Method and apparatus for electronic data discovery

• US 8,112,406 B2
• Filed: 12/21/2007
• Issued: 02/07/2012
• Est. Priority Date: 12/21/2007
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Paknad, Deidre, Raynaud-Richard, Pierre, Pogodin, Andrey
• Primary Examiner(s): Hoang, Son T
• Application Number:
  US11/963,383
• Publication Number:
  US 20090165026A1
• Time in Patent Office: 1,509 Days
• Field of Search: 707/706, 707/758
• US Class Current: 707/706
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

Removing or minimizing human participation in the collection or hold process, pursuant to electronic discovery, in a robust, fast, transparent, and legally defensible manner. A method and apparatus that ensures a robust and defensible way of communicating electronic discovery collection and hold requests from electronic discovery management systems to disparate data sources in a uniform way.

Claims

1. An electronic discovery apparatus for communicating both electronic discovery collection requests, in which data are collected from one or more data sources, and hold requests, in which one or more data sources are instructed to preserve certain data, in connection with discovery of electronically stored evidence, comprising:

a plurality of data sources comprising said electronically stored evidence;

a hardware connector comprising an interface and a plurality of services for performing operations on said data sources; and

an electronic discovery management application (EMA) embodied in a hardware module for managing collections and holds, said EMA communicating with said data sources via said connector by calling said connector services, wherein said EMA communicates collection and hold requests to said data sources, and collects said electronically stored evidence from said data sources, said EMA further comprising any of a uni-directorial communications module and a bi-directorial communications module, with which all service calls are initiated by said EMA, and with which said connector only responds to service calls from said EMA, said uni-directorial module further comprising;

a configuration service, wherein when said EMA requests configuration information from said connector, said information comprises at least one in a group consisting of query templates, information on a subset of services supported by said connector, information on versions of services supported by said connector, information on preservation capabilities of a data source or connector, and information of limitations on said connector implementation;

an optional validation service, wherein said EMA sends proposed values of query parameters to said connector, and said connector validates these parameters and replies with error description when said parameter values are invalid;

a collection request service, wherein said EMA instructs said connector to start a collection based upon provided query parameters, and wherein said connector responds with acknowledgement, collection information, or an error message;

an optional collection request readiness service, wherein said EMA checks whether said connector is ready with said electronically stored evidence to download, and wherein said connector responds with acknowledgement, collection information, or an error message;

an optional collection reminder request service, wherein said EMA instructs said connector to update an existing collection with newly arrived electronically stored evidence, and wherein said connector responds with acknowledgement, collection information or an error message;

an optional collection reminder request readiness service, wherein said EMA checks whether said connector is ready with said electronically stored evidence to download, and wherein said connector responds with acknowledgement, collection information, or an error message;

an un-staging service wherein, once said EMA has downloaded collected electronically stored evidence, said EMA calls said un-staging service to indicate that said connector disposes of transient information needed to perform a collection transaction, wherein said transient information only persists for a predetermined time period, and wherein said connector responds with acknowledgement, completion message, or an error message; and

an optional un-staging readiness service, wherein said EMA checks whether said connector has finished an un-staging process, and wherein said connector responds with acknowledgement, completion message, or an error message.

2. The apparatus of claim 1, said data sources each comprising any of:

a file system containing individual document files;

a content management system;

a transactional data driven application;

an email server; and

an email archive.

3. The apparatus of claim 1, wherein said connector services comprise any of Web Services, structured hypertext transfer protocol (“

HTTP”

) requests, and local or remote procedure calls.

4. The apparatus of claim 1, wherein said bi-directorial module further comprising:

a configuration service, wherein when said EMA requests configuration information from said connector, said information comprises at least one in said group consisting of query templates, information on a subset of services supported by said connector, information on versions of services supported by said connector, information on preservation capabilities of a data source or connector, and information of limitations on said connector implementation;

an optional validation service, wherein said EMA sends proposed values of query parameters to said connector, and said connector validates these parameters and replies with error description when said parameter values are invalid;

a collection request service, wherein said EMA instructs said connector to start a collection based upon provided query parameters, and wherein said connector responds with acknowledgement, collection information, or an error message;

an inbound collection status service, wherein said connector notifies said EMA that collected electronically stored evidence is ready for download, or collection is in progress, or notifies of an error;

an optional collection reminder request service, wherein said EMA instructs said connector to update an existing collection with newly arrived electronically stored evidence, and wherein said connector responds with acknowledgement, collection information or an error message;

an inbound collection reminder status service, wherein said connector notifies said EMA that collected electronically stored evidence is ready for download, or collection is in progress, or notifies of an error;

an optional un-staging service wherein, once said EMA has downloaded collected electronically stored evidence, said EMA calls said un-staging service to indicate that said connector disposes of transient information needed to perform a collection transaction, wherein said transient information only persists for a predetermined time period, and wherein said connector responds with acknowledgement, completion message, or an error message; and

an optional un-staging status service, wherein said connector notifies said EMA whether un-staging has been completed, error happened during un-staging, or un-staging is in progress.

5. The apparatus of claim 1, wherein said bi-directorial module further comprising:

a configuration service, wherein when said EMA requests configuration information from said connector, said information comprises at least one in said group consisting of query templates, information on a subset of services supported by said connector, information on versions of services supported by said connector, information on preservation capabilities of a data source or connector, and information of limitations on said connector implementation;

an optional validation service, wherein said EMA sends proposed values of query parameters to said connector, and said connector validates these parameters and replies with error description when said parameter values are invalid;

a hold request service, wherein said EMA instructs said connector to start a hold based upon provided query parameters, and wherein said connector responds with acknowledgement, hold information, or an error message;

an inbound hold status service, wherein said connector notifies said EMA that a process of putting electronically stored evidence on hold is completed, or it is in progress, or notifies of an error;

an optional hold reminder request service, wherein said EMA instructs said connector to update an existing hold with newly arrived electronically stored evidence matching query criteria, and wherein said connector responds with acknowledgement, hold information, or an error message;

an inbound hold reminder status service, wherein said connector notifies said EMA that a process of putting electronically stored evidence on hold is completed, or it is in progress, or notifies of an error;

an optional hold release service wherein, when a hold is not needed any more, said EMA calls said hold release service to indicate that said connector releases said electronically stored evidence on hold, and wherein said connector starts a hold release process and responds with acknowledgement, a completion message, or an error message; and

an optional hold release status service, wherein said connector notifies said EMA whether a hold release has been completed, an error happened during hold release, or a hold release is in progress.

6. The apparatus of claim 1, further comprising:

a configuration service, available from said connector, that responds to said EMA with a set of query templates, each template containing a number of query parameters;

wherein if there is more than one template, said EMA lets a user choose a query template, after which said EMA dynamically generates a query parameter input form based upon query parameters specified in a chosen template, after which said form is submitted to said connector;

wherein said EMA becomes independent of a data type and query criteria or a collection or hold that said EMA orchestrates.

7. The apparatus of claim 1, further comprising:

a storage associated with said EMA for saving query criteria filled in by a user when performing a collection or hold transaction;

wherein said user can search, either manually or automatically, through query criteria of existing hold and collection requests when said user needs to perform another hold or collection transaction and determine whether there is a request that fully or partially satisfies new query criteria.

8. The apparatus of claim 1, further comprising:

means associated with said EMA for performing validation of a dynamically generated collection or hold query;

wherein when a user submits a query to said EMA, said EMA performs a validation on data in said query.

9. The apparatus of claim 1, further comprising:

a validation service associated with said connection, wherein said connector receives exactly a same query request as it uses to perform a collection or hold, and performs a deep validation of request parameters, optionally using dynamic data stored inside said data source.

10. The apparatus of claim 1, further comprising:

means for eliminating unnecessary evidence after performing a collection;

wherein said connector disposes of data staged for a collection immediately after said electronically stored evidence has been collected, once it receives an un-staging call.

11. The apparatus of claim 1, further comprising:

means for freezing a set of collected electronically stored evidence during a collection transaction;

wherein, for a file system data source, said connector copies each file it found matching a query criteria into a special staging area before it proceeds with searching a remainder of files so that users cannot delete these files before they are collected by said EMA and, for a content management system, said connector locks a file it finds to prevent deletion of said file, and unlocks said file after a collection is completed.

12. The apparatus of claim 1, further comprising:

a configuration service for communicating to said EMA a subset of a collection or hold transaction that is supported by said connector in response to a configuration service call by said EMA.

13. The apparatus of claim 1, further comprising:

means for collecting electronically stored evidence that has previously been put on hold;

wherein said connector collects all of said electronically stored evidence that is currently on hold within a given hold transaction, or multiple hold transactions; and

wherein said connector optionally performs a hold reminder before responding to a collection request to make sure that most recent data are put on hold.

14. The apparatus of claim 1, further comprising:

any of hold and collection reminder services;

said hold reminder service comprising;

means associated with said EMA for calling a hold reminder service of said connector;

wherein each time said hold reminder service is called, it contains an identifier of an original hold transaction to which it belongs;

wherein said connector re-executes a search in said data source and adds new data that fits said search criteria to an existing hold;

wherein said EMA performs an initial hold and waits until it is time for a reminder;

wherein while waiting, said hold is optionally cancelled or released;

otherwise, said hold reminder is performed; and

wherein said query criteria is optionally either recorded by said connector during an original hold request call or communicated by said EMA in each hold reminder request;

said collection reminder service comprising;

means associated with said EMA for calling a collection reminder service of said connector;

wherein each time said collection reminder service is called it contains an identifier of an original collection transaction to which it belongs;

wherein said connector re-executes a search in said data source and communicates newly found data to said EMA;

wherein said EMA performs an initial collection and waits until it is time to issue a reminder, while optionally collecting newly arrived electronically stored evidence;

wherein, while waiting, said collection is optionally cancelled or un-staged, otherwise, a collection reminder is performed;

wherein query criteria is optionally either recorded by said connector during an original collection request call or communicated by said EMA in each collection reminder request.

15. The apparatus of claim 1 t further comprising:

means for asynchronous handling of a collection or hold request to avoid communication timeouts, by performing collection or hold request operations with said connector asynchronously;

wherein said connector starts a process during an initial collection request service call, and returns an acknowledgement in response;

wherein operation readiness is evaluated by said EMA, either through pinging said connector for a readiness status through a collection request readiness service call in a uni-directorial communication model or by said connector calling back to said EMA when said operation has been completed in bi-directorial communication model.

16. The apparatus of claim 15, wherein said EMA comprises:

means for allowing said connector to choose whether to respond asynchronously or synchronously to a service request;

wherein a response to a request service is of a same type as a response to a readiness service.

17. The apparatus of claim 1, further comprising:

an external online storage;

means associated with said connector for communicating with said external online content store;

wherein said connector uses said online data storage to communicate electronically stored evidence between said connector and said EMA.

18. The apparatus of claim 1, further comprising:

means for sending collected electronically stored evidence directly to said EMA data store;

wherein said connector stages said electronically stored evidence directly into an EMA collection repository via a direct path and points said EMA to said electronically stored evidence in said repository via a communication with said EMA.

19. The apparatus of claim 1, further comprising:

a user interface element for communicating limitations of a connector implementation to said EMA inside a response to a configuration service and for display by said EMA to a user, wherein said user is made aware of said limitations and can act accordingly; and

optional means for logging said limitations into a collection or hold audit trail so other parties are aware of said connector limitations.

20. The apparatus of claim 1, further comprising:

a configuration service through which at least one connector provides said EMA with information about its preservation capabilities;

wherein, based on said information, said EMA provides a user with proper preservation options.

21. The apparatus of claim 20, wherein data sources or connectors are classified according to their preservation capabilities, and provide information to said EMA on following basis:

those data sources or connectors that do not need a hold request to preserve data because data is always preserved;

those data sources/connectors that require a hold request to preserve data; and

those data sources/connectors that cannot preserve data in place.

22. The apparatus of claim 1, further comprising:

a technical support information system (TSIS),

wherein said connector instructs said TSIS to issue a ticket when said connector receives a collection or hold request from said EMA;

wherein said TSIS creates a ticket and assigns said ticket to a technical support employee, wherein instructions in said ticket are copied over from said EMA'"'"'s query parameters;

wherein said technical support employee sees said ticket in a form of a task;

wherein said technical support employee performs said task and sets said ticket status inside said TSIS to closed;

wherein, when said connector receives a subsequent readiness call, said connector checks whether said ticket status is closed, in which case said connector responds to said EMA with a completion, otherwise, said connector responds with an acknowledgement.

23. The apparatus of claim 1, said evidence being discovered in connection with any of civil litigation, tax, government investigation, and criminal proceedings.

24. An electronic discovery apparatus for communicating both electronic discovery collection requests, in which data are collected from one or more data sources, and hold requests, in which one or more data sources are instructed to preserve certain data, in connection with discovery of electronically stored evidence, comprising:

a plurality of data sources comprising said electronically stored evidence;

a hardware connector comprising an interface and a plurality of services for performing operations on said data sources; and

an electronic discovery management application (EMA) embodied in a hardware module for managing collections and holds, said EMA communicating with said data sources via said connector by calling said connector services, wherein said EMA communicates collection and hold requests to said data sources, and collects said electronically stored evidence from said data sources, said EMA further comprising a uni-directorial communications module, with which all service calls are initiated by said EMA, and with which said connector only responds to service calls from said EMA, said uni-directorial module further comprising;

a configuration service, wherein when said EMA requests configuration information from said connector, said information comprises at least one in a group consisting of query templates, information on a subset of services supported by said connector, information on versions of services supported by said connector, information on preservation capabilities of a data source or connector, and information of limitations on said connector implementation;

an optional validation service, wherein said EMA sends proposed values of query parameters to said connector, and said connector validates these parameters and replies with error description when said parameter values are invalid;

a hold request service, wherein said EMA instructs said connector to start a hold based upon provided query parameters, and wherein said connector responds with acknowledgement, hold information, or an error message;

an optional hold request readiness service, wherein said EMA checks whether said connector completed performing a hold, and wherein said connector responds with acknowledgement, hold information, or an error message;

an optional hold reminder request service, wherein said EMA instructs said connector to update an existing hold with newly arrived electronically stored evidence matching query criteria, and wherein said connector responds with acknowledgement, hold information, or an error message;

an optional hold reminder request readiness service, wherein said EMA checks whether said connector completed executing a hold reminder request, and wherein said connector responds with acknowledgement, hold information, or an error message;

a hold release service wherein, when a hold is not needed any more, said EMA calls said hold release service to indicate that said connector releases said electronically stored evidence on hold, and wherein said connector starts a hold release process and responds with acknowledgement, a completion message, or an error message; and

an optional hold release readiness service, wherein said EMA checks whether said connector has finished a hold release process, and wherein said connector responds with acknowledgement, a completion message, or an error message.

25. An electronic discovery apparatus for communicating both electronic discovery collection requests, in which data are collected from one or more data sources, and hold requests, in which one or more data sources are instructed to preserve certain data, in connection with discovery of electronically stored evidence, comprising:

a plurality of data sources comprising said electronically stored evidence;

a hardware connector comprising an interface and a plurality of services for performing operations on said data sources; and

an electronic management application (EMA) embodied in a hardware module for managing collections and holds, said EMA communicating with said data sources via said connector by calling said connector services,

wherein said EMA communicates collection and hold requests to said data sources, and collects said electronically stored evidence from said data sources, said EMA further comprising a bi-directorial communications module, with which said connector can both initiate service calls to said EMA and respond to service calls from said EMA, said bi-directorial module further comprising;

a configuration service, wherein when said EMA requests configuration information from said connector, said information comprises at least one in a group consisting of query templates, information on a subset of services supported by said connector, information on versions of services supported by said connector, information on preservation capabilities of a data source or connector, and information of limitations on said connector implementation;

an optional validation service, wherein said EMA sends proposed values of query parameters to said connector, and said connector validates these parameters and replies with error description when said parameter values are invalid;

a collection request service, wherein said EMA instructs said connector to start a collection based upon provided query parameters, and wherein said connector responds with acknowledgement, collection information, or an error message;

an inbound collection status service, wherein said connector notifies said EMA that collected electronically stored evidence is ready for download, or collection is in progress, or notifies of an error;

an optional collection reminder request service, wherein said EMA instructs said connector to update an existing collection with newly arrived electronically stored evidence, and wherein said connector responds with acknowledgement, collection information or an error message;

an inbound collection reminder status service, wherein said connector notifies said EMA that collected electronically stored evidence is ready for download, or collection is in progress, or notifies of an error;

an optional un-staging service wherein, once said EMA has downloaded collected electronically stored evidence, said EMA calls said un-staging service to indicate that said connector disposes of transient information needed to perform a collection transaction, wherein said transient information only persists for a predetermined time period, and wherein said connector responds with acknowledgement, completion message, or an error message; and

an optional un-staging status service, wherein said connector notifies said EMA whether un-staging has been completed, error happened during un-staging, or un-staging is in progress.

26. An electronic discovery apparatus for communicating both electronic discovery collection requests, in which data are collected from one or more data sources, and hold requests, in which one or more data sources are instructed to preserve certain data, in connection with discovery of electronically stored evidence, comprising:

a plurality of data sources comprising said electronically stored evidence;

a hardware connector comprising an interface and a plurality of services for performing operations on said data sources; and

an electronic discovery management application (EMA) embodied in a hardware module for managing collections and holds, said EMA communicating with said data sources via said connector by calling said connector services, wherein said EMA communicates collection and hold requests to said data sources, and collects said electronically stored evidence from said data sources, said EMA further comprising a bi-directorial communications module, with which said connector can both initiate service calls to said EMA and respond to service calls from said EMA, said bi-directorial module further comprising;

a configuration service, wherein when said EMA requests configuration information from said connector, said information comprises at least one in a group consisting of query templates, information on a subset of services supported by said connector, information on versions of services supported by said connector, information on preservation capabilities of a data source or connector, and information of limitations on said connector implementation;

an optional validation service, wherein said EMA sends proposed values of query parameters to said connector, and said connector validates these parameters and replies with error description when said parameter values are invalid;

a hold request service, wherein said EMA instructs said connector to start a hold based upon provided query parameters, and wherein said connector responds with acknowledgement, hold information, or an error message;

an inbound hold status service, wherein said connector notifies said EMA that a process of putting electronically stored evidence on hold is completed, or it is in progress, or notifies of an error;

an optional hold reminder request service, wherein said EMA instructs said connector to update an existing hold with newly arrived electronically stored evidence matching query criteria, and wherein said connector responds with acknowledgement, hold information, or an error message;

an inbound hold reminder status service, wherein said connector notifies said EMA that a process of putting electronically stored evidence on hold is completed, or it is in progress, or notifies of an error;

an optional hold release service wherein, when a hold is not needed any more, said EMA calls said hold release service to indicate that said connector releases said electronically stored evidence on hold, and wherein said connector starts a hold release process and responds with acknowledgement, a completion message, or an error message; and

an optional hold release status service, wherein said connector notifies said EMA whether a hold release has been completed, an error happened during hold release, or a hold release is in progress.