Using Jobs. AccessData eDiscovery
Below you will find brief information for eDiscovery. This document will help you to identify and collect relevant data in-house to address electronic discovery from beginning to end. You can run collections across the entire enterprise network of a company. The collected evidence can then be processed, reviewed, and exported. The reports are enhanced by the use of keyword searches and filters to gather only relevant data that pertains to a case. The resulting production set can then be exported into an AD1 format, or into a variety of load file formats such as
Advertisement
Advertisement
Part 6
Using Jobs
This part describes how to create and manage jobs.
Depending on the license that you own and the permissions that you have, you will see some or all of the following and includes the following sections:
Introduction to the eDiscovery Collection Job (page 383)
Creating and Configuring Jobs (page 385)
Approving and Managing Jobs (page 414)
Configuring Jobs for Third-Party Data Sources (page 433)
Using Jobs | 380
Chapter 36
Introduction to Jobs
About Jobs
You can create jobs to perform collections on a computer, network share, public data repository, email account, or all of the above within the enterprise. The collection can be set up with filters to find only the files that are needed for the project.
Jobs are responsible for the gathered, filtered, and archived information that comes from a variety of sources within an organization such as computers, laptops, personal digital assistants, and so forth.
Once you collect the data from the job, you can view the data in Project Review. You can filter the data and view the data by job or data source.
You use the Job Wizard to create Jobs. You can access the Job Wizard from one of two places in the application:
From Home > Project > Jobs tab, click the
Add button on the Info pane. See
About the Jobs Tab on page 382.
From the Project List on the Home page, click the
Add button next to a particular case.
Important: When a job targets a network share, if a file on the share is locked from reading, the job will skip that file and enter an entry in the log.
About Job Categories
Depending on the license that you own, you can use the following categories of jobs:
Job Categories
Option
Collection Job
Report Only
Description
You can use a collection job to collect data to process and review. You specify targets and can configure filters to collect specific files.
See Introduction to the eDiscovery Collection Job on page 383. chapter.
Identifies files that can be collected. This lets you specify the same targets and filters as a collection job.
This job type is used primarily to provide information about what you would collect if performing a collection.
Introduction to Jobs About Jobs | 381
About Approving Jobs
After you configure a job, it must first be approved before it is executed. Job approval allows administrative oversight of the job by either supervisors or legal professionals prior to executing the job.
You can designate that a job be approved by one or more approvers.
You designate who has permissions to approve a job by using roles and permissions. In order to approve a job, a user must have one of the following:
Application Administrator role
Case Administrator role
Project Manager Role
Approve LitHold Rights
LitHold Manager
Custom role with the Approve Jobs permission
You can designate that a job be approved by any user with the approve role permission, or you can designate specific users with the approver permission. If you designate multiple specific users, all of them may approve the job.
See Approving a Job on page 419.
About the Jobs Tab
Administrators, and users given permissions, use the Jobs tab to do the following:
Create jobs
View a list of existing jobs and their associations to people, computers, network shares, and groups.
Manage jobs
If you are not an administrator, you will only see either the jobs that you created or projects to which you were granted permissions.
The Jobs tab refreshes every three minutes.
To view the Jobs tab
1.
Log in to the console.
2.
3.
In the application console, click Home.
Select a project.
4.
Click the Jobs tab.
See Viewing and Managing Jobs on page 415.
Introduction to Jobs About Jobs | 382
Chapter 37
Introduction to the eDiscovery Collection Job
About Collection Jobs
You can use the Jobs tab to perform Collection Jobs on a computer, network share, public data repository, email account, or all of the above within the enterprise. Collection Jobs let you capture data for processing and review.
Jobs are the gathered, filtered, and archived information that comes from a variety of sources within an organization such as computers, lap tops, personal digital assistants, and so forth.
You use the Job Wizard to create Collection Jobs.
About Collections
Collections are the gathered, filtered, and archived information from a wide variety of sources. This allows a transfer of data from an organization to legal counsel. After collection, data is processed and reviewed for relevance. This collection process and the review of collected files is the essence of eDiscovery.
In the Custom Selection and Other Data Sources panes under the Job Options tab, you can select the data sources that you want to collect from.
About Collection Job Sources
The following are the types of data sources that you can collect from:
People. When you select a person to collect from, you can also choose to collect from the following data sources that a person is associated to:
Computers
Network Shares
Enterprise Vaults
Microsoft Exchange server
Cloud Mail server, such as Yahoo
Domino Server
Gmail
See Custodian Tab on page 395.
Computers. See Computers Tab on page 397.
Introduction to the eDiscovery Collection Job About Collection Jobs | 383
Network Shares. See Network Shares Tab on page 400.
Documentum. See Documentum Collections Options on page 440.‘
DocuShare. See DocuShare Collection Options on page 442.
Enterprise Vault Server. See Enterprise Vault Server Collection Options on page 444.
Exchange Public Folder. See Exchange Public Folder Collection Options on page 449.
FileNet. See Google Drive Collection Options on page 450.
Google Drive. See Enterprise Vault Server Collection Options on page 444.
OpenText ECM. See OpenText ECM Collection Options on page 451.
Sharepoint. See SharePoint Collection Options on page 452.
Website. See Website Collection Options on page 455.
Druva. See Druva Collection Options on page 456.
Box. See Box Collections Options on page 436.
Note: If you collect from the data sources under the People option, data will only be collected from data sources that are associated to a person. If you want to collect data from a particular data source, both associated and unassociated to a person, select the data source by name and not by the People option.
Note: When KFF is enabled for a project, the collection of files is not filtered by KFF settings.
Introduction to the eDiscovery Collection Job About Collection Jobs | 384
Chapter 38
Creating and Configuring Jobs
This chapter explains how to create, run, and manage jobs and includes the following topics:
About Collection Job Estimates (page 385)
General Job Wizard Tabs (page 388)
Using Recurring and Incremental Collection Jobs (page 410)
About Collection Job Estimates
While performing a collection job on Computers or Network Shares, you can view the following information:
Items Remaining (to collect)
Estimated time to complete
This information is displayed in columns on the Job Target Results tab on the project’s Jobs page.
See Job Target Results Tab on page 417.
Important: In order to display this data, when configuring the job, you must enable the Enable Prescan option in the job Advanced Options.
See Computers Tab on page 397.
See Network Shares Tab on page 400.
Note: Using the Enable Prescan option will add time for the job to complete.
Creating and Configuring Jobs About Collection Job Estimates | 385
Adding a Job
You use the Job Wizard to create jobs for a project.
You can set up the job with filters to find only the files that are needed for the project in the Project Review.
See Using Job Filters on page 404.
To add a job
1.
Do one of the following:
In the Project List panel, click the next to the project and then click Job.
2.
3.
4.
5.
6.
7.
8.
On the Home tab, select a project, click Jobs, then in the right side of the upper pane, click .
The Job Wizard opens.
In the Job Wizard dialog, in the Job Options screen, set the options that you want and click Next.
Bold names in the user interface indicate required fields.
See Job Options Tab on page 388.
Click Next.
The next screens you see will depend on the Job Target Options that you selected on the first page. The following Job Types result in a screen specific to that type:
Custodians: See Custodian Tab on page 395.
Computers: See Computers Tab on page 397.
Network Shares: See Network Shares Tab on page 400.
Third-party Connectors. See Configuring Jobs for Third-Party Data Sources on page 433.
Groups: See Group Selection Tab on page 393.
IP Range See IP Range Tab on page 394.
Click Next.
In the Scheduling screen, set how you would like the job to be executed. You can execute the job manually, or schedule a time for the job to be executed.
See Scheduling Tab on page 401.
Click Next.
In the Approvers screen, set the options that you want and click Next.
See Approvers Tab on page 402.
Creating and Configuring Jobs Adding a Job | 386
Job Wizard Summary
9.
On the Job Summary page, carefully review the settings that you have made to ensure that it includes and excludes the proper terms and documents.
10.
Click Save to submit the job for approval.
11.
Approve the job.
See Approving a Job on page 419.
Creating and Configuring Jobs Adding a Job | 387
General Job Wizard Tabs
You can use the following general tabs to configure Jobs:
Group Selection Tab (page 393)
Network Shares Tab (page 400)
You can also specify filters to narrow down the files on targets.
See Using Job Filters on page 404.
Job Options Tab
The following describes the options that are available in the Job Options tab of the Job Wizard.
General Job Options
Option
Job Type
Name
Description
Template
Description
Select the type of job:
Collection
Report
See About Job Categories on page 381.
Enter the name of the job. The job name should not be longer than 255 characters.
(Optional) Enter a description to help you further identify what you are collecting in the job.
Use Job Template
Lets you choose a job template that you have previously saved. There is also a list of pre-defined job templates that come with the application from which you can select.
See About Default Job Templates on page 428.
Save As Job Template
Lets you save the configuration of the job as a template for use in future jobs that you add. If a job is saved as a job template, the name of the job should be no longer than 64 characters.
See Managing Custom Job Templates on page 428.
Creating and Configuring Jobs General Job Wizard Tabs | 388
General Job Options (Continued)
Option
Job Data Path
Description
This sets the responsive folder path for data from eDiscovery jobs.
Under this path, a folder is created for each job. The job sub-folders contain job reports and ad1 files for collected files.
You can select to inherit the path that was configured for the project or
configure a different path. See General Project Properties on page 245.
For a multiple server installation, this path is the UNC path or IP address path to a network share that serves as the output location for all the items that are copied during the job collection.
Make sure double backslash characters (\\) precede the UNC path or the
IP address path.
If a network UNC path is specified, the path can be validated to ensure that the program can access the location. The validation also ensures that your job output is available for viewing.
Local paths only work on single box installations.
Inherit from Project
Job Data Browse Button
Inherits the job data path from the associated project.
Lets you browse to the job data path root field to expedite finding the job by this name.
Note:
The folder does not have to exist. If a new folder is specified, the system will create it for the user upon execution of the specified job.
Job Target Options
Option
Job Target Options - Custom
Job Target Options - Group
Description
Lets you manually select sources such as custodians (people), computers, network shares, and email servers, whose data you want to collect.
Lets you select data sources that you want to collect from based on
Active Directory organizational units and logical administrative units for people, groups, and resource objects such as computers and file shares.
When you create a job that includes
Group
as a target, a snapshot of all of the data sources in the group is made and used for the life of the job. If the group changes after the job is created and executed (not just approved), those changes do not affect the targets of the group that were used in an executing job.
Job Target Options - IP Range Select this to enter a range of IP addresses from which you want to collect data. This is an easy way to collect from a group of computers that are in an IP range.
Note:
If you select this option, configure a short Cancel Pending date or the job will never complete, because there is no guarantee of an agent being in the IP range.
Job Target Options - Custodians A network user who can be responsible for or have access to computers, network shares, email, or public data repositories that contain files of interest for the current job. The user’s non-email and email are also included in a CIRT job when selected.
See Custodian Tab on page 395.
Creating and Configuring Jobs General Job Wizard Tabs | 389
Job Target Options (Continued)
Option Description
Job Target Options - Computers A computer in the network that can contain files of interest. In order to collect from a computer, the computer must have the appropriate agent installed on it.
See Computers Tab on page 397.
Job Target Options - Network
Shares
A network repository for stored files that can contain files of interest.
See Network Shares Tab on page 400.
Job Other Data Sources Options
Option
Other Data Sources
Box
CMIS
Documentum
DocuShare
Druva
Enterprise Vault Server
Exchange Public Folder
Google Drive
OpenText ECM
SharePoint
Website
Description
See Configuring Third-Party Data Repositories as Data Sources on page 143.
See Configuring for a Documentum Server on page 157.
See Box Collections Options on page 436.
See Configuring for a Documentum Server on page 157.
See CMIS Collection Options on page 458.
See Configuring for a Documentum Server on page 157.
See Documentum Collections Options on page 440.
See Configuring for a DocuShare Server on page 164.
See DocuShare Collection Options on page 442.
See Configuring for Druva on page 171.
See Druva Collection Options on page 456.
See Configuring for an Enterprise Vault Server on page 151.
See Enterprise Vault Server Collection Options on page 444.
See Configuring for a Documentum Server on page 157.
See Collecting Exchange Emails for Custodians on page 447.
See Configuring for Google Drive on page 170.
See Google Drive Collection Options on page 450.
See Configuring for a OpenText ECM Server on page 168.
See OpenText ECM Collection Options on page 451.
See Configuring for a SharePoint Server on page 159.
See SharePoint Collection Options on page 452.
See Configuring for Web Sites on page 162.
See Website Collection Options on page 455.
Creating and Configuring Jobs General Job Wizard Tabs | 390
Job Priority and Agent Speed Options
Option Description
Job Priority - Inherit from Project Inherits the job priority from the associated project.
Job Priority - Low, Medium, High Select a priority for the job.
Processing Options
Option
Auto Process Options
Description
Check to have the data auto processed. If this option is checked, the job and evidence is processed automatically after the job is completed.
If you do not want to process the evidence at this time, leave this option unselected and you can manually select to process the job after it is completed.
Job AD1 Encryption Options
Option
AD1 Encryption
Inherit from Project
Disabled
Password
Certificate
Agent Collection
Description
The AD1 Encryption option set is only available if you choose the
Collection Job Type.
Inherits the AD1 encryption setting from the associated project.
Turns off encryption of an AD1 evidence image file.
Encrypts an AD1 evidence image file with a password that you specify.
Encrypts an AD1 evidence image file with a certificate.
Certificates use public keys for encryption and corresponding private keys for decryption. You can configure the certificates that appear in the drop-down menu.
Check to create AD1 image on the agent.
Job Expiration Options
Option
Job Expiration
Single Attempt
Description
Define the amount of time the system (Site Servers) will try and contact data sources within a job. After the time period, jobs meeting the conditions cancel. You have two condition options to specify for the job:
Fails the job on Agent or Share after a first attempt.
Creating and Configuring Jobs General Job Wizard Tabs | 391
Job Expiration Options (Continued)
Option
Cancel Pending
Cancel Incomplete
Description
Define the amount of time the system (Site Servers) will try and contact data sources within a job when the job is in a pending state. After the time period, any jobs still pending cancel. This stops the job from attempting to contact agents on which it has not yet started tasks (pending tasks).
Agents that have already been contacted within the time defined with continue to run until the task is complete regardless of the expiration date.
This only cancels the pending job(s), not other jobs in various states.
Note:
When cancelling a recurring job, only the job that is currently running in Site Server will cancel. The next occurrence of the job will start at its appointed time.
Define the amount of time the system (Site Servers) will try and contact data sources within a job. After the time period, any incomplete jobs cancel. This is selected by default.
This cancels all jobs that have not completed, even jobs that are in progress.
Job Auto Deploy Agents Options
Option
Auto Deploy Agents
Description
Turn on or Off. It is Off by default.
Run Scripts
Option
Run Scripts
Description
Select to execute a script after a job completes.
See Running Scripts on page 403.
Creating and Configuring Jobs General Job Wizard Tabs | 392
Group Selection Tab
The Group Selection appears only if you select Group in the Job Target Options earlier in the wizard.
Group Selection Tab
The following table describes the options that are available in the Select People of the Job Wizard.
Group Selection Options
Option
Groups list (upper pane)
Filter Options (lower pane)
Description
Displays the computers that you can select to add to the job. The list box identifies computers by their name and by their description and locality, if specified.
Allows you to filter the information in the associated list pane.
Displays all people within the selected group.
Displays all computers within the selected group.
Displays all file shares within the selected group.
Creating and Configuring Jobs General Job Wizard Tabs | 393
IP Range Tab
The IP Range screen appears if you select IP Range as the Job Target Option in the Job Options screen of the
Job Wizard.
IP Range Tab
IP Range Options
Option
Start
End
Include Filters
Exclude Filters
Advanced Options
Description
Allows you to enter the IP address for the starting point of the IP range.
Allows you to enter the IP address for the ending point of the IP range.
See Using Job Filters on page 404.
See Using Job Filters on page 404.
See Computers Tab on page 397.
Creating and Configuring Jobs General Job Wizard Tabs | 394
Custodian Tab
The Custodian options appear only if you selected Custom > Custodian in the Job Target Options group box in the Job Options.
You can select the custodians (people) that you want to collect from. In addition to selecting custodians, you can select a person’s:
Computers
Network Shares
Enterprise Vault
Exchange Server
Domino Server
Cloud Mail
Gmail Mail
Custodian Options
Option
View by Project
View All
Filter Options
Custodian Details (upper pane, right side)
Computers List tab
Computer Details area
Network Shares List tab
Network Share Details area
Enterprise Vault wizard page
Exchange wizard page
Description
Displays custodians associated with the selected project.
Displays all custodians.
Allows you to filter the information in the associated list pane.
Specifies the full name and username of the custodian. You can set the highlighted custodian’s default associations with computers, network shares, Exchange email, Lotus Notes email, or non-email data such as task items, calendar items, and so forth.
For example, if you check
Computers
, all the computers that are listed in the
Computers
tab of the
Select People
frame, become associated with the custodian.
Displays the computers that you can associate or unassociate with the highlighted custodian.
Identifies the name of the highlighted computer and, if available, its locality and description.
Displays the network shares that you can associate or unassociate with the highlighted custodian.
Identifies the network share path of the highlighted share and, if available, its locality and description.
Lets you collect Enterprise data for the highlighted custodian.
Lets you collect Exchange email for the highlighted custodian.
Domino wizard page Lets you collect Notes email for the highlighted custodian.
Creating and Configuring Jobs General Job Wizard Tabs | 395
Custodian Options (Continued)
Option
Cloud Mail wizard page
Description
Lets you collect Cloud Mail email for the highlighted custodian.
Gmail wizard page Lets you collect Cloud Mail email for the highlighted custodian.
Adds a data source.
Edits a data source.
Depending on the selected tab above, opens the
Associate Computers to
<custodian_name>
panel or the
Associate Network Shares to <custodian_name>
panel. This allows you to associate one or more computers or network shares to the custodian.
Creating and Configuring Jobs General Job Wizard Tabs | 396
Computers Tab
The
Computers
options appear only if you click Custom, and then check Computers in the Job Target Options group box earlier in the wizard.
For agents that are configured to use a proxy server, the Work Manager initiates a secure connection with the first proxy server in the list. If the proxy is configured with two network interface cards, the internal IP address is used. If a secure connection cannot be established, the next proxy server in the list is attempted until the list is exhausted. Several attempts are made to contact a proxy server, after which an error is recorded for the job.
Upon successful connection, the connected proxy server is recorded for the collection.
The file request is transmitted to the proxy server. Every 20 minutes, the agent initiates a secure connection. The file request is transmitted to the agent, which reads the file request and transmits the file back to the proxy server. The Work Manager repeats these steps for each identified node (computer) that is configured to use a
Proxy server.
The following table describes the options that are available on the Computers options of the Job Wizard.
See Network Shares Tab on page 400.
Computers Options
Option
Filter Options
Computers list box
Computer Details area
(upper pane, right side)
Filtered Collection
Full Disk Acquisition
Advanced Options
Logical Disk
Description
Filters the computers in the associated list pane.
See Filtering Content in Lists and Grids on page 39.
Note: If your filter results in listing multiple computers, you can choose to either target all of the computers matching the filter you applied, or target only specific computers that you have checked in the list. If you choose to target all computers matching filter, the filter must be enabled.
Displays all the computers that you can select to add to the job. This list comes from the computers that are defined in the Data Sources tab.
See Managing Computers for Collecting Data on page 122.
The list box identifies computers by their name and by their description and locality, if specified.
Identifies the name of the highlighted computer and, if available, its locality and description.
You can click to add a computer to the list.
You can click to edit the details of a computer in the list.
Expand to either show or hide the Filters options.
See Using Job Filters on page 404.
Allows you to collect an entire computer disk.
Allows you to scan and collect only the target’s logical drive space
(Allocated space)
Creating and Configuring Jobs General Job Wizard Tabs | 397
Computers Options (Continued)
Option
Physical Disk
Use Redirected
Acquisition
Advanced Options
Collect from
Target options
Collect Specific Sectors - You can collect specific sectors of the physical disk instead of the full disk. If Collect Specific Sectors is selected, you can specify the beginning and ending sectors for collection. With collecting specific sectors:
Sector 0 can be collected
You can examine the RAW file collected in a hex editor or third party tools
There is no limit on the number of sectors you can collect
Allows you to retrieve additional information about deleted files.
Note: If selecting this option, the Auto Process Feature will be disabled by default. If you want to auto process evidence, turn it on again.
Click the arrow to either show or hide the Advanced Options.
Allows you to see advanced options for collection.
Depending on the job type that you are creating, not all Advanced options are available.
File System: Select to collect the drives from the target’s file system.
Logical Disk: Select to collect only the target’s logical drive space.
Physical Disk: Select to collect the target’s entire physical drive.
‘Search with’ options
System Files
Search with Agent: Select to search files using the agent.
Search with Either Agent or Site Server: Select to search first with the agent and then with the Site Server.
Search with the Site Server: Select to search using the Site Server.
Allows you to search system files that are normally hidden from view. Files with “$” contain system metadata and in NTFS, the $MFT contains the file system pointers to all files.
Scan Deleted
Files
Scan Unused Disk
Area
Scans free space of a partition for files matching the filter criteria. Select this option if you have parsed $I30 INDX records.
Scans unallocated disk space for files matching filter criteria.
Archive Drill Down If archive files exist in any of the available data sources that contain compressed files of interest, this option lets you open the archive files as part of the job and checks them against keywords supplied in the keyword filter.
Note:
When selecting specific files for a Remediation job with Archive Drill
Down selected, the Remediation job will delete the entire archive file if one or more of the specified files match the criteria of the job.
Collect Response
Archive
Collects any archive that contains files that match filter criteria.
Specify
Extensions for
Archive Drill Down
Collect Non-
Extension Files
Description
Allows you to scan and collect the target’s entire physical drive (Allocated and Unallocated space).
Allows you to specify the extension for the archive drill down. If you don’t specify, the default will be used.
Collects all files that do not have an extension.
Creating and Configuring Jobs General Job Wizard Tabs | 398
Computers Options (Continued)
Option
Use Internal File
Identification
Collect
Unsearchable
Encrypted Files
Report on Non-
Responsive Items
Enable Prescan
Parse $I30 INDX
Records
Exclude
Removable
Drives/Media
Description
Recognizes internal file identification when checking file extensions.
Collects files that cannot be accessed to search for keyword filter criteria.
Generates a report detailing files that matched all filter criteria, but did not contain the specified keyword.
When selected, a prescan is performed before collecting data. The setting is used to provide information to determine Items Remaining and Estimated
About Collection Job Estimates on page 385.
Parses $I30 INDX records, so you can identify deleted files and display metadata contained in the file. This option is available for metadata, collection, and full disk acquisition jobs.
Excludes removable drives that are recognized by Site Server from the collection. This option is only available for collection jobs.
Not all removable drives are recognized as such so this option may not exclude ALL removable drives.
Creating and Configuring Jobs General Job Wizard Tabs | 399
Network Shares Tab
The Network Shares options appear only if you click Custom and then check either Network Shares or in the
Job Target Options panel earlier in the wizard.
The following table describes the options that are available in the Network Shares options of the Job Wizard.
See Computers Tab on page 397.
Network Shares Options
Option
Filter Options
Network shares list box
Description
Filters the network shares in the associated list pane.
See Filtering Content in Lists and Grids on page 39.
Note: If your filter results in listing multiple network shares, you can choose to either target all of the network shares matching the filter you applied, or target only specific network shares that you have checked in the list. If you choose to target all network shares matching filter, the filter must be enabled.
Displays all the network shares that you can select to add to the job. This list comes from the network shares that are defined in the Data Sources tab.
See Managing Network Shares for Collecting Data on page 127.
The list box identifies network shares by their name and by their description.
Identifies the name of the highlighted share and description.
Network Share Details area
(upper pane, right side)
You can click to add a new network share to the list.
Filters
Specify extensions for archive drill down
Collect Non-
Extension Files
Use Internal File
Identification
You can click to edit the details of network sharer in the list.
Click the arrow to either show or hide the Filters options.
See Using Job Filters on page 404.
Click the arrow to either show or hide the Advanced Options.
Advanced Options
Archive Drill Down If archive files exist in any of the available data sources that contain compressed files of interest, this option lets you open the archive files as part of the job and checks them against keywords supplied in the keyword filter.
Note:
When selecting specific files for a Remediation job with Archive Drill
Down selected, the Remediation job will delete the entire archive file if one or more of the specified files match the criteria of the job.
Collect
Responsive
Archives
Collects any archive that contains any fields that match keyword filter criteria.
Allows you to specify extensions for Archive Drill Down.
Collects all files that do not have an extension.
Recognizes internal file identification when checking file extensions.
Creating and Configuring Jobs General Job Wizard Tabs | 400
Network Shares Options (Continued)
Option
Collect Encrypted
Files
Report on Non-
Responsive Items
System Files
Enable Prescan
Description
Collects files that cannot be accessed to search for keyword filter criteria.
Generates a report detailing files that matched all filter criteria, but did not contain the specified keyword.
Allows you to search system files that are normally hidden from view. Files with “$” contain system metadata and in NTFS, the $MFT contains the file system pointers to all files.
When selected, a prescan is performed before collecting data. The setting is used to provide information to determine Items Remaining and Estimated
About Collection Job Estimates on page 385.
Scheduling Tab
You can schedule when you would like a job to execute using the Scheduling options screen in the Job Wizard.
Scheduling Tab in the Job Wizard
Options in the Scheduling Tab
Option
Manual Job Execution
Description
Select this to manually execute a job.
Creating and Configuring Jobs General Job Wizard Tabs | 401
Options in the Scheduling Tab
Option Description
Scheduled Job Execution Select this to set a date and time when you want the job to execute.
You can also configure the following:
A scheduled recurring job to execute on a regular basis
A scheduled incremental job to execute on a regular basis
See Using Recurring and Incremental Collection Jobs on page 410.
The schedule is server based and starts a new instance of the job on the Server. The server job collects data as they report results.
Approvers Tab
The following describes the options that are available on the Approvers screen of the Job Wizard.
Job Approvers Tab
Job Approvers Options
Option
Is Approved By Role
Is Approved By User List
Description
Allows any user with job approval rights to approve the collection. After you complete the Job Wizard, the job must first be approved and then it must be executed.
Allows you to select one or more users that are associated with the selected project, and that have approval rights, to approve the job.
After you complete the Job Wizard, the job must first be approved. If you selected more than one user to approve the job, each user must log into
CIRT and approve the collection. Once all approvals are complete, you can execute the job.
Creating and Configuring Jobs General Job Wizard Tabs | 402
Running Scripts
When creating a job, you can specify a script to execute after a job completes. This allows you greater control and customization of a job.
You can run the following files as scripts:
executable (.EXE)
batch files (.BAT)
Powershell scripts (.PS1)
To execute the script, copy the script to the Work Manager Scripts folder, then select the option when creating the job.
To execute a script
1.
2.
Navigate to Program Files > AccessData > eDiscovery > Work Manager > Scripts.
Copy the script that you want to execute to the Scripts folder.
Note: If you have multiple work managers, you must copy the script to each of the work managers.
3.
4.
5.
6.
7.
Close the file.
Create a job. See Adding a Job on page 386.
At the Job Options tab, select Run Scripts On Job Completion under Run Scripts.
Populate the Execute As fields. These fields grant permissions for the script to execute on the agents that you send the job down to:
File Name
Domain
User Name
Password
Confirm Password
Complete configuring the job and execute.
Script Execution Options
You can control the script execution after a job by editing a configuration file. You can:
Change the location of the scripts folder. This allows you to save the script to a network share that communicates with multiple work managers
Control how long a script runs. If this value is not changed, the script runs for 30 minutes.
To edit the config file
1.
2.
3.
Navigate to the Infrastructure.WorkExecutionServices.Host.exe.config file.
Add the following keys to the configuration file:
To change the location of the scripts folder: <add key="ScriptFolder" value="" /> . Enter the value as the location of the new scripts folder.
To control how long a script runs: <add key="ScriptMaxExecutionTime" value="" /> . Enter the value in milliseconds how long that you want the script to run.
Save and close the file.
Creating and Configuring Jobs General Job Wizard Tabs | 403
Using Job Filters
When configuring a job, you can use filters to target certain files by either including or excluding files.
The following are some examples of filters that you can use:
Include or exclude only some files extensions. For example, include only DOC or XLSX files.
Include or exclude a path. For example, exclude the \WINDOWS folder and all sub-folders.
Include or exclude files above or below a certain size.
Include or exclude files based on file creation, modified, or last accessed date.
Include or exclude files based on keywords in the documents.
Include or exclude files based on file MD5 hashes.
Combine filters: For example:
Include only the PDF files in a certain folder.
Exclude the EXE and DLL files in the WINDOWS folder.
Include only DOCX and XLSX files that were created after a specified date.
Different Filter Types
The filters that you can use depends on the type of target that you are running jobs on. There are a set of filters available for Computers and Network Shares, and different filters available for third-party repositories like
Exchange or SharePoint.
See Computer and Network Share Filter Options on page 405.
Combining Filters
You can combine filters to get more specific results. There are different ways that you can combine filters and the method used will generate different results.
You can use multiple properties within a single filter. This results in an AND function.
You can use multiple filters. The results in an OR function
Using multiple properties within a single filter - AND function
When you add a filter, you can configure one or more properties within the filter. If you specify multiple properties within a single filter, the properties are combined as an AND function.
For example, if you add an inclusion filter, and in that one filter specify an extension of PDF and also a file size of greater than 2MB, the logic is “PDF” AND “>2MB”. The results will include only PDF files that have a file size greater than 2 MB.
As another example, if you add an inclusion filter, and in that one filter specify the two extensions of DOCX and
XLSX, and also a file creation date of after 1/1/206, then the results will include only DOCX and XLSX files that have a file creation date of after 1/1/206.
As another example, if you include a path as a property in a filter, any other properties specified in the same filter will only apply to the specified path. Suppose you target a network share
\\documents and you create an inclusion filter and specify the folder my_Work_files. And suppose that in the same filter you specify a file extension, such as PDF. The results will be that it considers the path first and the extensions second. In this example, only the PDF files in the my_Work_files folder are included. No other PDF files will be included and
Creating and Configuring Jobs General Job Wizard Tabs | 404
no other files outside of my_Work_files will be included. Similarly, if you create one inclusion filter and you specify two paths and PDF and DOCX extensions, it will include all of the PDF and DOCX files from only the two folders.
Some filters include multiple tabs. For example, when using filters for computers and network shares, there are four tabs of filter properties. You can use properties from multiple tabs to perform an AND function. For example, when adding an include filter, on the Meta Info tab, you can specify an extension of PDF, and then on the MD5 tab, you can add a list of MD5 hashes. The result will be only the PDF files that have the listed MD5 files. As another example, when adding an include filter, on the Meta Info tab, you can specify one or more folders and then on the File Content tab, you can add a list of keywords. The result will be only the files within the specified folders that contain the listed keywords.
Using multiple filters - OR function
In contrast, you can use multiple filters and get the results of both. The functions as an OR function.
For example, if you add one inclusion filter, and in that filter specify an extension of PDF, and then add a second filter, and specify a file size of greater than 2MB, the logic is “PDF” OR “>2MB”. The results will include all PDF files and all files with a size greater than 2 MB.
As another example, suppose you target a network share
\\documents and you create one filter to include the folder my_Work_files. You can create a second filter and specify an extension of PDF. The results will include all of the files in my_Work_files and all of the PDF files within the share regardless of paths.
Using Inclusion and Exclusion filters - AND function
You can also use Include and Exclude filters together.
For example, you can add an Inclusion filter and specify an extension of PDF. You can also add an Exclusion filter and specify a file size greater than 3MB. The result is to include only PDF files that are less than 3MB.
As another example, you can add an Inclusion filter and specify an extension of PDF. You can also add an
Exclusion filter and specify a path of one or more sub-folders. The result is to include only PDF files that are not in the excluded folders.
Computer and Network Share Filter Options
When using a job to collect data from Computers and Network Shares, you can use Inclusion or Exclusion filters to either include or exclude specified data.
See Computers Tab on page 397.
See Network Shares Tab on page 400.
When you configure a filter for a job, you can save it as a template and load it in another occurrence.
The following table describes the filters elements:
Filters Options
Option
Filters
Include
Description
Click the arrow to either show or hide the Filters options.
Lets you create or load an Include filter.
Creating and Configuring Jobs General Job Wizard Tabs | 405
Filters Options
Option
Exclude
Description
Opens the Include panel where you can specify file inclusion filter information such as meta data information, file content, or MD5 hash sets.
Deletes the selected filter template from the Include list box.
Allows you to edit the settings of a selected filter in the Include list box.
Lets you load a previously saved Include filter template.
Displays the names of each file exclusion filter that you have created.
Opens the Exclude panel where you can specify file exclusion filter information such as meta data information, and file content.
Deletes the selected filter template from the Exclude list box.
Allows you to edit the settings of a selected filter in the Exclude list box.
Lets you load a previously saved Exclude filter template.
The following tables describe the Inclusions and Exclusions filter options that are available:
Meta Info
File Content
MD5
Notes Archive Options
Meta Info Tab
Option
Filter Name
Extension(s)
Path Contains
Description
(Required) The name of the new file include filter.
Includes or excludes files by extension.
You can use an asterisk (*) as a wildcard.
For example, doc* which will include .DOC and .DOCX.
You can specify multiple extensions by separating with a comma.
For example, bmp,jpg,png
Note:
Do not include spaces before or after commas. If you do, the application will remove them.
Includes or excludes files by path sub-folders.
Using “Path Contains” in a Filter (page 407)
Creating and Configuring Jobs General Job Wizard Tabs | 406
Meta Info Tab (Continued)
Option
File Size
File Creation Date
File Modified Date
File Last Accessed Date
Save Filter As Template
Description
Includes files based on file size. You can designate file size ranges using
Is
,
Greater Than
, or
Less Than
and on an associated file size in bytes, kilobytes, or megabytes.
Includes files based on any date, a specific creation date, or a data range.
Includes files based on any edit date, a specific edit date, or an edit data range.
Includes files based on any last accessed date, a specific last accessed date, or a last accessed date range.
Lets you save the configured filter as a template so that you can reuse it in other jobs.
Using “Path Contains” in a Filter
You can include or exclude files based on folders/sub-folders in the share or on the computer.
You can specify folders by doing the following:
Include or exclude a complete folder name
For example, suppose you target a network share \\documents. Also, suppose that the share has a folder structure of
\\documents\my_Work_files\
\\documents\my_Own_files\
\\documents\shared files
If you enter my_Work_files in this field, it will include that folder.
Include or exclude a folder name using wildcards.
For example, if you enter *work* in this field, in will include the my_Work_files folder.
Note: You do not need to include the full path, just the name of a folder that is within the target.
You can specify multiple folders by separating the folder names by a comma. For example,
my_work_files,shared files,*own*
Note:
Do not include spaces before or after commas. If you do, the application will remove them.
Spaces within a folder name are allowed (for example, shared files).
You can also click Browse and import a list of paths from a TXT or CSV file. In the file, specify each path name either with commas (no spaces), or on its own line (commas will be inserted when imported). Do not include any headers or other text in the file. For example,
my_work_files,shared files,*own*
or
my_work_files shared files
*own*
Creating and Configuring Jobs General Job Wizard Tabs | 407
When the target is a computer, you can do the following:
Collect a single file by specifying an absolute file path. This allows you to quickly gather items that you know are stored in a certain directory. For example, specifying the path c:\program files\accessdata\agent\agentcore.exe only collects that particular executable.
Collect files by specifying a system environmental variable. This allows to locate objects at any location on the system. For example, when an agent is installed on a machine, a system variable is created:
%ADAgentDir%. By specifying the %ADAgentDir% variable, you can locate all files in the agent folder.
Be sure to define the variable in the Path Contains field as %<variable>%.
You can specify any system environmental variable that is on a system
You can also specify any custom system environmental variable that you may have defined on a system
Note:
If you create a custom system variable on the agent, you must reboot the agent machine before the collection job can find the variable.
Note: Due to a known issue, if you use the Path Contains property in an exclusion filter, you MUST also include a value in the Extension(s) property. If you want to exclude all the files in the specified folders, put
.* in
Extension(s) field. As an alternative, you can specify an extension, such as pdf. In that scenario, only the
PDF files in the paths will be excluded.
Creating and Configuring Jobs General Job Wizard Tabs | 408
File Content Tab
Option
Keywords
Simple or Regext
Keyword text field
Description
You can use the File Content tab with either Inclusion or Exclusion filters.
Lets you select whether to use simple text or regular expression keywords.
Lets you enter text, patterns of data (regular expressions), or hexadecimal values. You can include files that contain specific keywords.
When writing queries for the Keyword(s) field, use the terms AND or OR to help refine your search. For example:
Apple AND orange returns files with both terms apple and orange.
Apple OR orange returns files with either the term apple or orange.
(Apple AND orange) OR (banana) returns files with either the terms
apple and orange or files with the term banana.
‘Apple and orange’ OR banana returns files with either the term apple
and orange or files with the term banana.
Lets you narrow the keyword filter to search only the file name.
Search File name only
Luhn Options
Credit Card Numbers
Custom
Save Filter As Template
Includes credit card numbers using Luhn testing. Luhn testing distinguishes valid credit card numbers from what could be a random selection of digits.
Includes a custom regex expression. To filter by regular expressions, check
Custom
, and then enter the regular expression delimiters. For example:
\d\d\d\d.
Note: You are not able to use dashes when creating a custom regex expression. For example: \d\d\d\-\d\d\-\d\d\d\d
Lets you save the configured filter as a template so that you can reuse it in other jobs.
Note: There is a current issue that if you create one filter and use a property on the Meta Info tab and then create a second filter and use a property from another tab, only the filter with the Meta Info tab property is used and any other filter is ignored. If you combine the tab’s properties within one filter, it works correctly.
MD5 Tab
Option
MD5 hash list box
Import Hash List
Save Filter As Template
Description
Lets you add MD5 hash values to the MD5 list box. The added values are included in the job.
Lets you browse and open an MD5 hash value file into the MD5 hash list box.
Lets you save the configured filter as a template so that you can reuse it in other jobs.
Creating and Configuring Jobs General Job Wizard Tabs | 409
Using Recurring and Incremental Collection Jobs
About Recurring Scheduled Collection Jobs
You can schedule a job to execute multiple times by enabling recurrence for that particular job. When recurrence is enabled for a job, the job executes the same requested action during each recurrence. All the data and objects that meet the job criteria are collected again each time the job reoccurs.
You can configure each occurrence of the job to execute by the minute, hourly, or daily, weekly, monthly, or yearly. You can also configure the job to end after a certain number of occurrences or on a specified date.
For each occurrence, a complete set of data is collected from the target. For example, suppose you configure a recurring job to collect files from a network share once a week. The first occurrence of the job may collect 100 files. If during the next week 15 files are added to the share, the second occurrence of the job will collect the original 100 files plus the 15 new files, for a total of 115 files. If during the second week 20 files are added, the third occurrence of the job will collect the 115 files plus the 20 new files, for a total of 135 files.
On the project’s Jobs page, you can expand a Job Results panel and view each occurrence of the job with the results of that occurrence. For example, for the first occurrence, the Job Target Results tab lists 100 hits. The second occurrence lists 15 hits and the third occurrence lists 20 hits. The cumulative number (135) is not displayed.
For each occurrence, a unique sub-folder is created under the Responsive File Path folder for the job. The subfolders name will have the date and time the job was run. For example, 2016-10-13 17.30.01. In each sub-folder, the job data and AD1 evidence file for that specific occurrence is stored.
About Processing Data from Recurring Scheduled Jobs
You have the following options for processing collection data from jobs:
Configure the job to automatically process the collection
See Processing Options on page 391.
Manually process the data after the collection
See Processing a Job on page 420.
If you automatically process the collection, the full collection is processed each time. For example, for the first occurrence, 100 files are processed. For the second occurrence, 115 files are processed. For the third occurrence, 135 files are processed. As a result, when you go into review, there would be 350 files. Each occurrence of the file is processed with a unique ObjectID. So for example, a file in the original 100 is processed as four separate files. The ObjectNames are the same, but the ObjectIDs are unique. Also, each occurrence is given a unique evidence ID. For example, the first 100 have an EvidenceID of 1, the 115 files have an
EvidenceID of 2, and the 135 files have an EvidenceID of 3.
If you manually process the collection, you can select which occurrence to process. For example, you can select to process the occurrence with 100, 115, or 135 files, a combination, or all. Generally you would want to process the last one.
Creating and Configuring Jobs Using Recurring and Incremental Collection Jobs | 410
About Incremental Collection Jobs
There are two kinds of Incremental jobs:
Scheduled Incremental Jobs When you schedule a recurring job, there is an Incremental option. When you select this option, when each occurrence of the job is run, only the new or incremented files are collected. This lets you continuously collect data based on a schedule.
For example, suppose you configure a scheduled incremental collection job to collect files from a network share once a week. The first occurrence of the job may collect 100 files. If during the next week 15 files are added to the share, the second occurrence of the job will collect only the 15 new files. If during the second week 20 files are added, the third occurrence of the job will collect only the 20 new files.
Because this is a type of recurring job, each occurrence of the incremental jobs can be viewed and unique job sub-folders are also created. The difference is that the AD1 evidence file only contains the newly collected files.
See About Recurring Scheduled Collection Jobs on page 410.
Resubmitted Incremental
Jobs
If you resubmit a job, you can select the new job to be Incremental. If you select this option, the original job become the first occurrence or baseline, and when the new job is run, it only collects newer files.
See Resubmit Collection Options on page 431.
Important: Scheduled incremental collections are run based on the file’s creation date and not the modified date.
As a result, if you have a file that was collected as a new file, and then the file gets modified, the modified file will not be collected.
Important: Scheduled incremental collections are run based on the file’s creation date and not the time it was indexed by a respository. As a result, there may be times when certain files are not collected during a scheduled incremental collection. When a file is saved on a third-party repository, it may not be indexed by that system before an occurrence of the job runs. For example, suppose you have a schedule incremental collection job that runs at 2:00 am every Sunday. Also, suppose that a person saves a file on that system on Sunday morning at 1:58 am. If the repository system does not index and recognize that file by 2:00 am, when eDiscovery runs the job at 2:00 am, it won’t see the file to collect it. And then the next week, because it looks for files with a creation date since the job was last run, and the file has a creation date and time of before the previous job, it will not be recognized to be collected then either. This issue will be fixed in a future release.
As a result, it is recommended that you use a relatively long interval period (not just some minutes apart).
Supported Platforms and Filters for Scheduled Incremental Collection Jobs
The following connectors are supported for scheduled incremental collection jobs:
CMIS
Documentum
DocuShare
Druva
Enterprise Vault
Exchange EWS: (2010 SP1, 2013, O365, SilverSky)
Google Drive
Creating and Configuring Jobs Using Recurring and Incremental Collection Jobs | 411
OpenText ECM
SharePoint
Web Sites
Important: When using scheduled incremental collections, the use of inclusion and exclusion filters are not officially supported in this release. Some filters, such file extension may work, but results are not guaranteed.
A hidden filter for creation date is automatically used by the system to track items that were created after the previous occurrence of the recurring job.
Important: At this time, scheduled incremental jobs are not supported with the following connectors:
Box
Cloud Mail
Domino
Exchange (MAPI 2007, MAPI 2010, MAPI 2013)
Gmail (Administrative)
Web Crawler
If you select one of these unsupported targets in the wizard, the Incremental option will not be active. As a result, it is recommended to not mix target types when doing an incremental collection. If you select two targets, one supported and one not supported, the Incremental option is not active.
About Processing Data from Scheduled Incremental Collection Jobs
Because a scheduled incremental job is a type of recurring job, you have the same options for processing collection data from jobs:
Configure the job to automatically process the collection
See Processing Options on page 391.
Manually process the data after the collection
See Processing a Job on page 420.
However, the actual processing is different.
If you automatically process the collection, the collection from each occurrence is processed individually. For example, for the first occurrence, 100 files are processed. For the second occurrence, 15 files are processed.
For the third occurrence, 20 files are processed. There are no duplicate files. Also, each occurrence is given a unique evidence ID. For example, the first 100 have an EvidenceID of 1, the 15 files have an EvidenceID of 2, and the 20 files have an EvidenceID of 3.
If you manually process the collection, you can select which occurrence to process. For example, you can select to process the occurrence with 100, 15, or 20 files. To process data from all occurrences, you must process all of them.
Scheduling a Recurring Job
To schedule a recurring job
1.
From the Scheduling tab, click Scheduled Job Execution.
2.
Select Enable Recurrence. See Recurrence Options on page 413.
Creating and Configuring Jobs Using Recurring and Incremental Collection Jobs | 412
3.
4.
Under Recurrence Pattern, specify how often the job reoccurs. Specify when the recurring job will end.
You can specify the recurrence of the job to end after so many occurrences or specify the recurrence of the job to end after a specific date and time.
Specify when the recurrence job ends.
Recurrence Options
Option
Use Relative Start Time
Minute
Hourly
Daily
Weekly
Monthly
Yearly
End Recurrence
Incremental
Description
You may not know when a recurring job will get approved or started in relation to the scheduled time. With this option selected, if a job is approved after the scheduled start time, it will start at the next given iteration instead of having to be rescheduled.
Allows you to specify the number of minutes between job recurrences with the minimum option being 1 minute and the maximum being 30 minutes.
Allows you to specify the number of hours between job recurrences with the minimum being 1 hour and the maximum being 12 hours.
Allows you to specify a specific time for the job recurrence to occur. The time specified must be an hourly instance, such as 4:00 AM or 7:00 PM.
Allows you to specify a specific day for the weekly job recurrence to occur.
Allows you to specify a specify day for a monthly job recurrence to occur. You can specify the day that the monthly job recurs by number or by day name.
Allows you to specify a specify day for a yearly job recurrence to occur. You can specify the month and day that the yearly job recurs.
Allows you to specify when the recurrence job ends. You can specify that the job never ends, ends after so many occurrence, or ends by a specific date.
(optional) Select Incremental to collect files that are new or have been changed
since the last job execution. See About Incremental Collection Jobs on page 411.
5.
Click Next and follow the Job Wizard.
For information on processing a scheduled incremental job, see Processing a Job (page 420).
Creating and Configuring Jobs Using Recurring and Incremental Collection Jobs | 413
Chapter 39
Approving and Managing Jobs
This chapter explains how to approve and manage jobs and includes the following topics:
Viewing and Managing Jobs (page 415)
Using Job Reports (page 424)
Using Job Notifications (page 426)
Using Job Templates and Filter Templates (page 428)
Additional Job Tasks (page 430)
Testing the Collection Workflow (page 430)
Approving and Managing Jobs | 414
Viewing and Managing Jobs
You can view and manage jobs from the project’s Job page.
To view the Jobs tab
1.
2.
3.
Log in to the console.
In the application console, click Home.
Select a project.
4.
Click the Jobs tab.
Jobs tab
Elements of the Jobs Tab
Element
Filter Options
Jobs List
Refresh
Description
Allows the user to filter jobs in the list. See Filtering Content in Lists and Grids on page 39.
Displays the jobs associated with the project. Click the column headers to sort by the column.
Note: If a job doesn’t collect and report on certain types of data, NA displays in the column. For example, for volatile jobs, the Hits and
Errors columns display NA.
Refreshes Jobs List.
See Refreshing the Contents in List and Grids on page 36.
Approving and Managing Jobs Viewing and Managing Jobs | 415
Elements of the Jobs Tab (Continued)
Element
Columns
Description
Sets what columns display in the Jobs List. You can display the following columns:
Approved
Approved By Username
Approved Date
Completed
Created By
Creation Date
Description
Elapsed Time
End Date
End Processing Date
Errors
Failed
Hits
Job Type
Modification Date
Modified By
Name
Percent Complete
Percent Processed
Processing Status
Project Name
Recurring
Scheduled End Date
Scheduled Start Date
Scheduled to Run
Start Date
Start Processing Date
Status
Targeted
Total Collected Size
See Sorting by Columns on page 36.
Deletes the selected job. The button is only active when a job is selected.
Delete
Resubmit
Cancel
Manage Notifications
Resubmits a job under a new name.
See Resubmitting a Job on page 430.
Stop the current job.
See Stopping a Job on page 430.
Creates notifications for the checked job(s).
See Using Job Notifications on page 426.
Approving and Managing Jobs Viewing and Managing Jobs | 416
Elements of the Jobs Tab (Continued)
Element
Manage Templates
Test Work Flow
Description
Manages the templates for jobs.
See Using Job Templates and Filter Templates on page 428.
Tests the work flow of the job.
See Testing the Collection Workflow on page 430.
Note: This may take up to 30 seconds
Imports the job list to a CSV file.
Export to CSV
Job Details Pane
Job Target Results Tab
Status Tab
People Target Tab
Computers Target Tab
Network Shares Target
Tab
Groups Target Tab
Reports Tab
Includes the ability to add jobs (plus sign button), edit jobs (pencil button), and delete jobs (minus sign button).
See Editing a Job on page 431.
See Deleting Jobs on page 432.
Displays all the targets for the selected job.
See Job Target Results Tab on page 417.
Displays the failure status of a job in detail.
Displays the People targeted for the selected job.
Displays the Computers targeted for the selected job.
Displays the Network Shares targeted for the selected job.
Displays the Groups targeted for the selected job.
Displays statistics about jobs run.
Job Target Results Tab
The Job Target Results tab allows you to view information about the job target.
You can view the following columns:
Action Status
Collected Size
Current File
Custodian
End Date
End Processing Date
Error Message
Errors
Estimated Time to Complete
Files Collected Size
Approving and Managing Jobs Viewing and Managing Jobs | 417
Hits
Items Remaining
Last Collect File
Name
Processing Status
Start Date
Start Processing Date
Type
Status Tab
The Status tab allows you to view the failure status of a job in detail. The errors that cause a failure status to display are invalid network shares for collection jobs against a network share and any errors reported to the application by Site Server.
See Network Shares Tab on page 400.
The Status tab can be viewed by any user, even a user without admin permissions. You can view if a job has failed on an individual target and why the job fails for a particular target. If the entire job fails, a red bar error displays the reason why the job has failed.
Note: For combination jobs, the Status tab displays the status of each job being processed.
Job Status Tab
Reports Tab
The Reports tab allows you to generate and download reports on a selected job. You can download the following reports:
Full Error Report - This report shows a breakdown of failed targets and the errors associated to them.
Job Report - This report displays details pertinent to the specific job. The report can be created on a completed job or a job that is in the middle of executing.
See Using Job Reports on page 424.
Approving and Managing Jobs Viewing and Managing Jobs | 418
Approving a Job
Each Job has to be approved before it can be executed. Select By Role to allow any user with specified roles to approve the job, or select specific users from the User List.
See Adding a Job on page 426.
See Executing a Job on page 419.
To approve a job
1.
2.
3.
Log in as a user who has been granted permission to give approval to a specific job.
Click Jobs.
In the Jobs list pane, highlight a job that has not yet been approved.
4.
In the right pane, click
Approve
.
Executing a Job
You can execute a job after it is approved.
Executing a job begins the process of collecting the data that meets any filter or keyword criteria that you configured in the Job Wizard.
See Adding a Job on page 426.
See Approving a Job on page 419.
To execute a job
1.
2.
3.
4.
Log in if you are a user who has been granted permission to execute a specific job.
Click Jobs.
In the Jobs list pane, highlight a job that has not yet executed.
In the right pane, click Execute.
Approving and Managing Jobs Approving a Job | 419
Processing a Job
When you add a job, you have the option of having the job automatically processed.
See Job Options Tab on page 428.
If you do not enable this options, you can process a job after it is executed.
The steps to process a recurring or incremental collection is different.
See Using Recurring and Incremental Collection Jobs on page 450.
See
To process a recurring job (page 420) or
To process a scheduled incremental job (page 422)
To process a normal job
1.
If not already, log in as a user who has been granted permission to approve a specific job.
2.
3.
4.
Select the project that has the job that you want to process.
Click the Jobs tab.
In the Jobs list pane, highlight a job that has not yet been processed.
5.
In the right Information pane, click Process.
To process a recurring job
1.
2.
3.
4.
If not already, log in as a user who has been granted permission to approve a specific job.
Select the project that has the recurring job that you want to process.
Click the Jobs tab.
On the Jobs list pane, do one of the following:
View the Jobs list.
In the top Jobs list pane, a job represents the last occurrence of the recurring job.
4a.
Highlight a job that has not yet been processed.
Approving and Managing Jobs Processing a Job | 420
4b.
In the right Job Details pane, click Process.
On the bottom-left of the Jobs tab, expand the Job Results pane.
After the pane is expanded, you see each occurrence of the job.
4c.
You can process the last occurrence or you can process an earlier occurrence.
Select the box for the occurrence that you want to process.
4d.
Below the occurrence list, click Process.
Important: Click the Process button in the bottom-left pane, not the button in the right Job Details pane.
Approving and Managing Jobs Processing a Job | 421
To process a scheduled incremental job
Important: To process all data from a scheduled incremental job, you must process all occurrences.
1.
2.
If not already, log in as a user who has been granted permission to approve a specific job.
Select the project that has the recurring job that you want to process.
3.
4.
Click the Jobs tab.
On the Jobs list pane, view the Jobs list.
Important: In the top Jobs list pane, a job represents only the last occurrence of the recurring job. Do NOT click the Process button on the right pane.
5.
On the bottom-left of the Jobs tab, expand the Job Results pane.
After the pane is expanded, you see each occurrence of the job.
5a.
You can process either one occurrence or you can process all occurrence.
Select the box for the occurrence that you want to process.
To process all occurrences, select the box above the list.
5b.
Below the occurrence list, click Process.
Approving and Managing Jobs Processing a Job | 422
Important: Click the Process button in the bottom-left pane, not the button in the right Job Details pane.
Resetting the Processing Status
If a job has already been processed, you can reset the processing status.
To reset the processing status
1.
2.
3.
If not already, log in as a user who has been granted permission to approve a specific job.
Select the project that has the job that you want to reset the process.
In the Jobs list pane, highlight the processed job that you want to reset.
4.
Reset Processing Dialog
5.
6.
7.
In the Reset Processing dialog, select whether you want the status to be reset to either Not Started or
Completed.
Select between the Collection Status Only or Collection and Sub Items option.
Click OK.
Approving and Managing Jobs Processing a Job | 423
Using Job Reports
You can use Job Reports to generate various predefined reports with detailed information about collected files, emails, file statistics, remediated files, and so forth.
You can download a job report in the Excel spreadsheet format (.xls) format.
The following job reports are available:
Job Details Report: Displays comprehensive information on the job options that were applied when the job was created.
Job Results: Displays information on job results for the job.
Full Error Report: Displays a breakdown of failed targets and the errors associated to them.
Running the Job Detail Report
All jobs have the Job Detail report available.
To run the Job Detail report
1.
On the Home page, select a project and click the Jobs tab.
2.
In the Jobs list pane, select a job.
3.
4.
In the lower pane, click Reports .
Click Job Detail > Download to view the report.
Running the Job Results Report
The Job Results report is available for Search and Review and Volatile jobs. You can generate a job results report once a job begins collecting and at least one job target status is also collecting.
To run the Job Results report
1.
On the Home page, select a project and click the Jobs tab.
2.
In the Jobs list pane, select a job.
3.
4.
5.
In the lower pane, click Reports .
Click Job Results > Download to download the report.
Click Job Results > View to view the report.
Running the Full Error Report
The Full Error Report shows a break down of failed targets and the errors associated to them. You can generate a full error report on a completed job where one or more targets have failed.
To run the Job Results report
1.
2.
On the Home page, select a project and click the Jobs tab.
In the Jobs list pane, select a job.
Approving and Managing Jobs Using Job Reports | 424
3.
4.
5.
In the lower pane, click Reports .
Click Full Error Report > Download to download the report.
Open the report.
Retrieving Reports for Deleted Jobs
You can retrieve Job reports, System logs, and Activity logs for jobs that have been deleted. You can retrieve the logs by navigating to a folder that you have specified in the web.config file.
In order to enable this feature, you must edit the web.config file. You can find the web.config file at
C:\Program
Files\AccessData\MAP\Web.config. In the web.config file, locate the <add key=”PersistLogsToPath” value= “”/> . For the PersistLogsToPath value, enter a path to where you would like to save the logs.
Note: Only previously generated reports for a job are available after a job has been deleted.
Approving and Managing Jobs Using Job Reports | 425
Using Job Notifications
About Managing Notifications for a Job
You can use
Manage Notifications
to set up a list of subscribers to email notifications for a given target job or target project, and an event type such as when job processing is completed.
Target types and their associated event types include the following:
Notification Type
Target type
Projects
Jobs
System
Associated event types
Job Approved
Job Completed
Job Created
Processing Completed
Job Approved
Job Completed
Processing Completed
See Creating Job Notifications on page 426.
See Deleting Job Notifications on page 427.
User Created
User Deleted
Project Created
Project Deleted
Before you can have email notifications sent for a job event, you must first make sure that you have configured the email notification server that you want to use.
See Configuring the Email Notification Server on page 81.
Creating Job Notifications
After you create a job notification, you can view all the notifications that you have created by going to the
Manage Notification Subscriptions view available from the Home page.
See About Managing Notifications for a Job on page 426.
To create job notifications
1.
On the menu bar, click Jobs.
2.
In the Jobs list pane, check one or more jobs whose events you want to target for email notification.
3.
4.
5.
6.
In the lower left area of the project list pane, click .
In the Create Event Notification page, select a notification event type from the drop-down list.
In the Select Users to Notify group box, check the users who will receive the notification email message.
Click Create Event Notification.
Approving and Managing Jobs Using Job Notifications | 426
Deleting Job Notifications
You can delete job notifications that you created or job notifications that you are subscribed to.
See About Managing Notifications for a Job on page 426.
To delete job notifications
1.
2.
On the Home page, in the Project List panel, click .
Do one or more of the following:
In the Notifications I Created group box, under the Notification Type column header, check the job notifications that you want to delete.
In the Notification I Belong To group box, under the Notification Type column header, check the job notifications that you want to delete.
3.
4.
Click .
In the Confirm Deletion dialog box, click OK.
Approving and Managing Jobs Using Job Notifications | 427
Using Job Templates and Filter Templates
About Job Templates and Filter Templates
You can create and manage templates so that job settings can be re-used.
Job Templates
You can create a job template which includes several general job settings, such as job type, job target type, job priority, AD1 options, approvers, and so on. When you create a new job, you can save time by importing the settings from a job template.
Important: You can’s save scheduling settings in a custom job template.
Filter Templates
When configuring a job and defining filters, you can save the filters for use in other jobs.
Viewing Job Templates and Filter Templates
To view templates
1.
Do one of the following:
On the Management page, do the following:
1a.
Click System Configuration.
1b.
1a.
1b.
Click Manage Templates.
On the Home page, do the following:
Select a project.
Click the Jobs tab.
2.
3.
Click the Job Templates or Filter Templates tab.
About Default Job Templates
In the current version of eDiscovery, no default job templates apply. However you can create and use your own custom job templates.
Managing Custom Job Templates
An application administrator or as a user with the Manage Job Templates permission can use a central location on the Management page to view, add, edit, and delete job templates.
You can create job templates in one of two ways:
Create them in advanced using the Job Wizard Template Editor.
When creating a job, save general settings in a template.
Approving and Managing Jobs Using Job Templates and Filter Templates | 428
To create a job template in advance
1.
2.
3.
On the Job Templates page, click Add .
Go through the wizard and select the options that you want to save.
See Job Options Tab on page 428.
Save the template.
To edit a job template
1.
On the Job Templates page, select a custom job template.
2.
3.
4.
Click Edit .
Go through the wizard and select the options that you want to save.
See Job Options Tab on page 428.
Save the template.
To delete a job template
1.
On the Job Templates page, check the custom job templates that you want to delete.
2.
Click Delete .
Viewing and Deleting Filter Templates
An application administrator or as a user with the Manage Job Templates permission can use a central location on the Management page to view and delete filter templates.
You create and edit filter templates when creating a job.
See Using Job Filters on page 443.
On the Filter Templates page, you can only view and delete filter templates.
To view filter templates
1.
Do one of the following:
On the Management page, do the following:
1a.
1b.
Click System Configuration.
Click Manage Templates.
On the Home page, do the following:
1a.
Select a project.
1b.
Click the Jobs tab.
2.
3.
Click the Filter Templates tab.
To delete a filter template
1.
On the Filter Templates page, check the custom job templates that you want to delete.
2.
Click Delete .
Approving and Managing Jobs Using Job Templates and Filter Templates | 429
Additional Job Tasks
Testing the Collection Workflow
You can test the collections workflow to insure that everything is collecting properly.
To test the collections workflow
1.
2.
On the Home page, select the project that has the job that you want to check the collection workflow.
In the Jobs list pane, select a job or jobs.
3.
Click
Test Collection Workflow
at the bottom of the Jobs list pane.
Note: This process could take up to 30 seconds to execute.
4.
Click OK.
Stopping a Job
You can stop active jobs after they have been approved and executed.
When you stop a job, the Job Status column in the Jobs list pane does not immediately show “Canceled.”
Instead, the status shows “Canceling” until the task is complete.
See Deleting Jobs on page 432.
To stop a job
1.
On the menu bar, click Jobs.
2.
In the Jobs list pane, check a job you want to cancel.
3.
4.
In the lower left corner of the Jobs list pane, click .
Click Yes.
Note: Stopping an already executed job (completed) results in a dialog box that says “There are no jobs to cancel. None of the selected jobs are executing.”
Resubmitting a Job
You can resubmit a job if it has failed, the computer has restarted, some of the items in the job did not complete, or you want to add incremental data.
Note: Users without the Create Jobs Project permission cannot create jobs by resubmitting existing jobs.
To resubmit a job
1.
2.
On the menu bar, click Jobs.
In the Jobs list pane, check a job name.
Approving and Managing Jobs Additional Job Tasks | 430
3.
4.
In the lower left corner of the Jobs list pane, click .
In the Resubmit Job dialog, set the options that you want. The following table describes the available options.
Resubmit Job Dialog
Resubmit Collection Options
Option
New Job Name
Item Options
Include Failed Items Only
Include all Failed Files
(Shares Only)
Copy Job
Resubmit Type
Full (Recommended)
Incremental
Description
Specify a new name for the job.
Include all Incompleted Items
Only
Collects only targeted items that have failed for various reasons, such as no connection.
Collects only targeted items that do not have a “Completed” status. The status may be Collecting, Queued, Waiting for Retry, Cancelled, Terminated, and so forth.
Tries to collect only failed files that reside on a network share.
Recollects all the originally targeted items.
Reruns the entire job again and gathers all hung, new, or modified data.
Reruns the job, but only gathers new or modified data since the last collection.
See Using Recurring and Incremental Collection Jobs on page 450.
5.
Click Create Job.
Editing a Job
You can edit a job only if it has not yet been approved or executed. If a job is already approved or executed, you can only view the job’s settings.
Approving and Managing Jobs Additional Job Tasks | 431
See Approving a Job on page 419.
See Executing a Job on page 419.
To edit a job
1.
On the menu bar, click Jobs.
2.
In the Jobs list pane, highlight a job name.
3.
4.
5.
In the task pane, click .
In the Edit Job page, open the desired panel of the wizard, and then set the options that you want.
Click Save to return to the Jobs list pane where you can select the job, approve it, and then execute it.
Deleting Jobs
You can delete one or more jobs from the Jobs list view. You should use caution when you use this feature because a selected job may be active. If a job is active and you delete it, the Work Manager may stop.
Note: There may be a delay between the time you delete the job and the time that the program updates the overall project size. You can still proceed with your work while the program is updating the project size.
See Stopping a Job on page 430.
To delete jobs
1.
2.
On the menu bar, click Jobs.
Do one of the following:
In the Jobs list pane, highlight a job name you want to delete. In the right side of the upper pane, click
3.
4.
.
In the Jobs list pane, check one or more jobs that you want to delete. In the lower left corner of the
Jobs list pane, click .
(Optional) In the Confirm Deletion pane, check Keep Archive to keep an archive record of the jobs, and remove the jobs from the user interface.
Click OK.
Note:
Multiple files are collected from incremental jobs executed against Exchange mailboxes: PST file, sent file, receive file, and sometimes the Exchange top of the file. If multiple incremental jobs are executed against an Exchange mailbox, extra files with be generated.
Incremental collection only counts files as hits, not folders. However the folders appear in an AD1 file created from the data.
Moving a file from one folder to another does not count as an incremental change and does not cause an update to occur. Moving files from one folder to another causes duplicates in the data to occur.
Approving and Managing Jobs Additional Job Tasks | 432
Chapter 40
Configuring Jobs for Third-Party Data Sources
You can access third-party data sources for data. To access these sources, you need to configure job options in the Job Wizard. The following jobs access third-party data sources:
See Introduction to the eDiscovery Collection Job on page 383.
Note: Before you can access third-party data sources with a job, you need to configure the application to connect to the third-party data source in Data Sources.
See Configuring Third-Party Data Repositories as Data Sources on page 143.
When configuring job options, you may configure the following third-party Data Sources.
Other Data Sources Job Options
Option
Box
Cloud Mail
CMIS
Documentum
DocuShare
Domino
Druva
Enterprise Vault Server
Exchange
Description
Lets you select data sources from your Box cloud storage system.
See Box Collections Options on page 436.
Lets you select data sources from a cloud mail server.
See Cloud Mail Collection Options for People on page 438.
Lets you select data sources from a server connected by CMIS.
See CMIS Collection Options on page 458.
Lets you select data sources from a Documentum server.
See Documentum Collections Options on page 440.
Lets you select data sources from a DocuShare server.
See DocuShare Collection Options on page 442.
Lets you select data sources from a Domino
See Domino Collection Options on page 439.
Lets you select data sources from a Druva server.
See Druva Collection Options on page 456.
Lets you select data sources from an Enterprise Vault Server or select from a particular person on an Enterprise Vault Server.
See Enterprise Vault Server Collection Options on page 444.
Lets you collect Exchange emails from a person.
See Collecting Exchange Emails for Custodians on page 447.
Configuring Jobs for Third-Party Data Sources | 433
Other Data Sources Job Options
Option
Exchange Public Folder
Gmail
Google Drive
OpenText ECM
SharePoint
Website
Description
Lets you collect data sources from an Exchange Public Folder.
See Exchange Public Folder Collection Options on page 449.
Lets you select data sources from a Gmail server.
Lets you select data sources from a Google Drive.
See Enterprise Vault Server Collection Options on page 444.
Lets you select data sources from an OpenText ECM server.
See OpenText ECM Collection Options on page 451.
Lets you select data sources from a SharePoint server.
See SharePoint Collection Options on page 452.
Lets you select data sources from a Website through a Google account.
See Website Collection Options on page 455.
Configuring Jobs for Third-Party Data Sources | 434
Other Data Sources Filter Options
When using a job to collect data, you can use filters to either include or exclude specified data.
You are not required to configure filters to complete a job. If you do not configure any filters, the application collects all the files in the data storage locations.
You configure filters by expanding the Filters panel on the wizard page and then clicking or to add or edit an Include or Exclude filter.
Configuring Jobs for Third-Party Data Sources Other Data Sources Filter Options | 435
Box Collections Options
This option appears only if you select Box in the Other Data Sources pane in the Job Options screen of the wizard.
In order to make any selections, you must have already configured the application to collect from a Box data source.
See Configuring for Box on page 176.
In the Box panel, you can select a server that you want to collect from.
Box Include and Exclude Filters
You also have the option to configure the Box filters. You can customize filters to include or exclude certain variables.
Important: If you use a filter property, such as File Extension or File Modified Date, you must also use the Query property. You must query on at least one keyword.
If you do not use any filters, you can collect all files without having to use the Query property.
Box Filters
Box Filter Properties
Option
Filter Name
Ancestor Folder Ids
File Extension
Description
The name of the filter.
Allows you to select Box files based on the parent folder. You can select files that are within the ancestor folder or are not within the ancestor folder. Use commas to separate multiple folders.
Allows you to select Box files based on file extension. You can select files that contain the file extension or do not contain the file extension. Use commas to separate multiple extensions.
Box Filter Properties Box Collections Options | 436
Box Filter Properties
Option
File Creation Date
File Modified Date
Owner
Query
Scope
File Size
Description
Allows you to select Box files based on file creation date. You can specify a single file creation date or a date range when the file was created.
Note: Do not select Range - Date Outside for this option. The filter will collect the Date Inside range instead of Date Outside range.
Allows you to select Box files based on file modified date. You can specify a single file modified date or a date range when the file was modified.
Note: Do not select Range - Date Outside for this option. The filter will collect the Date Inside range instead of Date Outside range.
Allows you to select Box files based on the owner. You can select files that contain the owner or do not contain the owner. Use commas to separate multiple owners.
Lets you query for a keyword in a document.
Important! Box does index the entire contents of a file. If you query for a specific keyword, you may not get accurate results.
Important! If you use any other filter property, such as File Extension or File
Modified Date, this field is required. You must query on at least one keyword.
Allows you to select Box files based on the scope of the authentication token.
You can select files that contain the scope of the authentication token or contain the scope of the authentication token. Use commas to separate multiple scopes.
Allows you to select Box files based on file size. You can specify a single file size or a file size range.
Note: Do not select Range - Date Outside for this option. The filter will collect the Date Inside range instead of Date Outside range.
Box Filter Properties Box Collections Options | 437
Cloud Mail Collection Options for People
You can collect cloud mail for Custodians. To collect, select People and Select Person’s Cloud Mail in the Job
Target Options group box in the Job Wizard.
When you collect the mail, you may notice a discrepancy in the email count between collecting from an POP server and collecting from an IMAP server. It might seem that there is more email collected from the IMAP server than the POP server.
The reason is because of the difference between the way IMAP handles email compared with the way POP handles email. If there is an email sent on an IMAP server that has the same To: address as the Sent From: address (For example, if you had sent an email to yourself), IMAP will store a copy of the email in two separate locations: one in the To: folder, and one in the Sent From: folder. POP will only store one copy of the email.
Box Filter Properties Cloud Mail Collection Options for People | 438
Domino Collection Options
The Domino tab lets you collect Notes email for the highlighted custodian. In the Domino pane, you can do the following:
Include Notes Collect Notes email for the highlighted custodian in the list box.
Collect Folders
Collect email folders on the highlighted custodian in the list box.
Note: You should not put spaces in a comma-delimited list of folders that you want to collect.
Collect Non-Email Data
Collect non-email data, such as task items or calendar items, on the highlighted custodian.
Domino Filters
Filter the collected emails by variables such as subject, creation date, or keywords.
You can customize the filters, edit them, and delete them.
You must select a custodian from the Custodians pane before you can select any of the above options.
When dealing with a Domino Server, you should understand that Domino differentiates between internet email servers and other email servers. As an administrator, you need to make sure that you have the correct value listed in the Domino filter when setting up collecting with a Domino server.
To obtain the values for the Domino filter
1.
On your Domino server, select an email from the user you want to define as a Domino custodian in eDiscovery.
2.
3.
4.
Right click the user.
The Domino server will display a fields tab and the values associated with those fields.
Highlight and copy the value string of the field that you want to edit.
Note: On the Domino server, the value string for a sender’s email server is listed in From under the Fields tab, while the value string for a sender’s internet email server is listed in INetfromfield under the Fields tab .
Domino Email Values
To set up email values in the Domino filter
1.
2.
3.
4.
In the Custodians option, under Job Wizard, select the custodian that you want.
Select the
Domino
tab.
Check
Include Notes.
Select
Domino Filters.
5.
6.
7.
In the Include group box, click Add. The Include dialog appears.
Enter the value string in the Senders’ Internet Email and Senders’ Email fields.
Click OK.
Box Filter Properties Domino Collection Options | 439
Documentum Collections Options
This option appears only if you click Custom, and then check Documentum in the Job Target Options group box in the Job Options screen of the wizard.
In order to make any selections, you must have already configured the Documentum data source.
See Configuring for a Documentum Server on page 157.
In the Documentum panel, you can select a server that you want to collect from.
Documentum Include and Exclude Filters
You also have the option to configure the Documentum filters. You can customize filters to include or exclude certain variables.
Documentum Filters
Documentum Filters
Option
Filter Name
Box Filter Properties
Description
(Required) The name of the new filter.
Documentum Collections Options | 440
Documentum Filters (Continued)
Option
Cabinet(s)
Author(s)
Owner
Creator
Keyword(s)
Modified By:
Name
Extension(s)
File Size (bytes)
Subject
Title
File Creation Date
File Modified Date
Description
The name of the cabinet that you are collecting from.
Filters files based on the author(s).
Filters files based on the owner.
Filters files based on the creator.
Filters files based on keywords.
Filters files based on the Modified By: field.
Filters files based on the name.
Filters files by extension. You can separate multiple extensions with a comma. For example, bmp,jpg,png. You can use an asterisk (*) as a wildcard.
Filters files based on file size. You can designate file size ranges using
Equals, Not Equals, Greater Than, or Less Than size in bytes.
Filters files based on the subject.
Filters files based on the title.
Filters files based on any date, a specific creation date, or a data range.
Filters files based on any edit date, a specific edit date, or an edit data range.
Box Filter Properties Documentum Collections Options | 441
DocuShare Collection Options
This option appears only if you select DocuShare in the Job Target Options group box in the Job Options screen of the wizard.
In order to make any selections, you must have already configured the DocuShare data source.
See Configuring for a DocuShare Server on page 164.
In the DocuShare panel, you can select a server from which you want to collect.
DocuShare Include and Exclude Filters
You also have the option to configure the Docushare Filters. You can customize filters to include certain values or exclude certain values.
DocuShare Filters
Box Filter Properties DocuShare Collection Options | 442
DocuShare Filters
Option
Filter Name
Author(s)
Keyword(s)
Description
File Type
Handle
Keyword Property
Modified By
Owner
File Size (bytes)
Summary
Title
File Name
File Creation Date
File Modified Date
Description
(Required) The name of the new filter.
Filters files based on the author(s).
Filters files based on keyword(s).
Filters files based on content in the description
Filters files based on file type.
Filters files based on the handle.
Filters files based on keyword property.
Filters files based on the Modified By: field.
Filters files based on the owner.
Filters files based on file size. You can designate file size ranges using
Equals, Not Equals, Greater Than, or Less Than size in bytes.
Filters files based on the content in the summary.
Filters files based on the title.
Filters files based on the file name.
Filters files based on any date, a specific creation date, or a data range.
Filters files based on any edit date, a specific edit date, or an edit data range.
Box Filter Properties DocuShare Collection Options | 443
Enterprise Vault Server Collection Options
The Enterprise Vault Server options appear only if you click Custom and then check Enterprise Vault Server in the Job Target Options group box in the Job Options screen of the wizard.
In order to make any selections, you must have already configured a Enterprise Vault Server data source.
Configuring for an Enterprise Vault Server (page 151)
In the Enterprise Vault Server panel, you can select an Enterprise Vault Server, Enterprise Vault Store, and
Unassociated Archives.
Enterprise Vault Include and Exclude Filters
You also have the option to configure the Email Archive Filters or the File Archive Filters. You can customize filters to include certain values or exclude certain values.
Email Archive Filters for Enterprise Vault Server
Enterprise Vault Email Archive Filters
Option
Filter Name
BCC’s Email
CC’s Email
Keyword(s)
Description
(Required) The name of the new filter.
Filters files based on the BCC’s email.
Filters files based on the CC’s email.
Filters emails based on keyword(s).
Box Filter Properties Enterprise Vault Server Collection Options | 444
Enterprise Vault Email Archive Filters (Continued)
Option
Apply Keywords
Recipient’s Email
Sender’s Email
Senders Names
Subject
Mailbox Folder Name
Created Date
Description
Applies keywords entered in the Keyword field by content, attachments, or both.
Filters files based on recipient’s email.
Filters files based on sender’s email.
Filters files based on the senders names.
Filters files based on the subject.
Filters files based on the mailbox folder name.
Filters files based on the created date. You can filter by a single date, a range of dates, or any date.
File Archive Filters for Enterprise Vault Server
Enterprise Vault File Archive Filters
Option
Filter Name
Extension(s)
File Size (bytes)
Keywords
Description
(Required) The name of the new filter.
Filters files by extension. You can separate multiple extensions with a comma. For example, bmp,jpg,png. You can use an asterisk (*) as a wildcard.
Filters files based on file size. You can designate file size ranges using
Equals, Not Equals, Greater Than, or Less Than size in bytes.
Filters files based on keywords.
Box Filter Properties Enterprise Vault Server Collection Options | 445
Enterprise Vault File Archive Filters (Continued)
Option
Apply Keywords
File Creation Date
File Modified Date
Description
Applies keywords entered in the Keyword field by content, attachments, or both.
Filters files based on any edit date, a specific edit date, or an edit data range.
Filters files based on any edit date, a specific edit date, or an edit data range.
Box Filter Properties Enterprise Vault Server Collection Options | 446
Collecting Exchange Emails for Custodians
The Exchange tab lets you collect Exchange email for the highlighted custodian. The data that you can collect from a server depends upon the version of Exchange server that you are collecting from.
A custodian must be associated to an Exchange server before you can collect from that server.
See Configuring for an Exchange Online/365 Server on page 145.
See Configuring for Exchange 2003, 2007, and 2010 Servers on page 147.
See Configuring for Exchange 2010 SP1 and 2013 Servers on page 148.
Collecting Data from an Exchange Server
To collect Exchange email from a custodian
1.
In Job Wizard, under Custom Selection, select
People
and
Select Person’s Exchange.
2.
3.
Click
Next.
Select the person or people that you want to collect from using Exchange.
4.
5.
6.
Under
Exchange
tab, click Include Exchange.
Populate the Include Exchange fields.
Select
Next.
Exchange Collection Options
The following table describes the fields that are available in the Include Exchange panel.
Note: When collecting from Exchange public folders, Include and Exclude filters will only work with Exchange
2013. Attempting to use a filter when collecting from public folders from earlier versions of Exchange will result in job target failure.
Include Exchange Fields
Field
Exchange MAPI
Complete Mailbox
Filtered Mailbox
Include Dumpster
Description
MAPI (Messaging Application Programming Interface) data is available from
Exchange 2003, 2007, and 2010 servers. Depending upon which servers the custodians are associated with, both MAPI and EWS options may be available. If only a server is set up to collect MAPI data only, only MAPI data options will be available.
Creates a local, unfiltered PST containing the full contents of the custodian's mailbox. With this option, you can collect additional data besides the custodian’s mailbox.
Allows you to filter email by variables such as subject, creation date, or keywords.You can customize the filters, edit them, and delete them. If filters are not set, the complete mailbox will be collected.
Allows you to collect emails that are soft-deleted.
Box Filter Properties Collecting Exchange Emails for Custodians | 447
Include Exchange Fields
Field
Collect Non-Email Data
Exchange Web
Services
Apply Filter
Include Recoverable
Deletes
Include Recoverable
Purges
Include Recoverable
Versions
Include Archive MailBox
Mailbox Folder Path(s)
Description
Allows you to collect non-email data, such as task items or calendar items associated with that custodian.
Exchange Web Services data is available from Exchange Online/365, Exchange
2010 SP1, and 2013 servers. Depending upon which servers the custodians are associated with, both MAPI and EWS options may be available.
Note: Discovery does not support EWS data for Exchange 2010. Only MAPI data can be collected from Exchange 2010.
Allows you to apply the Exchange filters to the EWS data.
Allows you to collect deletions. Deletions are enabled by default in
Exchange.There’s no need to specify a folder path because there is no folder structure retained for those items.
Allows you to collect purges (hard deletes) of data. In order to collect purges from an Exchange server, enable purges in the Exchange server. There is no need to specify a folder path because there is no folder structure retained for those items.
Allows you to collect versions of data that have been saved. In order to collect versions from an Exchange server, enable versions in the Exchange server.
There is no need to specify a folder path because there is no folder structure retained for those items.
Allows you to collect from an archive mailbox.
Specifies the mailbox folder to collect from an archive mailbox. In the field, you can put in the exact path of the destination of the mailbox, a root path of the destination, or you can put in a keyword. If you use a keyword, the application will collect from every mailbox with the keyword.
Note: Each mailbox folder path, and its options, is assigned per custodian, so if you need to have multiple custodians with the same job target, you need to define the mailbox folder and options under each custodian.
Box Filter Properties Collecting Exchange Emails for Custodians | 448
Exchange Public Folder Collection Options
The Exchange Public Folder options appear only if you check Exchange Public Folder in the Other Data
Sources group box in the Job Options screen of the wizard.
In order to make any selections, you must have already configured a Exchange Server data source.
In the Exchange Public Folder panel, you can select a server that you want to collect from.
Exchange Include and Exclude Filters
You also have the option to configure the Exchange Public Folder filters. You can customize filters to include or exclude certain variables.
Exchange Public Folder Include Filter
Exchange Public Folder Filters
Option
Filter Name
Keywords
Title
Creation Date
Description
(Required) The name of the new filter.
Filters files based on keywords.
Filters files based on the title.
Filters files based on any edit date, a specific edit date, or an edit data range.
Box Filter Properties Exchange Public Folder Collection Options | 449
Google Drive Collection Options
The
Google Drive
option appears only if you click
Custom
and then check
Google Drive
in the Job Target
Options
group box in the Job Options screen of the wizard.
In order to make any selections, you must have already configured a Google Drive data source.
Note: The Google Drive connector will only collect documents that have been created in Google Drive. It will not collect documents that have been uploaded to Google Drive from other sources, such as Microsoft Word or Excel files.
Configuring for Google Drive (page 170)
In the Google Drive panel, you can select a server from which you want to collect.
Google Drive Include and Exclude Filters
You also have the option to configure the Google Drive Filters. You can customize filters to include or exclude certain keywords.
Note: For Google Drive, the exclude filters are ignored
Make sure to separate multiple keywords by commas.
Google Drive Filters
Google Drive Filters
Option
Filter Name
Keyword(s)
Description
(Required) The name of the new filter.
Filters files based on keywords.
Box Filter Properties Google Drive Collection Options | 450
OpenText ECM Collection Options
The OpenText ECM options appear only if you click Custom and then check OpenText ECM in the Job Target
Options group box in the Job Options screen of the wizard.
In order to make any selections, you must have already configured a OpenText ECM data source.
Configuring for Cloud Mail (page 166)
In the OpenText ECM panel, you can select a OpenText ECM repository.
OpenText ECM Include and Exclude Filters
You also have the option to configure the OpenText ECM filters. You can customize filters to include certain values or exclude certain values.
Include Filter for OpenText ECM
OpenText ECM Filters
Option
Filter Name
Creator
Keyword(s)
Title
File Creation Date
Description
(Required) The name of the new filter.
Filters files based on the creator.
Filters files based on keywords.
Filters files based on the title.
Filters files based on any edit date, a specific edit date, or an edit data range.
Box Filter Properties OpenText ECM Collection Options | 451
SharePoint Collection Options
The SharePoint options appear only if you click Custom and then check SharePoint in the Job Target Options panel earlier in the wizard.
In order to make any selections, you must have already configured a SharePoint data source.
See Configuring for a SharePoint Server on page 159.
You can select the Top-Level Site URL(S) and SubSites. For the SubSite, you can select to include the following:
Select SharePoint Collection Type Options
Option Description
Top-Level Site URL(S) list box Lists all the Top-Level Site URL(S) that you can select to add to the job to collect from.
This list is populated based on settings in the Data Sources tab.
See Configuring for a SharePoint Server on page 159.
Filter Options Lets you filter the information in the associated list pane.
See Managing Columns in Lists and Grids on page 37.
SubSites list box Lists all the SubSites that you can select to add to the job to collect from.
This list is populated based on settings in the Data Sources tab.
See Configuring for a SharePoint Server on page 159.
SubSite Options
Include Blog
Include Discussion Board
Include Wiki
Include Document Library
Include Calendar
Include Contacts
Include Tasks
Include Announcements
Include Survey
Collects blog data within the specified root path of a highlighted individual site or a team site in the SharePoint Site URL list. You can choose to include the whole page in collecting or not.
Collects discussion board data from within the specified root path of a highlighted individual site or a team site in the SharePoint Site URL list. You can choose to include the whole page in collecting or not.
Collects wiki data within the specified root path of a highlighted individual site or a team site in the SharePoint Site URL list.
Collects document data from within the specified root path of a highlighted individual site or a team site in the SharePoint Site URL list.
Collects calendar data from within the specified root path of a highlighted individual site or a team site in the SharePoint Site URL list.
Collects contacts data from within the specified root path of a highlighted individual site or a team site in the SharePoint Site URL list.
Collects tasks data from within the specified root path of a highlighted individual site or a team site in the SharePoint Site URL list.
Collects announcements data from within the specified root path of a highlighted individual site or a team site in the SharePoint Site URL list.
Collects survey data from within the specified root path of a highlighted individual site or a team site in the SharePoint Site URL list.
Box Filter Properties SharePoint Collection Options | 452
Sharepoint Include and Exclude Filters
You also have the option to configure the File Filters. You can customize filters to include certain values or exclude certain values.
Note: Using a “Does Not Contains” operator is no longer supported.
Sharepoint Filters
Option
Filter Name
Extension(s)
URL Contains
File Size (bytes)
Title
Box Filter Properties
Description
(Required) The name of the new filter.
Filters files by extension. You can separate multiple extensions with a comma. For example, bmp,jpg,png. You can use an asterisk (*) as a wildcard.
When filtering for a specific file-type, the job may also collect some system files, such and .MHT files.
Filters any URL with the designated name in the path.
Filters files based on file size. You can designate file size ranges using
Equals, Not Equals, Greater Than, or Less Than size in bytes.
When filtering for a specific file size, the job may also collect some system files, such and .MHT files.
Filters files based on the title.
SharePoint Collection Options | 453
Sharepoint Filters (Continued)
Option
Author(s)
Editor(s)
Content Type
Keyword(s)
Name
File Creation Date
File Modified Date
Description
Filters files based on the author(s).
Filters files based on editor(s).
Filters files based on the content type.
The following values are supported:
members, badges, document, folder,
link, message, event, issue,
announcement, contact, task, workflow history, person, sharepointgroup, domaingroup, post, comment, east asia contact, followed sites
Filters files based on keywords.
Filters files based on the name.
Filters files based on any date, a specific creation date, or a data range.
Filters files based on any edit date, a specific edit date, or an edit data range.
Note: When you perform a Collection job that includes a .Zip or other archived file, the collected files will include the contents of the .zip file in the file count.
Box Filter Properties SharePoint Collection Options | 454
Website Collection Options
The
Website
option appears only if you check Website in the Other Data Sources pane in the Job Target
Options
group box in the Job Options screen of the wizard.
In order to make any selections, you must have already configured a website data source.
See Configuring for Web Sites on page 162.
In the Website panel, you can select a website from which you want to collect.
There are no filters available for websites.
Box Filter Properties Website Collection Options | 455
Druva Collection Options
The
Druva
option appears only if you check Druva in the Other Data Sources pane in the Job Target Options group box in the Job Options screen of the wizard.
In order to make any selections, you must have already configured a Druva data source.
See Configuring for Druva on page 171.
In the Druva panel, you can select a Druva server.
Druva Include and Exclude Filters
You also have the option to configure the File Filters. You can customize filters to include certain values or exclude certain values. You can add a filter, delete a filter, edit a filter, or load a saved filter.
Druva Include Filter
Druva Include Filter Options
Option
Filter Name
Extension(s)
Description
(Required) The name of the new filter.
Filter files by extensions. Specify whether the value(s) filtered equals or does not equal the data entered in the field. Separate multiple extensions by comma.
Box Filter Properties Druva Collection Options | 456
Druva Include Filter Options
Option
Path Contains
Description
Filter files by what values are contained in the path. Specify whether the value filtered is text or a regular expression. Separate multiple extensions by comma.
File Size (bytes)
File Creation Date
File Modified Date
Filter files by file size. Specify whether the value filtered is greater than, is, less than, or any value entered in the file size field. You can specify the size by bytes, kilobytes, and kilobytes.
Filter files by file creation. Specify the data by a range of dates, a single date, or any specific date.
Filter files by the time the file was modified. Specify the data by a range of dates, a single date, or any specific date.
File Last Accessed Date Filter files by the last time the file was accessed. Specify the data by a range of dates, a single date, or any specific date.
Save Filter as a Template Save the filter created as a template that can be loaded by other users.
Box Filter Properties Druva Collection Options | 457
CMIS Collection Options
The
CMIS Repository
option appears only if you check CMIS in the Other Data Sources pane in the Job Target
Options
group box in the Job Options screen of the wizard.
In order to make any selections, you must have already configured a CMIS Repository data source.
See Configuring for a CMIS Repository on page 173.
In the CMIS panel, you can select a CMIS Repository server. Checking Use Global Custom Filters allows the job to use a custom filter that you may have uploaded when configuring the application for CMIS collection.
Note: The custom filter can combine with the Include and Exclude filters. The custom filter in combination with the Include/Exclude filters acts as an OR not AND. That is, data matching either the specifications in the
Include/Exclude or in the custom filter. The data does not need to match both filters.
CMIS Include and Exclude Filters
You also have the option to configure the File Filters. You can customize filters to include certain values or exclude certain values. You can add a filter, delete a filter, edit a filter, or load a saved filter.
Although there are many fields available in the Include and Exclude filters, not all fields available can be filtered.
The values that are available for you to filter depends upon how you have set up your CMIS repository.
Note: Please note that the user interface displays the application’s default filters. Not all of the values that are available in the filter apply to every CMIS repository. If you filter on a value that is not available in the
CMIS repository, the collection job will fail.
Box Filter Properties CMIS Collection Options | 458
CMIS Include Filters
CMIS Include Filter Options
The following lists the options that are available to filter in the Include filter.
Note: In the following table, if there is no description listed, the field cannot be searched and the job will fail.
CMIS Include Filter Options
Option
Filter Name
Name
Description
(Required) The name of the new filter.
Filters files based on the name. Specify whether the data contains the value or not.
This field is case-sensitive. For example, a name of david will not hit on David and a name of MP3 will not hot on mp3.
This field is case-sensitive. Description
Path
Keyword(s) Filters files based on the keyword(s). Specify whether to filter on any of the keywords or all of the keywords.
Box Filter Properties CMIS Collection Options | 459
CMIS Include Filter Options
The following lists the options that are available to filter in the Include filter.
Note: In the following table, if there is no description listed, the field cannot be searched and the job will fail.
CMIS Include Filter Options
Option
Creator
Modified By
File Creation Date
File Modified Date
Description
Filters files based on the creator. Specify whether the data contains the value or not.
Filters files based on the person who modified the file. Specify whether the data contains the value or not.
Filters files based on the file creation date. Specify the data by a range of dates, a single date, or any specific date.
Filters files based on the file modified date. Specify the data by a range of dates, a single date, or any specific date.
Object ID
Object Type ID
Parent ID
Version Label
Version Series ID
Content Stream Length
Content Stream Mime
Type
Content Stream File
Name
Content Stream ID
Filters files based on the content stream file name. Specify whether the data contains the value or not.
Box Filter Properties CMIS Collection Options | 460
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
Identify and collect relevant data
Collect evidence across the entire enterprise network
Process, review, and export collected evidence
Enhanced reports with keyword searches and filters
Export production set into AD1 or other load file formats
Data source management
Litigation hold management
Project management
Dashboard for monitoring and reporting
LawDrop for secure file sharing
Frequently asked questions
eDiscovery helps you to identify and collect relevant data in-house to address electronic discovery from beginning to end. You can run collections across the entire enterprise network of a company. The collected evidence can then be processed, reviewed, and exported.
Some key features include identifying and collecting relevant data, collecting evidence across the entire enterprise network, processing, reviewing, and exporting collected evidence, enhanced reports with keyword searches and filters, exporting production set into AD1 or other load file formats, data source management, litigation hold management, project management, a dashboard for monitoring and reporting, and LawDrop for secure file sharing.
You can contact AccessData Customer and Technical Support through the AccessData Support Portal, by email at [email protected], or by phone at 800-658-5199 for Americas/Asia-Pacific.
