Place image here

Enterprise Discovery:

The Next Frontier

14 September 2010

2

Jeff Ghielmetti

Director, Collection and Forensics

Svetlana Godjevac, PhD

Sr. Manager, Iron Mountain Consulting

Greg Neustaetter

Director, eDiscovery Product Management

David Bayer

Director, eDiscovery Product Marketing

En

terp

ris

e D

isco

ve

ry:

Pre

sen

ters

3

Core Drivers for Enterprise Discovery

Increase Cost

Predictability

eDiscovery costs too much

Event driven charges are unpredictable

Point solution and multi-vendor

engagements are inefficient

Large matters adversely impact standard

discovery budgets

Be Prepared

Information sources must be mapped

Disposition policies need to be defined and

enforced

Legal holds must be transparently and

consistently applied

Data search procedures must be defensible

Simplify Workflow

Data collection needs to be technology-

based, defensible and non-intrusive

Relevant data should be directly delivered to

early case assessment and review

Inefficiencies of multi-application, multi-

vendor environments must be overcome

4

Discovery as critical business process

Know What

You Have®

Enact retention policies

Automate legal holds

Identify and collect data

Leverage early case assessment

Reduce data volumes

Review/produce documents efficiently

AutomateEnsure deployment of retention policies

and litigation holds; reproducible and

defensible processes, and systemic

cost reductions

IntegrateProvide functional interoperability and

seamless, high-quality data movement

across applications

TransformOperationalize governance

capabilities with discovery as a

consistent business process

Place image here

Enterprise DiscoveryFrom Point Applications to Integrated

Solutions

Jeff Ghielmetti

6

Corporate Challenges: Retention and Discovery

Corporate

Culture + Busy

Employees

Escalating Litigation

discovery need

Many IT Systems

Email,

SharePoint, Web,

Apps, Actg,

Storage, Eng,

DMS, Archives

IT has no funding and

long project cycle Corporate Security

Retention and collection is a low priority until there

is a “Compelling Event”

7

Examples: Retention and eDiscovery

Category Company A Company B Company C Company D

Company Type High Tech Banking Manufacturing Telecom

Number of Employees 37k 91k 25k 12k

Regulated No Yes No No

Culture - employee computer use Users have unrestricted use of computer

Users have restricted use of computer

Users have unrestricted use of computer

Users have unrestricted use of computer

Culture - business driven by technology and innovation

driven by control driven by technology and innovation

driven by technology and innovation

Culture - security Non-intrusive Intrusive and Controlling

Non-Intrusive Intrusive and Controlling

Infrastructure - Order Consolidated and well organized

Not well organized. Not consolidated. Multiple systems and subsystems.

Consolidated and well organized

Consolidated and well organized

Four companies – four totally different approaches.

8

Examples: Retention and eDiscovery

A consolidated approach would meet the needs of all four companies.

Category Company A Company B Company C Company D

Company Type High Tech Banking Manufacturing Telecom

Infrastructure - System Control Limited control Very controlled Limited control Limited control

Litigation Related Events -(negative)

No Yes No Yes

Litigation position re employees Minimize impact on revenue generating employees

Litigation issues more important than day to day activities.

Minimize impact on revenue generating employees

Litigation issues more important than day to day activities.

Preservation Strategy Replicate and Isolate. Leverage backup systems, and exchange

100 % archive and no destruction

Mix of replicate and isolate and forensic image individual machines

Full forensic image of all custodian systems

Retention Program Trying to implement for past 9 years

100 % archive and no destruction

Trying to implement for past 4 years

In place but ineffective

9

Integrated Discovery Meeting enterprise discovery imperatives head-on

Identify &

Collect

• Endpoint devices

(laptops, desktops)

• Pattern matching

algorithms for

intelligence

• Policy-based

identification and

collection

• Metadata based

repository

Archive

• Email, SharePoint,

network file shares,

additional data types

• Repository of record

• Retention policies

• Litigation holds

• Classification

Early Case

Assessment

• Transparently ingest

data

• Faceted search,

advanced analytics

• Identify and tag

documents

• Develop case

strategy

• Filter and reduce

data volumes

Review

• Load data discovery

applications and/or

3rd party collections

• High productivity,

scalable review

• Advanced analytics

• Multi-project/review

team support

• Automated workflow

Place image here

Enterprise DiscoveryEarly Case Assessment

Greg Neustaetter

11

ECA in the Enterprise

• ECA appliances and software must fit within the IT environment to be most successful

• A powerful approach to identification, collection, and preservation involves:

• Email and content archives for content from corporate email, file shares, and collaboration tools

• Endpoint data collection tools for PCs and laptops

• These solutions allow for search, but due to the massive data volumes don’t offer significant analytical capabilities and are more geared towards IT users

• ECA appliances give the legal user a way to analyze collected data, reduce data volumes, and define case strategy

12

ECA for Case Strategy

• Getting access to the data early provides an opportunity for legal teams to better define case strategy

• Figure out who is involved

• Evaluate search terms prior to a meet and confer

• Estimate the cost of document review

• Understand the composition of the collected data

• Advanced search and analytical capabilities reign in complex data sets

• Faceted search and filtering tools help to find the key participants

• Conceptual organization of data brings structure to help in understanding the collected data

13

ECA for Data Reduction

• The biggest cost in eDiscovery is the billable hours of external counsel

• Reducing data volumes is the most effective tool in reducing the cost of legal review

• Primary tools for data reduction in ECA tools

• File type filtering

• Date ranges

• Deduplication

• Inclusive keyword search

• Faceted search

14

Defensibility in ECA

• ECA when done without structure can be a risk to defensibility

• Improper handling of data quality issues

• Skipping of unsupported file types

• Failure to identify non-searchable documents

• Filtering relevant data due to over-aggressive search criteria

• Chain of custody

• ECA tools or users can take steps to limit the risks to defensibility

• Exception reporting and fixing data quality issues

• Support for wide variety of email and document formats

• Search and work product auditing and reporting with rich contextual details

• Random sampling

15

Transitioning from ECA to Review

• To avoid reprocessing data, ECA tools must export all of the raw ingredients needed for full scale review

• Native, near-native, extracted text files

• Load files with document metadata

• Even if two tools support the same load file format, transition may not be simple

• Differing metadata field definitions

• Mapping of metadata fields

• Loss of work product and advanced processing information

• Legacy load file formats

16

Enterprise DiscoveryCombining advanced technologies with integrated processes

File Systems

LaptopsDesktops

High Productivity Review

Archive for

Retention Policies,

Legal Holds

Policy-based Data Identification and

Collection

Early Case Assessment

Search, identify, and directly transfer

emails and documents between governance

and discovery applications

Deliver rich metadata across applications for

granular faceted search and analysis

Chain of custody reporting across

information lifecycle and discovery

Consistent workflow drives reproducibility

and predictability

Project teams that provide matter

management support 24x7 for large complex

reviews

Place image here

© 2010 Iron Mountain Incorporated. All rights reserved. Iron Mountain and the design of the mountain are registered trademarks of Iron

Mountain Incorporated. All other trademarks and registered trademarks are the property of their respective owners.

Search and Enterprise DiscoveryBest Practices

Svetlana Godjevac, PhD

“I’m feeling lucky”

18

eDiscovery search targets

Collection & Processing

Defining a corpus of potentially relevant data

Fact Finding

Locating all the relevant data

Hot Document

Locating a specific document

QC

Locating documents for purpose of exclusion

19

Creating search terms: understanding the corpus

Knowing the relevant professional jargon and subject matter is crucial.

In addition to interviews/depositions, acquiring that knowledge should include the process of sampling of the data per custodian, business practice, department or relevant business unit.

Sampling should be done to gather:

Referents – names of people, departments, projects, locations, roles, dates, times,

Relations – names of activities, processes,

Code names/neologisms – informal or idiomatic names of projects, people, rules, situations, action codes, dates, times, etc.

.

20

Creating search terms: knowing the search tool

Know your index

Indexes are not created equal. Each search system has its own indexing options. Each provider may turn on a different subset of options.

Know your search syntax rules

Search syntax is not always the same across different search systems, and not all syntactic rules are supported by all providers, even when they use the same search systems.

21

Query building

Ingredients:

key word(s) + operator + disambiguation

(bank OR account OR letter OR signature OR complaint)

(bank OR account OR letter) AND (signature OR complaint)

(bank OR account OR letter) w/25 (signature OR complaint)

(bank w/5 account) AND (letter w/10 signature) AND complain*

agreement

bank

account

signature

letter

complaint

…

AND

OR

NOT

w/10 – within 10 tokens

w/s – within a sentences

w/p – within a paragraph

occurs(bank,5)

*?

eggs AND (ham OR bacon )

(eggs AND ham)OR (bacon) Boolean operators

Proximity operators

Wild Card operators

Occurrence operator

22

Operator Effects

Inclusion• OR

• *

• ?

Exclusion• NOT

• FILTER

Restriction• AND

• w/10

• w/s

• w/p

23

How operators affect search results

NARROWEST

NARROW

BROAD

BROADEST

(bank OR account OR letter OR signature OR complaint)

(bank OR account OR letter) AND (signature OR complaint)

(bank OR account OR letter) w/25 (signature OR complaint)

(bank w/5 account) AND (letter w/10 signature) AND complain*

Inclusive operator

Restrictive operator

More restrictive operator

Multiple restrictive operators

24

How to choose most effective search terms

Narrow Broad

Number of interpretations according to Visual Thesaurus

25

Wild cards: use them sparingly

book* see* man*

book

book's

bookcase

bookcase's

bookcases

booked

bookend

bookended

bookending

bookends

bookie

bookie's

bookies

booking

booking's

bookings

bookish

bookkeeper

bookkeeper's

bookkeepers

bookkeeping

bookkeeping's

booklet

booklet's

booklets

bookmaker

bookmaker's

bookmakers

bookmaking

bookmaking's

bookmark

bookmark's

bookmarked

bookmarking

bookmarks

bookmobile

bookmobile's

bookmobiles

books

bookseller

bookseller's

booksellers

bookshelf

bookshelf's

bookshelves

bookshop

bookshops

bookstore

bookstore's

bookstores

bookworm

bookworm's

bookworms

see

seed

seed's

seeded

seedier

seediest

seediness

seediness's

seeding

seedless

seedling

seedling's

seeds

seedy

seeing

seeing's

seeings

seek

seeker

seeker's

seekers

seeking

seeks

seem

seemed

seeming

seemingly

seemlier

seemliest

seemliness

seemliness's

seemly

seems

seen

seep

seepage

seepage's

seeped

seeping

seeps

seer

seer's

seers

seersucker

seersucker's

sees

seesaw

seesaw's

seesawed

seesawing

seesaws

seethe

seethed

seethes

seething

seethings

man's

manacle

manacle's

manacled

manacles

manacling

manage

manageability

manageable

managed

management

management's

manager

manager's

managerial

managers

manages

managing

manatee

manatee's

manatees

mandarin

mandarin's

mandarins

mandate

mandate's

mandated

mandates

mandating

mandatory

mandible

mandible's

mandibles

mandolin

mandolin's

mandolins

mandrake

mandrake's

mandrakes

mandrill

mandrill's

mandrills

mane

mane's

manes

maneuver

maneuver's

maneuverability

maneuverability's

maneuverable

maneuvered

maneuvering

maneuvers

manful

manfully

manganese

manganese's

mange

mange's

manged

manger

manger's

mangers

manges

mangier

mangiest

manging

mangle

mangled

mangles

mangling

mango

mango's

mangoes

mangos

mangrove

mangrove's

mangroves

mangy

manhandle

manhandled

manhandles

manhandling

manhole

manhole's

manholes

manhood

manhood's

manhunt

manhunt's

manhunts

mania

mania's

maniac

maniac's

maniacal

maniacs

manias

manic

manics

manicure

manicure's

manicured

manicures

manicuring

manicurist

manicurist's

manicurists

manifest

manifestation

manifestation's

manifestations

manifested

manifesting

manifestly

manifesto

manifesto's

manifestoed

manifestoes

manifestoing

manifestos

manifests

manifold

manifolded

manifolding

manifolds

manikin

manikin's

manikins

manipulate

manipulated

manipulates

manipulating

manipulation

manipulations

manipulative

manipulative's

manipulator

manipulator's

manipulators

mankind

mankind's

manlier

manliest

manliness

manliness's

manly

manna

manna's

manned

mannequin

mannequin's

mannequins

manner

manner's

mannered

mannerism

mannerism's

mannikins

mannerisms

mannerly

manners

mannikin

mannikin's

manning

mannish

mannishly

mannishness

mannishness's

manor

manor's

manorial

manors

manpower

manpower's

manqué

manqué's

mans

mansard

mansard's

mansards

manse

manse's

manservant

manservant's

manses

mansion

mansion's

mansions

manslaughter

manslaughter's

mantel

mantel's

mantelpiece

mantelpiece's

mantelpieces

mantels

mantes

mantilla

mantilla's

mantillas

mantis

mantis's

mantises

mantissa

mantissa's

mantle

mantle's

mantled

mantles

mantling

mantra

mantra's

mantras

manual

manually

manuals

manufacture

manufactured

manufacturer

manufacturer's

manufacturers

manufactures

manufacturing

manure

manure's

manured

manures

manuring

manuscript

manuscript's

manuscripts

many

26

Quality control usually leads to iterative refinements

Search term creation is an iterative process involving 4 basic steps:

Search term creation

Search execution and report generation

Report analysis, results sampling and evaluation

Search term revision

27

Documentation: keep a trail of search runs

TERM POPULATION Doc

Count

Date Run No. of Hits Unique Hit

Doc Count

Term 1 Custodian 43 1590 7/01/2011 89 23

Term 2 Custodian 43 1590 7/01/2011 0 0

Term 1 Custodian 55 3260 7/01/2011 2114 907

Term 2 Custodian 55 3260 7/01/2011 32 11

Purpose:

Search term validation

Collection quality check (QC)

Audit trail

28

E-Discovery search - Summary

Science

ArtMagic bullet

Iterative process

Place image here

© 2010 Iron Mountain Incorporated. All rights reserved. Iron Mountain and the design of the mountain are registered trademarks of Iron

Mountain Incorporated. All other trademarks and registered trademarks are the property of their respective owners.

Enterprise DiscoveryReview Security in Complex Matters

David Bayer

30

Ironclad Security for Multiple Review Teams in Complex Matters

Review teams cannot view users and security policies not their own

Review teams cannot share work product that is derived from secured tags, folders, etc. Ex:

- Issue folders based on project-specific secured tag(s)

- Work folders based on project-specific secured metadata

Review team content-based work product cannot be accessed by users in other projects. Ex:

- Redactions

- Highlighting

Native documents and produced documents can be shared between review teams

Project document metadata work product can be shared with users in other parties. Ex:

-Non-search based Work Folders

-Tags

-Annotations

-Coding Fields

-Custom Metadata

Restrictions Permissions

31

Multiple Review Teams in Complex Matters

© 2

009 S

tratify

, In

c.,

Confid

entia

l &

Pro

prie

tary

32

Multiple Review Teams in Complex Matters

© 2

009 S

tratify

, In

c.,

Confid

entia

l &

Pro

prie

tary

33

Multiple Review Teams in Complex Matters

© 2

009 S

tratify

, In

c.,

Confid

entia

l &

Pro

prie

tary

34

Multiple Review Teams in Complex Matters

© 2

009 S

tratify

, In

c.,

Confid

entia

l &

Pro

prie

tary

35

Jeff Ghielmetti

jeff.ghielmetti@ironmountain.com

Svetlana Godjevac, PhD

svetlana.godjevac@ironmountain.com

Greg Neustaetter

greg.neustaetter@ironmountain.com

David Bayer

david.bayer@ironmountain.com

Thank you!