1. Introduction
E-discovery (electronic discovery) is the legal procedure for locating, collecting, and delivering Electronically Stored Information (ESI) as evidence to be used in court cases or investigations. Information governance programs frequently incorporate e-discovery since it is an obligatory legal and regulatory requirement.
E-discovery is frequently ignored by organizations and only becomes meaningful after a case is launched. Moreover, the e-discovery process is often unfamiliar ground for many organizations with investigations into data privacy concerns and digital infiltration proving to be a challenge, even with experienced internal staff.
Organizations that store large amounts of data need to know exactly what data they have, and where it is located. Large databases might take months to search, and investigators need to have access to the right information quickly.
2. How Lepide Helps with e-Discovery
The Lepide Web Console provides an out-of-the-box e-Discovery tool that will scan your repositories to locate files containing Personally Identifiable Information (PII).
Our Solution allows you to combine multiple values as well as search an expansive range of file types ensuring you get the most accurate results possible, thereby avoiding time-consuming false positives.
3. Starting e-Discovery
Hover over the Identify icon on the menu to the left side of the screen
Select e-Discovery
The e-Discovery screen will be displayed:
4. Setting Up a Case
The first step in the e-Discovery process is to set up a Case to specify the details of the data you want to find. A case can be Non Indexed or Indexed depending on your requirements and the instructions for setting these up are given in Sections 4.2 and 4.3 of this guide.
You can use Local Host or an Agent when setting up an e-Discovery Case. The following steps explain how to install an Agent:
4.1 Install Agent
Click the Settings tab (top of the screen next to the Cases tab)
This will display the Settings window with Categories listed on the left hand side
Ensure that the Agents category is displayed by clicking the Agents icon:
All installed agents are listed here
Agent settings can be edited by clicking the icon
To add a new Agent, click the Install Agent button
This displays the Install Agent dialog box:
To add a new agent:
Click the icon
This displays the Add Server dialog box:
Add the following information:
IP Address: Add the IP Address
Agent Path: Use \\Server name\Share name format
User Name: Use domain name\User name format
Password: Enter Active Directory password
Click Done when finished
Once all the Agents have been added, check the box(es) to select Agents individually or choose Select All to select all Agents
Click the Install button to install the Agents.
Creating a New Case – Non Indexed
To create a non indexed Case:
On the top left of the screen are two tabs: Cases and Settings
Ensure that the Cases tab is selected
Click the button (top right of the screen)
The Create New Case dialog box is displayed:
Type in the Name of the case and add a Description
Click Next
The Select Objects dialog box is displayed:
Select the Component from the drop down list
Select Non Index for the Search Type. To use the Index Search Type, please refer to section 4.3 of this guide
Add the User Name in Domain name\User name format
Type the Password (this is the Active Directory login password)
Click the Add File Server button to add a File Server. The file server will be listed at the bottom of the dialog box.
Click the Add UNC Path to specify a UNC path in this format: \\Server name\Share name. This will be listed at the bottom of the dialog box.
Click Next
The File Type dialog box is displayed:
This allows you to specify all the details for the files you want to find. The more specific you can be here, the better the search results will be.
Choose the following:
File Criteria: All, Include or Exclude
If you choose Include or Exclude, the following file type options will be displayed:
This is a long list of file types. Scroll down to see the complete list.
Check or uncheck the file type boxes to choose which ones you want to Include or Exclude
Enable OCR: Check enable OCR (Optical Character Recognition) if you want image files containing text to be scanned
Select All: Check this box to select all file types
Search File Type: Type a file type here to search for and it will list all file types containing that value.
For example, if you type .doc into the search box, it will show *.doc, *.docx and *.docm and so on.
Click the icon to add a file type
Type the file type name and click Add
If you want to remove this file type, select the file type to be removed and click the icon
Check Last Modified to specify a date when the file(s) was last modified
File Size Limit: This can be KB or MB. The suggested limit is 20MB
Search For: Here you can type strings of characters that you want to search for. Click Add to add each string.
In the example below where we are searching for Marty Byrde we could add search strings for his name, address, DOB and so on
Choose the Operator. In this case it is OR to search for any of the strings
Each string will be displayed at the bottom of the dialog box along with the operator specified:
Click Next
The Search Server dialog box will be displayed:
Here you can specify when the Search should start:
Search Now – search immediately
Do not Search – the Case is set up, but the search can be initiated at a later date
Search Later - specify a date and time for the search to start
Choose Local Host or Agent Server
If you choose Agent Server, you will need to click the Validate Agent button
No of Threads: For quick results keep the minimum thread count value as 20
Click Done when finished
A message will appear: Case Created Successfully
The Case will be listed in the e-Discovery screen:
4.3 Running a Report
Once a Case has been set up, and a scan has been run, you can run a report to see the data returned based on the criteria specified in the Case.
From the e-Discovery screen, click the icon next to the case on which you want to run the report
This will show the following menu:
Choose Success Report
The Report is displayed:
The Case Name, Operator and search strings are shown at the top of the screen
File Server and File Paths are listed for all the files that have been found to contain the search criteria we specified in the Case
The report can be Exported to CSV or PDF by clicking the Export button
Here is an example of a report exported to PDF format:
4.3.1 Other Non Index Case Action Menu Options
The other menu options are as follows:
Start Scan: Starts the scan running
Remove: Delete the Case
If you choose Remove, you will have to confirm the action:
Edit: Edit the scan settings
Failed Report: List all Failed Reports for this Case
4.4 Creating a New Case – Indexed
When you create a new case which is Indexed you will need to select a Location. A Location contains server and file type information and once a location has been created, you can use it for multiple cases.
The steps for setting up a new Location are given below. If you already have the Location set up, then you can move to Section 4.4.2 of this guide.
4.4.1 Create a New Location
The steps to create a Location, to use with an indexed case, are as follows:
From the e-discovery window, choose the Settings tab
This will display the Settings window with Categories listed on the left-hand side
Select the Indexed Locations Category by clicking the icon:
All Location Names are listed on this screen
To add a new Location, click the button
This displays the Create New Location dialog box:
Type in the Name of the location and add a Description
Click Next
The Select Objects dialog box is displayed:
Select the Component
Index will be selected for the Search Type
Add the User Name in Domain name\User name format
Type the Password (this is the Active Directory login password)
To add an entire file server to be indexed, click the Add File Server button. Once added, the file server will then be listed at the bottom of the dialog box.
To add a specific location to be indexed, click the Add UNC Path in this format: \\Server name\Share name. Once added, this will then be listed at the bottom of the dialog box:
Click Next
The File Type dialog box is displayed:
This allows you to specify all the details for the files you want to find. The more specific you can be here, the better the search results will be.
Choose the following:
File Criteria: All, Include or Exclude
If you choose Include or Exclude, the following file type options will be displayed:
This is a long list of file types. Scroll down to see the complete list.
Check or uncheck the file type boxes to choose which ones you want to Include or Exclude
Enable OCR: Check enable OCR (Optical Character Recognition) if you want image files containing text to be scanned
Select All: Check this box to select all file types
Search File Type: Type a file type here to search for and it will list all file types containing that value.
For example, if you type .doc into the search box, it will show *.doc, *.docx and *.docm and so on.
Click the icon to add a file type
Type the file type name and click Add
If you want to remove this file type, select the file type to be removed and click the icon
Check Last Modified to specify a date when the file(s) was last modified
File Size Limit: This can be KB or MB. The suggested limit is 20MB
Search For: Here you can type strings of characters that you want to search for. Click Add to add each string.
In the example below where we are searching for Marty Byrde we could add search strings for his name, address, DOB and so on
Choose the Operator. In this case it is OR to search for any of the strings
Each string will be displayed at the bottom of the dialog box along with the operator specified:
Click Next
The Search Server dialog box will be displayed:
Here you can specify when the Search should start:
Index Now – search immediately
Do not Index – the Case is set up, but the search can be initiated at a later date
Index Later - specify a date and time for the search to start
Choose Local Host or Agent Server
If you choose Agent Server, you will need to click the Validate Agent button
No of Threads: For quick results keep the minimum thread count value as 20
Click Done when finished
A message will appear: Location Created Successfully
The Location will be listed in the e-Discovery screen:
4.4.2 Create Case
Once you have set up a Location, you can create an indexed Case. The steps for doing this are as follows:
On the left of the e-Discovery screen are two tabs: Cases and Settings
Ensure that the Cases tab is selected
Click the + Create Case button (top right of the screen)
The Create New Case dialog box is displayed:
Type in the Name of the case and add a Description
Click Next
The Select Objects dialog box is displayed:
Select the Component
Select Index for the Search Type. To use the Non Index Search Type, please refer to Section 4.1
Select the Location. For information on how to create a Location, please refer to https://lepide.atlassian.net/wiki/spaces/LEPKB/pages/edit-v2/4056743940#4.4.1-Create-a-New-Location
The Location Name will be displayed at the bottom of the dialog box:
Click Done
The Case name will be displayed. Indexed cases are shown in blue while non-indexed cases are shown in black.
4.4.3 Specify the Search Criteria for an Indexed Case
Once an Indexed Case has been set up, you can specify the search criteria.
Click on the Case Name (shown in blue for an Indexed Case)
Type the search string and click Add
The string will be displayed at the bottom of the dialog box
From the Operators drop down list, select AND/OR as required
Click Search
The results will be displayed at the bottom of the screen:
From here you can click the icon to preview the file:
Click Close and then click Export to export the file to PDF or CSV format:
4.4.4 Action Menu for Indexed Cases
From the e-Discovery screen, click the icon
This will show the following menu:
The Action Menu options are as follows:
Search: Display the Search dialog box
Remove: Delete the Case
If you choose Remove, you will have to confirm the action:
Edit: Edit the scan settings