2010 via EWS (17163) AD1 Encryption at collection not working for network shares (18673) Exchange Collections not working for larger sized Inboxes (18747) Some errors from Search (dtsearch) are being suppressed (21768) 5.3.1 Service Pack 5 Fixes During collections, targets that are being collected are updated more frequently so that there's less latency in reporting the status (12098) File stream errors will no longer occur in native exports with file names between 255 and 260 characters. This path is now truncated just like longer file names (13866) Sharepoint collection fails for certain lists with invalid character (15331) The Value field in the Project Filter Options is no longer case-sensitive (15719) 5.3.1 Service Pack 4 Fixes Slipsheets are now generated for all pages that are still exported when "Exclude Extensions" option is used for creating export sets (6929) Redactions are now carried over on produced records for certain.pdf records when redactions are on native (7265) An export in progress now displays the correct "Elapsed Time" value (8470) Export Sets no longer ignore the Exclude Extensions option when the source record has an image (8813) Slipsheets are now displayed in Image Viewer for produced and exported records (8989) A single slipsheet is now generated, instead of one for each page of the exported record, when Exclude extension option is used (8994) You can now collect data from your content management system using the new CMIS Data Source (9572) Imaging to single- and multi-page.tiffs no longer are failing to image properly due to.pdfs that have layers missing from the.tiff images generated during production (9588) Native redactions and highlights are now printed consistently for extensions.jpg,.png,.tiff when loaded as natives via Evidence Processing (9677) Native files are now getting exported when a slipsheet is required for the extension while creating the Production Set. Export folder now has the expected native files (9840) ediscovery 5.3.1 Service Pack 8 Release Notes Page 2
Where source records have an image associated with them, custom slipsheets now get applied and a default slipsheet is applied (9888) Branding is now carried over on some documents for large production sets created with the Multi-Page option for rendering images (10368) Native.swfs from a produced native now produces properly and with the proper page count (10407) Produced images that are imaged as multi-page.tiffs and produced again as single-page.tiffs are now produced and exported as multi-page.tiffs instead of single-page tiffs (10525) Multi-page.swfs now have correct page counts for the.pdf.swf streams when doing native.swf conversions (10594) For data loaded via Import with both image and native and having redactions on the image, the source image is now produced instead of the native being produced as an image with redactions from the source image (11116) For redaction on images, produced natives are now created instead of native.swf being created and displayed. (11132) The "Number of collected files column has been removed so that it doesn't cause confusion on the hit count and collected files counts (11273, 11263) Export report will no longer have an error after AD1 export when files being exported contain characters that are illegal Windows file system characters and the files will now export successfully (11310) Redactions are now carried over to produced images when images are rendered as multi-page.tiffs and redactions are on the source image (11319) The Search report no longer shows redundant information while using phrases with wildcards (11530) Slipsheet generation now gives consistent results when the same data set is used to create multiple Export Sets (11779) Search hit report no longer hangs with a large volume of data (12103) In Data Sources, you can now add SharePoint URLs that are as long as 500 characters (12104) Now, any time an error or warning is logged to the CSV log file and if the Production or Export Set creation or export does complete successfully, the status becomes Creation Completed With Warnings or Export Completed With Warnings. The status display in the Production or Export History tab is then a yellow-green instead of green. (13329) When using the Facets for Email Senders Domain, and others, the numbers now match the pre-loaded numbers and return the correct documents (13331) When it's necessary to restart Work Manager, jobs that are currently processing will now go to a Failed status (13548) When there's a database error when deleting a project, the name of deleted project is still be captured in the Activity Log (13559) Some email signatures with light blue font are now getting imaged (13792) You can now choose "Cancel Incomplete" as the default selection in the Job Wizard for Job Expiration. (13795) For native.swfs created for a produced native.swf, all pages are now produced to.swf correctly (13794) Fixed text-based redactions on produced natives (13838) AD1 exports now contain files that would, at times, previously be logged as a missing file in the AD1 export (13872) Fixed certain cases where a PST export would have no data inside the export folder (13875) Production, Export, and Printing Tab timeouts have increased so that they do not time out unexpectedly (14194) Processing now enumerates, processes, and indexes email with attachments more consistently to provide consistent evidence counts between cases with the same evidence (14258) Item counts now match between native MSG and PST exports in the Export Set History tab (14263) After upgrading from InSight 5.2.x, pushing an Endpoint Threat Monitoring (ETM) policy will no longer fail, due to coreupdate not updating the filter drivers (14337) ediscovery 5.3.1 Service Pack 8 Release Notes Page 3
After a job is canceled, Site Server no longer saves the temporary results from the agent(s) in the Site Server storage folder, but deletes them to optimize disk space (14348) 5.3.1 Service Pack 3 Fixes KFF deletes now occur when necessary so that those Job Target Results complete (8915) Trailing spaces in network paths no longer fail jobs (8997) Data Sources no longer allow duplicate Computers so that there are no longer conflicts (9085) Threat Scan jobs now complete when Site Server is not running under the user security context for the responsive path (9483) Threat Scan jobs now return the expected results in cases where it would return too many results (9458) For Threat Scan job, the IOC indicator with mixed criteria classes now returns hits for all matching criteria (9135) Threat Scan jobs are now completing after pushing new modules to agents core versions 4.9.x, 32-bit operating system (9544) In Doc search in Text Viewer, InSight no longer throws an exception on clicking 'Next Hit' while on the last hit (10141) Volatile job now completes in instances when it used to fail with error: "Failed to set policy for policy id" (10176) Leftover coreupdate files no longer cause some jobs to fail (10195) Export jobs now complete successfully in certain instances when they would hang (10252) When FireEye and Arcsight are configured together, the Third Party Service now generates CEF files after applying SP 2 (10388) Notes Archive Options filter is available (10585) Admon.sys no longer causes a blue screen at time of bootup (10854) InSight now pushes an agent in folder storage mode when it would fail at times (10992) Cerberus jobs set for the agent to throttle now throttle the Jamsa.exe and ad_jam.exe processes (10966) Agents sending heartbeat now accept jobs when it wouldn't at times (11007) Heartbeat now updates the contact date and version with correct core version (11223) The Native Export is now successful when output is reduced PST and has Original File name (11305) WorkExecutionServices no longer consumes all of the RAM when generating Email and File Dedup reports. You can also choose to generate those reports on demand (12118) This also fixes certain issues with some failing Volatile jobs: o When there are fields that are not null that need to have null data inserted, this fix will put <unknown> in these fields when nulls are encountered. o When there are fields (such as a DateTime field, LastLoggedIn field) that attempts to insert an invalid date for SQL server when the original data had a null, it now attempts to insert the C# default value for DateTime. o When the IpAddress field for a Network Share Session is not really an IP Address, but instead it is the Computer Name, it will be left null when the data cannot be parsed into an IP Address. This is because the field is an IP Address type in the database. 5.3.1 Service Pack 2 Fixes KFF Replication jobs now complete without a "Completed with errors" status (4074) ediscovery 5.3.1 Service Pack 8 Release Notes Page 4
Fixed the issue where importing some CSV files caused an unknown failure (5746) InSight Dashboard no longer has a memory leak (6084) The Review grid now populates correctly after the first time a Network Acquisition alert is opened in Review (6591) Data collected from Collection Jobs that are part of Combination jobs now populates Review as well as reports (6647) Interrupted collections no longer re-collect from the beginning after resuming the collection (7566) Issues with large project lists no longer cause problems with permissions (7812) You can now cancel a System Job when there are issues contacting agents (7797) The Job Target Results pane now populates correctly when running a 3000-node job (8007) A 3000-node job now executes correctly without deadlock errors in the system logs (8017) Job details now display in Job Target Results pane when using.net 4.0 (8195) Threat Scan jobs now perform more quickly and overall performance has been improved (8266) The LitHold asp.net approval page now operates correctly, and no website error occurs when creating a new LitHold after upgrading from 5.0.2 to 5.2.1 (8325) You can now generate a Job Results report during the collection of a job. The report can be generated after the job starts collecting and at least one job target status is collecting. (8448) The Execute button now immediately become disabled once a job is submitted, preventing the user from clicking the button a second time (8450) If a PST file is not smaller after reduction or if a PST does not reduce after exporting, an error message appears in the log file alerting you to the problem (8513) Spaces at the end of network paths no longer cause issues (8997) The Language field now appears in Review when using ediscovery (9118) Quick columns now appear when using ediscovery (9119) A Threat Scan indicator with mixed criteria classes now produces results for all matching criteria (9135) On Threat Scan jobs, the File Modified search indicator now produces results when condition is "greaterthan" (9218) Email addresses are now retained during production set creation (9785) On Threat Scan jobs, hits are now generated for matching File Size criteria and Compile Time criteria with AND logic (9788) The threshold for load files has been lowered to 400MB. This keeps a family of files smaller than 512 MB, since file sizes larger than 512 MB cause issues. (9795) The CoreUpdate files no longer cause some jobs to hang or fail (10195) 5.3.1 Service Pack 1 Fixes Fixed the issue where a PST reduction failed because of the MAX_PATH exceeded (1575) Filter Options in Project List now display in alphabetical order (2097) Exporting native files now only outputs native files, instead of outputting both native files and OCR text files (8307) You no longer receive an error on the Validate Path button when in Exports (8424) ediscovery 5.3.1 Service Pack 8 Release Notes Page 5
COMMENTS? We value all feedback from our customers. Please contact us at support@accessdata.com. ediscovery 5.3.1 Service Pack 8 Release Notes Page 6