How To Use Nearpoint Ediscovery On A Pc Or Macbook

(1)

NearPoint eDiscovery Option

(2)

NearPoint eDiscovery Option User's Guide 1

The software and each of its components, including the source code, documentation,

appearance, structure, and organization are owned by Mimosa and others and are protected under copyright and other laws. Title to the Software and any components or to any copy, modification, or merged portion shall remain with the respective copyright holders, subject to the licenses described in the Mimosa End User License Agreement ("EULA"). The Mimosa Software cannot be distributed without the prior written permission of Mimosa and cannot be copied, except as necessary for back-up purposes.

The information contained in this manual is governed by the Limited Warranty expressed in the EULA. For additional third party copyright attributions refer the Additional_Copyrights.pdf document present in the <drive>:\Program Files\Mimosa directory. The following are trademarks, or registered trademarks of Mimosa Systems, Inc:

Mimosa

Mimosa NearPoint Mimosa Systems NearPoint

One Pass Protection

NearPoint Deployment Advantage NearPoint for SharePoint

Microsoft®, Windows®, Outlook®, and Entourage®, are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks are the property of their respective owners.

(3)

NearPoint eDiscovery Option User's Guide i

Across every industry, organizations must preserve and produce electronic information for legal proceedings and internal investigations. Government inquiries, criminal and civil proceedings, and financial audits are some activities that can force costly and complicated searches of electronic information. NearPoint eDiscovery facilitates rapid search and discovery of the following types of NearPoint-archived items:

• Email, attachments, PST files, and other Microsoft Exchange items, such as tasks and calendar items

• Files on shared drives (archived using NearPoint for File System Archiving)

• Files from an organization's SharePoint environment (archived using NearPoint for Microsoft SharePoint)

• Email captured from an SMTP server that NearPoint uses as a target for journaling (archived using the NearPoint for File System Archiving EML Ingestion feature)

Auditors, paralegals, and internal or external legal counsel can search quickly through thousands of emails and documents to find and review the ones that are relevant to a legal matter. After the review, they can export the results for further review and analysis by other tools, or deliver them for use by opposing counsel or court-ready production.

(12)

NearPoint eDiscovery Option User's Guide 10 Getting Started

Getting Assistance

Who's Who in NearPoint eDiscovery

The following people use NearPoint eDiscovery in an organization:

The NearPoint Administrator designates one or more users in the NearPoint environment as eDiscovery Administrators and provides an appropriate level of access to archived resources to each. A small organization might have only one eDiscovery Administrator who sets up the environment for all legal staff who participate in eDiscovery. A large organization might have several eDiscovery Administrators, each responsible for eDiscovery operations in a geographical location or one or more departments. See Designate an eDiscovery Administrator.

eDiscovery Administrators set up the eDiscovery environment for users of the NearPoint

eDiscovery client that they administer. This setup includes the following tasks:

• Defining auditor roles, which associate specific users with content sources. Content sources are the locations of archived items from an Exchange environment, an SMTP server that acts as a journaling target1, or files from file shares2 or SharePoint3 hierarchies.

• Assigning case management permissions to users

• Defining universal (system-wide) tags and litigation holds that can be used in all cases These tasks are described in "Set Up the eDiscovery Environment".

eDiscovery Case Managers set up cases, which are virtual containers for information about

the following items:

• names of NearPoint eDiscovery users who work on the case • Permissions assigned to each user in the case

• Content sources that they can search and review for the case • Tags and the holds that they can apply to reviewed items

These tasks are described in "Set Up Cases and Case Folders".

eDiscovery Users work in the context of a case or in the Personal Workspace to perform the

following types of tasks:

• Search for archived content related to a legal matter (see "Search the NearPoint

Archive" on page 15)

• Create review lists of items that they found through the searches (see "Review

Search Results" on page 31)

• Review items and adding tags and holds (see "Review Search Results" on page 31)

• Export reviewed items for legal production or further processing in other legal discovery applications (see "Export Items" on page 39)

• Generate and view reports on eDiscovery activity or tag and hold use (see

"Create and View Reports" on page 41)

(13)

Getting Assistance

1 If the organization uses the EML Ingestion feature of NearPoint for File System Archiving 2 If the organization uses NearPoint for File System Archiving

3 If the organization uses NearPoint for Microsoft SharePoint

New Features in This Release

NearPoint eDiscovery release 4.2 introduces the following new features:

Reports

NearPoint eDiscovery provides reports to aid project management:

• Litigation Hold Report provides both summary information on the number of holds

that reviewers placed on items as well as details about the content that they put on hold. Administrators can select the cases and users to include in the report.

• Tag Report, like the Litigation Hold Report, provides both summary information on the

number of tags that reviewers placed on items as well as details about the tagged content. Administrators can select the cases and users to include in the report.

• Auditor Activity Report summarizes the activity of users who work on a case. It

provides a snapshot of what users work on and the types of tags and litigation holds they apply.

Item Commenting

Users can add comments to reviewed items to provide more information to others who work on the case. Although items might pertain to more than one case, you see the comments related only to the selected case. All users working in a case or case folder can add

comments to an item and see the comments that others add. In the Personal Workspace, you see only comments that you add.

Custodian Hold

This feature enables eDiscovery users to place litigation holds on any content sources to which a custodian has access. Use this feature to preserve the content of entire mailboxes or entire cabinets that NearPoint uses to archive files or SharePoint content. When you apply a custodian hold, you do not need to apply holds to individual items during the review process. You can configure custodian holds and they override the original retention period for

archived items.

(14)

Launch the eDiscovery Client

Hide Duplicate Items

This feature reduces the review workload by displaying a single instance of emails that are exact duplicates in the Results and Review panes of the Search workspace. For example, an email sent to several people appears only once in search results. A user can click Hide

Duplicate Items to see just one or multiple instances of the identical emails. To restore

hidden duplicates, click the Clear Filter button.

Note: This feature is active for email-only searches. NearPoint eDiscovery cannot hide duplicates in mixed email and files search results.

Search Messages by Custom Properties

As part of the advanced search feature, NearPoint eDiscovery users can search for messages based on the data in Outlook custom fields. To do so, a NearPoint administrator first must use the NearPoint Configuration Tool to enable indexing of Outlook custom properties. For more information, see "Enable Search of Outlook Custom Properties".

Launch the eDiscovery Client

To launch the NearPoint eDiscovery client, complete the following steps:

1. Double-click the NearPoint eDiscovery desktop icon, or click Start, and then select

Programs > Mimosa Systems > NearPoint Options > Mimosa eDiscovery.

2. In the authentication dialog box, type your domain and user name in the format domain_name\user_name.

3. Enter your password.

4. (Optional) To have NearPoint eDiscovery save this information for your next log on, enable the Remember User Name and Domain option.

5. Click OK.

(15)

NearPoint eDiscovery Option User's Guide 13 Getting Started Quick Tour

Quick Tour

The NearPoint eDiscovery client console puts the features that you need in one interface.

The permissions that the eDiscovery Administrator grants you determine the features that you see in the client.

The first thing that you see after you open NearPoint eDiscovery is your Home tab, which lists the main functions of the client application. Here you can select a case or case folder to work on, or click Open Personal Workspace (if your eDiscovery administrator has enabled this feature) to review items outside a case context.

(16)

Open a Case

First, to choose a functional area to work in, click one of the space buttons.

The items in the navigation pane, which change according the space button that you select, are

nodes or groups of related items on which you can perform the same kinds of actions. To show

the list of items contained in that node, click the plus sign next to a node.

All information related to a case or case folder or your Personal Workspace view is displayed on a tab. Each tab has a toolbar with features relevant to the current context.

In procedures related to search, review, and export, the pane to the right of the navigation pane is typically called the workspace related to a particular space button, for example, the search workspace.

The content of the workspace varies depending on the features that you use. For example, when you use the Searches workspace, it displays subtabs on which you can define search criteria, view search results, or apply tags and litigation holds as you review individual items.

Open a Case

To open a case, complete the following steps: 1. Launch the eDiscovery client.

The Case Explorer in the right pane lists the cases that the a case manager has assigned to you.

Tip: Move the cursor over the case name to see a brief description of the case. 2. Click the name of the case you want to work on.

The Browse Case Folders list in the right pane displays the case and any case folders that have been assigned to you.

3. In the Browse Case Folders list, double-click a case or case folder. A tab for this case or case folder opens.

(17)

The eDiscovery Option provides powerful search capabilities for quickly finding results based on simple or complex search criteria. You can run searches manually when required, or on a defined schedule.

Perform a Basic Search

Prerequisite: You must have the Create Search permission to perform this task.

A basic search lets you find archived content based on keywords (with or without Boolean and other operators) and date criteria. For email searches, the basic search matches your criteria in the message body, attachments, and header information (Subject, From, To, Cc, and Bcc). To perform a basic search for archived items, complete the following steps:

1. Click the Searches space, if it is not already highlighted.

2. Click Create New Search. The right pane displays the search-related workspace. The Search subtab is selected by default.

3. In the Select Search Option drop-down list, verify that Basic Search is selected (default). 4. Under Content Types, select one or more of the following check boxes:

• Email—Outlook items such as emails, contacts, appointments, and calendar items.

• SharePoint—Documents archived in cabinets created using NearPoint for SharePoint.

• Files—Files archived in cabinets created using NearPoint for File System Archiving.

• SMTP—SMTP-transferred email archived in cabinets using the EML Ingestion feature of

NearPoint for File System Archiving.

5. If you are working in a case or case folder, click Select Content Sources. or

If you are working in the Personal Workspace, complete the following steps:

Chapter 2

SEARCH THE NEARPOINT

(18)

NearPoint eDiscovery Option User's Guide 16 Search the NearPoint Archive

Perform a Basic Search

a. Select an auditor role that grants access to the content sources you must search. The eDiscovery Administrator creates Auditor Roles. Contact your NearPoint eDiscovery administrator for more information about specific roles.

b. Click Select Content Sources. The Define Search Scope dialog box opens and lists the Available Content Sources (sources of archived content that you can search). 6. Scroll down the list of content sources and select the ones you want to search.

Tip: To search only a subset of content sources in a high-level container (for example, selected mailboxes in a mail store), click the Browse button (...) next to a content source name to open the Browse Content Sources dialog box and select only the specific content sources you want to search.

Tips: To select a continuous block of content sources, click the first content source while pressing the Shift key, and then click the last one in a block. Release the Shift key. To select multiple items anywhere in the list, press and hold the Ctrl key, and then click the items. 7. Click Add.

The content sources that you chose are displayed in the Selected Content Sources list. 8. Click Save.

9. From the drop-down list under Keywords and Boolean Terms, select one of the following options:

• Any of these words—to search for items that contain any of the keywords you specify

• All of these words—to search for items that contain every one of the keywords you

specify

Note: To create multi-condition search strings, use the Adv. Boolean Search or Boolean

Search options. For more information, see Use the Query Builder for Boolean

Searches (see "Create a Boolean Search String with the Query Builder" on page 17) or Develop Advanced Search Criteria (on page 47).

10. In the text box, enter one or more keywords or phrases, using the following guidelines:

• Enter multiple keywords or phrases separated by a space.

• Enclose multi-word phrases in quotation marks.

(19)

Create a Boolean Search String with the Query Builder

• Enter a minus sign (-) in front of a word or phrase to exclude results that contain the word or phrase.

Example: With the All of these words option, the search string +"first class

mail" +postage -meter would return results that contain "postage" and "first class mail" but not "meter".

11. In the Date Search section, from the drop-down list in the left field, select one of the following options:

• Today, Yesterday, Last Week, Last two weeks, Last month, Last three months or Last six months—Search for items archived within these periods relative

to the current date.

• Equals—Specify a particular date. Click in the date field to open a calendar, and

then navigate to and click the date of interest.

• After or Before—Search for items dated before or following a specific date.

• In between—Enter a range of dates.

12. If you selected Equals, After, Before or In between: a. Click in the date field to open a calendar.

b. Navigate to and click the date (two dates for the In Between option) of interest. 13. Click Search.

You receive a message on the Results tab that indicates that the search is in progress. The

Results tab lists items that match your search criteria, and the lower pane displays the first

found item.

Create a Boolean Search String with the Query Builder

The Query Builder leads you through the process of creating complex Boolean search strings with correct syntax.

To create a Boolean search string using the Query Builder, complete the following steps: 1. In the Keywords and Boolean Terms drop-down list, select Adv. Boolean Search. 2. Click Query Builder Wizard, a button that appears at the right of this section after you

select the Adv. Boolean Search option. The Query Builder wizard opens.

3. Type a search term in the Search for items that contain field.

(20)

Perform an Advanced Search

5. In the field below the condition name, enter another search term that has the chosen conditional relationship to the first term.

6. Repeat steps 4 and 5 until you have described all the conditions between terms that you want to search for.

The full search query that specifies all conditions for the search is shown at the bottom of the query builder window.

Tip: To delete a condition, click the X button next to it. 7. Click OK.

The advanced Boolean search query string is added in the Text Search Criteria section of the search workspace.

Perform an Advanced Search

Prerequisite: You must have the Create Search permission to perform this procedure. You begin an advanced search the same way as you begin a basic search (see "Perform a Basic Search" on page 15), except that from the Select Search Option drop-down list, you select Advanced Search.

Note: Select Advanced Search before you define any criteria. NearPoint eDiscovery deletes any criteria that you define before you choose the Advanced Search option.

After you select Advanced Search, extra search criteria sections appear. You can use any or all of these sections to define search criteria.

(21)

Email-related Criteria

In Email Items

To specify email-related search criteria, complete the following steps:

1. From the list on the left, select specific Outlook items for which you want to search (for example, messages or contacts), or click All.

2. Under Select email attributes to include in search, choose attributes of the selected email item types. For example, for messages, you can search specific parts such as Subject, Attachments, Body, or All. For calendar items, you can search attributes such as Required, Optional, and Recurrence.

Note: If you select multiple Outlook items, the attributes list shows only those attributes that are common to all the selected items.

3. Under Email Direction, choose one or more of the following options:

• All—Email items sent or received on all internal or external email addresses.

• External Inbound—Email items with an external domain in the From and one or more

internal domain email addresses in the To, Cc, or Bcc fields.

• External Outbound—Email items in which the email address in the From field contains

an internal domain and one or more email addresses in the To, Cc, or Bcc fields contain an external domain.

• Internal—Email items sent from an internal domain email address to one or more

internal domain email addresses.

• Foreign—Email items for which both the senders and recipients are from an outside

organization and have email addresses from external domains. This is typical when PST files are requested from an associated organization and archived by NearPoint.

Advanced Search Criteria: Email

To specify advanced email-related search criteria, complete the following steps: 1. Click Add Search Criteria.

2. From the context menu, choose an email field: From, Create Time, Received Date,

Size, or Custom Properties.

(22)

A row is added to specify a criterion related to the selected field. The following figure shows the rows that are added for each of the email fields.

3. To search using text-based attributes, complete the following steps:

a. Click and choose the way in which the search text that you enter must match the attribute:

Equals—The results must exactly match the search text.

Contains—The search text can occur anywhere in the item attribute.

b. Specify one or more search terms that the attribute must match. 4. For date-based attributes, click and choose a point in time.

5. For size-based attributes, click and choose from Equals, Greater than, Less than or

In between, and then enter a value in kilobytes (KB).

6. For custom properties, select the specific custom property to search for from the drop-down list.

Note: You can specify exclusion criteria the same way as the search criteria. When NearPoint eDiscovery runs a search, each item that matches a specific exclusion criterion is not included in search results.

SharePoint-related Criteria

In SharePoint Items

To specify SharePoint-related search criteria, complete the following steps:

1. From the list on the left, select the SharePoint items (documents, pictures, and so on) that you want to search.

(23)

• Content—The readable text of the file.

• Properties—The metadata information such as owner, and date of creation.

• All—Both content and properties.

3. If you are searching for SharePoint items only, specify the related items to include in results:

• Include Deleted Items and All Versions of Items—Search for items that users

deleted from the archive and all archived versions, including the most recent archived item versions.

• Include Deleted Items—Search for items that users deleted from the archive and most

recent archived item versions.

• Exclude Deleted Items and all Versions of Items—Search for the most recent

archived item versions only.

Note: This option is not available for combined email and SharePoint item searches.

Advanced Search Criteria: SharePoint

To specify advanced SharePoint-related search criteria, complete the following steps: 1. Click Add Search Criteria.

2. From the context menu, choose a SharePoint item attribute: Title, Created By, Modified

By, Creation Date, Modification Date, Content Type or Size.

A row is added to specify a criterion related to the selected field. 3. To search using text-based attributes, complete the following steps:

5. For size-based attributes, click , select from Equals, Greater than, Less than or In

between, and then enter a value in kilobytes (KB).

(24)

Files-related Criteria

In Files Items

To specify file-related search criteria, complete the following steps: 1. From the list on the left, select the file types that you want to search.

2. Under Select file attributes to include in search, select the attributes for which you want to search:

• Content—The readable text of the file.

• Properties—The metadata information such as owner, and date of creation.

3. If you are searching for files only, specify one of the following the items to include in results:

• Include Deleted Items and All Versions of Files—Search for files that users

deleted from the archive and all archived versions, including the most recent archived file versions.

• Include Deleted Items—Search for files that users deleted from the archive and most

recent archived file versions.

• Exclude Deleted Items and all Versions of Files—Search for the most recent

archived file versions only.

Note: This option is not available for combined email and file searches.

Advanced Search Criteria: Files

To specify advanced file-related search criteria, complete the following steps: 1. Click Add Search Criteria.

2. From the context menu, choose a file attribute: Owner, File Name, Size, Creation

Date, Archived On, Modification Date, or Last Accessed Date.

A row is added to specify a criterion related to the selected field. 3. To search using text-based attributes, complete the following steps:

(25)

Note: You can specify exclusion criteria the same way as the search criteria. When NearPoint eDiscovery runs a search, each item that matches a specific exclusion criterion is not included in search results.

SMTP-related Criteria

In SMTP Items

The list on the left shows Email as the only type of SMTP item that can be searched.

• Under Select file attributes to include in search, select the attributes for which you want to search:

• Content—The readable text of the email.

• Properties—The metadata information such as From, and Cc.

Advanced Search Criteria: SMTP

To specify advanced SMTP-related search criteria, complete the following steps: 1. Click Add Search Criteria.

2. From the context menu, choose an email field: Subject, From, Sent Date, or Size. A row is added to specify a criterion related to the selected field.

3. To search using text-based attributes, complete the following steps:

between, and then enter a value in kilobytes (KB).

(26)

eDiscovery Metadata Fields

You can search for tags and litigation holds that reviewers have added using NearPoint eDiscovery.

To select tags, complete the following steps: 1. Click Add Search Criteria > Select Tags. 2. Select one of the following options:

• Any of these tags—One of the selected tags must match

• All of these tags—All the selected tags must match

3. Select the tags that you want to look for.

To select litigation holds, complete the following steps:

1. Click Add Search Criteria > Select Litigation Holds. 2. Select one of the following options:

• Any of these holds—One of the selected litigation holds must match

• All of these holds—All the selected litigation holds must match

3. Select the litigation holds that you want to look for.

Point-in-time Criteria

You can limit the scope for searching to only those items that are present in the archive for selected content sources until a specific or relative point in time. For example, you might want to search for email items that were archived up until one week ago.

To apply point-in-time criteria to your search, select one of the following options:

• Current Time (default)—Search among items that are currently in the archive for the

selected content sources.

• Yesterday—Search among items that were present in the archive for the selected content

sources until yesterday.

• One week ago, Two weeks ago, One month ago, Three months ago, or Six months ago—Search among items that were present in the archive for the selected content

sources until this amount of time before the current date.

• Equal to—Search among items that were present in the archive for the selected content

(27)

Save a Search

Prerequisite: You must have the Save Search permission to perform this procedure.

After you run a search with specific criteria and scope, you can save it as a record of what was discovered for the case. Additionally, you can save it to use as a shortcut to create a similar search in the future, with modifications as required.

To save a search, complete the following steps:

1. Right-click a search in the list in the left pane and, from the context menu, select Save, or select a search from the list, and then click Save Search on the Search tab. The Save Search dialog box opens.

2. Type a name for the search and a brief description that helps you remember its scope and intent.

3. Click OK.

The search appears under My Searches in the navigation pane.

Search within Results

A search can return a large number of items that fit the specified search criteria. You can add more search criteria to narrow the focus within a set of search results. You can save this search as a child object of the original search.

For example, you might search for all emails between User1 to User2. After the search is completed, you save the search as U12_Emails. Now you want to search for emails that contain the word "Holiday". You can perform a search within results operation, and save the search under U12_Emails, as U12_Holiday_Emails.

To search within results, complete the following steps: 1. Click the Search space.

2. In the navigation pane, select the search within which you want to perform a further search. 3. On the toolbar, click Search In Results.

The Search tab displays the criteria used for the original search. 4. Modify the criteria for your search within results, as required. 5. Click Search.

The search runs against the results from the original search.

(28)

Create a New Search from an Existing One

You can save time when you define searches if you reuse search criteria (keywords, item attributes and so on) or search scope (the set of selected search targets) or both from previous searches.

To create a new search from an existing one, complete the following steps: 1. Click the Searches space.

2. From the My Searches list in the navigation pane, select a search that you want to use as the base for a new search.

3. From the Create New Search drop-down list, select one of the following options:

• Copy criteria from existing search—to use the search criteria (search strings and

other criteria) from an existing search.

• Copy scope from existing search—to use the search scope (targets) from an

existing search.

• Copy scope and criteria from existing search—to use both the search criteria

and the scope from an existing search. The Browse Searches dialog box opens.

4. Select the search of interest, and then click OK.

Note: Only top-level parent searches can be selected.

Depending on the option that you select, NearPoint eDiscovery loads the search criteria or scope, or both, from the selected saved search file in the Search tab. The default name of the search is New Search_<number>.

(29)

Work with Scheduled Searches

NearPoint eDiscovery lets you schedule searches to run at set intervals. You also can schedule searches to scan the archive for specific items regularly according to the specified schedule. For example, to search for all items containing the word salary, you could schedule a search for NearPoint eDiscovery to run every Monday at 10:00 a.m. that scans all the assigned content sources for items containing that contain the word salary.

A scheduled search scans items that have been added to a content source since the last search was conducted. The most recent search results are added to a review list.

When you create a scheduled search, you can import criteria from an existing search, or specify new criteria. You can schedule a one-time search or a periodic search. In addition, you can direct NearPoint eDiscovery to apply one or more tags and one litigation hold to the results of a scheduled search.

Create a Scheduled Search

To create a scheduled search, complete the following steps: 1. In the navigation pane, click Scheduled Searches. 2. Click Create New Search.

Tip: As with regular searches, you can Create a New Search from an Existing One (on page 26).

3. Define search criteria as described in Perform a Basic Search (on page 15) or Perform

an Advanced Search (on page 18).

4. Click the Properties tab.

5. (Optional) In the Automated Review Action section, select one or more tags that you want to apply to results returned by this scheduled search.

6. (Optional) From the list of holds, select one hold that you want to apply the results that this scheduled search returns.

7. In the Review List section, click Select Review List. The Select Review List dialog box opens with the Create new review list option selected by default.

8. Complete one of the following steps:

• Type a name and a description of the review list you want to create.

or

• To add the results of the scheduled search to an existing review list, select Use an

existing review list, and choose the review list you want from the list.

9. Click OK.

(30)

• Periodic scanning for newly created content—Select this option to perform the

search at a repeated interval, and specify the frequency by choosing Daily, Weekly or

Monthly. Specify a start date and time.

• One time scanning for historical content—Select this option to run the search only

once. Specify the date and time in the fields below this option. 11. Click Save Search. The Save Search dialog box opens.

12. Type a name and a description for the scheduled search, and then click OK. 13. To view details of the scheduled search, click the Jobs tab.

NearPoint eDiscovery runs the scheduled search according to the schedule and details displayed on the Jobs tab.

14. To see search results, click the Review Lists space, and then, under My Review Lists, select the review list you specified for the scheduled search. The Results tab displays results of the search.

Stop a Scheduled Search

To stop a search, complete the following steps:

1. Click Scheduled Searches > <Search name> in the navigation pane. 2. Click Stop Search. A dialog box opens.

3. To confirm that you want to stop running the search on the defined schedule, click Yes. On the Jobs tab for the selected scheduled search, the status changes to Schedule

Suspended, meaning that NearPoint eDiscovery will no longer run the search according to

the schedule.

Resume a Scheduled Search

You can resume a scheduled search that you suspended. The first scheduled search that eDiscovery runs after you resume the scheduled search scans all items that were added since NearPoint eDiscovery performed the last scheduled search.

To resume a scheduled search, complete the following steps:

1. In the navigation pane, click Scheduled Searches > <Search name>. 2. Click Start Search. A dialog box opens.

3. To confirm that you want to resume running the search on the defined schedule, click Yes. On the Jobs tab for the selected scheduled search, the status changes to Schedule

(31)

Modify a Scheduled Search

To modify a scheduled search, complete the following steps:

1. In the navigation pane, click Scheduled Searches > <Search name>. 2. Click Modify. The Save Search dialog box opens.

3. Edit the name and description of the search, and then click OK.

4. Use the Search and Properties tabs for the selected scheduled search to modify search criteria and schedule details.

5. Click Save Search.

The modified schedule for the search takes effect at the time of the next scheduled search execution.

Delete a Scheduled Search

To delete a scheduled search, complete the following steps:

1. In the navigation pane, click Scheduled Searches > <Search>.

2. Click Delete. You receive a message that prompts you to confirm that you want to delete the selected search.

(32)

(33)

The following sections describe features you can use to examine the results of NearPoint eDiscovery searches.

View the Summary of Search Results

The Search Summary in the search workspace provides information that can help you plan your review effort.

To view the summary of search results, complete the following steps: 1. After you run a search, click the Summary tab.

The tab displays summary information about the search results, including the number and total size (in kilobytes) of each type of item found in each content source.

2. (Optional) Click one of the following buttons on the toolbar to capture the summary search results:

• Print Preview—previews the printed summary report

• Print—prints the summary

• Export to PDF—saves the data to a PDF file

Flag Items for Review

Searches can find items that meet your search criteria but that are not relevant to the legal matter. The Results pane lists search results in the order that they were found. You can preview items and add tags, holds, and comments on both the Results tab and the Review tab. However, if you mark (flag) items to examine more closely on the Results tab, you can use the sorting and other features available only on the Review tab to organize results for a more efficient review. To flag items for review, complete the following steps:

1. To view the list of items found through a search, click the Results tab.

The Results list shows the first batch of search results (up to 100) in a scrollable list. If there are more results, click Next to display the next batch of results.

(34)

NearPoint eDiscovery Option User's Guide 32 Review Search Results

Flag Items for Review

• Create Time For files, the time the file was created on a file server. For email, the time

the email was created in a user mailbox. In most cases, this is the time the recipient received the email but, for email imported from PST files, it might differ from Received Time.

• Received Date Email only. The date and time the message entered the recipient

mailbox.

• Delete Date The date and time at which NearPoint found a newer version of the item.

The time value indicates that this version of item is no longer active but a newer version exists.

• User Delete Date The date and time that NearPoint found that the item no longer exists

in the source mailbox or file share.

• Archived on The time at which NearPoint archived the item.

• Expiry Date The date on which a user-placed retention hold expires. Set only if the

NearPoint administrator configured the Tiered Storage Option (TSO) and items are on a compliance device or the Retention and Classification Option (RCO) is enabled.

2. (Optional) To sort items in the list (alphabetically or in ascending numerical order), click a column heading. Click the column heading again to invert the order.

3. (Optional) To reduce the number of items displayed in the list, apply any of the following filters:

• To view items of a particular type, in the List Filter drop-down list, choose the type of items you want to see. The list displays only items of the selected type.

• In the Item History drop-down list, choose either or both of the following options:

Exclude History—Display only the most recent message in an email thread or the most

recent version of a file.

Exclude Deleted—Display only items that are still present in the content source, not

items that users have deleted.

• To remove all but one instance of email items with identical content, click Hide

Duplicate Items. The filtered list is also displayed in the Review tab.

Note: Sort and filter operations work on the whole list of results, not only on items on the displayed page. The number of total items that match search criteria is displayed above the list.

Tip: Click Clear Filter to view the full results list again.

4. To view the content of an item, click its row in the list. The bottom pane displays the item content.

(35)

Save a Review List

5. (Optional) To view the item in the application in which it was created (where you can see original formatting), click Open.

Note: The appropriate application must be installed on the local computer. 6. (Optional) To print a copy of the selected item, click Print.

7. To flag an item to review, click the flag button in the first column, or click Review Flag >

Apply.

Tip: Click the flag icon in the column heading to select all items in the list.

8. (Optional) Add comments to list items. For more information, see Attach Comments (on page 36).

9. After you flag all the items you want to review, click the Review tab.

All the items you flagged for review are listed on the Review tab. If you used the Hide Duplicate Items feature to hide identical email messages, the Review tab displays the filtered list. On the Review tab, you can sort the results, look at item history (messages only), save a review list, and add tags, comments, and holds.

Save a Review List

You can review flagged items directly in the Review tab, or you can use the following procedure to save a list of flagged items to examine later or to assign to another reviewer. If you created a review list previously, you can also use this procedure to add more items to that review list. To save a review list, complete the following steps:

1. After you flag items on the Results tab, click the Review tab.

2. Click Save Review. The Select Review List dialog box opens with the Create new

review list option selected by default.

3. Complete one of the following steps:

• Type a name and description of the review list you want to create.

or

• To add the flagged items to an existing review list, select Use an existing review

list, and then choose the review list you want from the list.

(36)

Review Items

Use the Review tab in the Search workspace to read the content of items and assess if they are relevant to a case. The features on this tab let you perform the following actions:

• Sort the items in the order that is most relevant to your review focus.

• View related items such as all messages in a particular email thread or all versions of a specific file.

• Apply tags that indicate which items are relevant to a case or how the review team should handle specific items. Tags are created by your eDiscovery administrator or case manager. • Apply litigation holds to ensure that items that are relevant to a case are not deleted from the

archive by users or by a lapsed retention period.

• Attach comments to items to provide additional information for your own use or for other reviewers working on the case.

Populate the Review Tab List

To add items found through searches to the Review tab, complete one of the following steps: • If items that you want to review are in a saved review list, complete the following steps:

a. Click the Review Lists space.

b. In the navigation pane, under My Review Lists, click a review list that you want to work on. The Results tab displays the items in the review list.

c. Flag the items from the review list that you want to review, and then click the Review tab.

Or

• To review items that you flagged in the Results tab, click the Review tab.

The sections that follow describe the actions you can perform on flagged items in the Review tab.

Sort the List

From the Sort By drop-down list, select the order in which you want to list the items. Choose from the following options:

• Title

• Creator

• Size

• Date

(37)

Review Items

Read the Item Content

On the Flagged Items tab, click an item that you want to review. The content of the item is displayed in the Preview tab in the right pane.

See Related Items

To show other email messages in a conversation thread (and the history of the items), or all versions of a file, click Related Items.

Tip: To show the conversation thread across all case content sources, select Across auditees before you click Related Items.

The Related Items tab appears next to the Flagged Items tab. It lists items that are related to the item selected in the Flagged Items tab.

See Distribution List Members

If a selected item was sent to a distribution list, you can find out which other users received the message. To do so, complete the following steps:

1. Click the Distribution Lists tab in the right pane. In the Select Distribution List drop-down list, select a distribution list.

2. Click Display Members. The right pane lists the members.

Note: NearPoint eDiscovery does not display distribution lists created outside your

organization. Distribution List details are only available for messages that were archived with NearPoint version 3.1 or later.

Apply Tags

When you find an item that is relevant to the case, apply an appropriate tag. To apply a tag to an item, complete the following steps:

1. Select an item, and then click Tags > Apply To Selected > <tag name>. You receive a message that confirms that NearPoint eDiscovery applied the tag.

(38)

Apply a Litigation Hold to Custodian Content Sources

Apply Litigation Holds

Apply a litigation hold to an item to ensure that users cannot delete it and it will not be deleted if its retention period expires. To apply a hold to an item, complete the following steps:

1. Select an item, and then click Litigation holds > Apply > <hold name>. You receive a message that confirms that the hold is applied to the item.

2. To close the message, click OK. The Holds and Tags tab in the right pane displays the hold name, the name of the user who applied it, and the date the hold was applied. If you are working in a case context, the Holds and Tags tab also displays holds that other case reviewers added.

Note: This tab lists only holds that reviewers applied to individual items. It does not list holds that you applied to custodian content sources. For more information, see Apply a

Litigation Hold to Custodian Content Sources (on page 36).

Attach Comments

To attach a comment to an item, complete the following steps:

1. Select the item, and then click Add Comments. The Add Comments dialog box opens. 2. In the text box, type your comment, and then click OK. You receive a message that confirms

that the comment was saved.

3. To close the message, click OK. The Comments tab in the right pane displays the comment, the name of the user who applied it, and the date that a reviewer added the comment. If you are working in a case context, the Comments tab also displays comments that other case reviewers added.

Apply a Litigation Hold to Custodian Content Sources

When you review individual case items, you can add litigation holds that override the NearPoint retention policy for the item. For more information, see Review Items (on page 34).

In addition, you can apply litigation holds to all items in a custodian content source at one time. For email, you can apply a hold to an entire mailbox. For files and SharePoint content, you can apply a hold to a NearPoint cabinet that contains the items of interest.

To apply a litigation hold to a custodian content source, complete the following steps: 1. While you are working on a specific case, click the Litigation Holds space. 2. In the My Litigation Holds section of the navigation pane, click Case Holds or

Universal Holds.

(39)

Apply a Litigation Hold to Custodian Content Sources

5. From the list, select the names of custodian content sources to which you want to apply the litigation hold.

6. Click OK. The Details pane displays the list of custodian content sources to which you applied the selected hold.

Items from the custodian content sources to which you applied the hold are retained as specified in the hold.

(40)

(41)

After you review items and find those that are relevant to a legal matter, you can export them to deliver to opposing counsel, to use for court-ready production, or to import into other tools for further review and analysis. The eDiscovery Option lets you export PST files of selected email items or ZIP files of selected files.

To export items from NearPoint eDiscovery, complete the following procedures: 1. Create an Export Container (on page 39)

2. Export and Save Batches of Items (on page 39)

Create an Export Container

To create an export container, complete the following steps: 1. Click the Exports space.

2. In the eDiscovery toolbar, click Create.

3. Type a name and description for the export container. 4. Click OK.

The export container appears in the navigation pane under Exports.

Tip: You can modify the name and description of an export container. To do so, select it, and then click Modify. Similarly, to remove a selected export container, use the Delete action. When you delete a container, all export batches within it are also deleted.

Export and Save Batches of Items

To export and save a batch of items, complete the following steps: 1. Click the Searches space or the Review Lists space. 2. Click Export. The Exports dialog box opens.

3. Select one of the following options:

• Export all results—to have the export batch contain all items listed in the search

results (Searches space) or all items in the review list (Review Lists space).

(42)

NearPoint eDiscovery Option User's Guide 40 Export Items

Export and Save Batches of Items

• Export flagged items only (default)—to have the export batch contain only flagged

items.

4. Under Export details, enter the following information:

• Base Name—Type a name for a base file within the container.

• Save In—From the drop-down list, select an export container.

• Display Name—Type the name to display for the export batch.

• Password—To password protect the exported file, type a password.

• Confirm Password Type the password again.

• Select PST Version—For exported email items, select an Outlook PST file format from

the drop-down list.

5. Under Splitting options, select either or both of the following options:

• Split results by owner—to divide items into separate files based on the owner of the

items.

• Retain Folder Structure (default)—to keep items in the same nested folder structure

that they had in their native environment.

6. (Optional) Enter a value to change the maximum size of the export batches, if desired. Default sizes for exported batches are as follows:

• ZIP files—19,000 MB

• Files only—10 GB

• PST files—2 GB (Outlook 97-2000), 20 GB (Outlook 2003 or later)

• Mixed content:

2 GB, if the content contains PST files for Outlook 97-2000 10 GB, if the content contains PST files for Outlook 2003 or later 7. Click OK. You receive a message that indicates that the export has started.

8. Click the Exports space. The export batch is listed under the selected export container under Exports.

9. Expand the export container to view the export batches that you added to it. If you select an export batch, all PST and ZIP files that you created in the selected batch are listed in the results pane.

10. Click a PST or ZIP file to save it on your local computer.

(43)

The sections that follow explain how to use the NearPoint eDiscovery reporting features.

Prerequisite: To use NearPoint eDiscovery reporting features, you must have the Access

Reports permission.

Generate an Auditor Activity Report

Prerequisite: You must have the Access Reports permission to perform this procedure. To generate an Auditor Activity Report, complete the following steps:

1. In the NearPoint eDiscovery client, click the Home tab.

2. Click Reports. The results pane shows lists of general and case-specific report types. 3. Double-click Auditor Activity Report. The Auditor Activity Report window opens. 4. Under Date, click the calendar buttons in the From Date and To Date boxes and choose

a start and end date for the reporting period.

5. In the lists in the Report Filters section, select the tags or holds, the content sources, and the auditors that you want to include in the report. To choose all items in a list, select the check box at the top of the column.

6. In the Report Filters section, set the scope of reviewers and activities to include in the report. To do so, complete the following steps:

a. In the Auditors list, select the name of each auditor that you want to include in the report.

b. In the Activity Targets list, select each activity target (group of activities) that you want to include. As you select Activity Targets, NearPoint eDiscovery adds corresponding actions to the Activity Types list.

Tip: To choose all items in a list, select the check box at the top of the column.

Chapter 5

CREATE AND VIEW

(44)

NearPoint eDiscovery Option User's Guide 42 Create and View Reports

Generate an Auditor Activity Report

Activity

Target Activity Types

Search Search performed Case

Administration

Case Created, Case Modified, Case Deleted, Renamed a Tag, Deleted a Tag, Shared Tag with Auditors, Renamed a Hold, Deleted a Hold, Shared Hold with Auditors, Case Status Changed, Case Manager Changed

eDiscovery

Search Query Search Query Saved, Renamed a Search Query, Deleted a Search Query Review Lists Saved to a Review List, Renamed a Review, Deleted a

Review Authentication User Login eDiscovery

Administration

Permissions Changed, Role Created, Role Modified, Role Deleted, Universal Tag Created, Universal Tag Modified, Universal Tag Deleted, Universal Hold Created, Universal Hold Modified, Universal Hold Deleted

Exports Files Retrieved, Exported Messages/Files Message View

c. In the Activity Types list, select each activity type that you want to include.

7. Click Run Report. NearPoint eDiscovery generates the report and displays it in the lower portion of the window.

Tip: To view more of the report, click the double arrow in the Parameters heading to collapse the Parameters section.

For information about the content of the report, see Auditor Activity Report Description (on page 43).

How To Use Nearpoint Ediscovery On A Pc Or Macbook

NearPoint eDiscovery Option

CONTENTS

Preface

5

Getting Started

9

Search the NearPoint Archive

15

Review Search Results

31

Export Items

39

Create and View Reports

41

Develop Advanced Search Criteria

47

Troubleshooting eDiscovery

53

Glossary of Terms

59

Index

61

Audience

Product Documentation and Online Help

Typographical Conventions

Getting Assistance

Who's Who in NearPoint eDiscovery

New Features in This Release

Launch the eDiscovery Client

Quick Tour

Open a Case

Perform a Basic Search

Chapter 2

SEARCH THE NEARPOINT

Create a Boolean Search String with the Query Builder

Perform an Advanced Search

Email-related Criteria

SharePoint-related Criteria

Files-related Criteria

SMTP-related Criteria

eDiscovery Metadata Fields

Point-in-time Criteria

Save a Search

Search within Results

Create a New Search from an Existing One

Work with Scheduled Searches

Create a Scheduled Search

Stop a Scheduled Search

Resume a Scheduled Search

Modify a Scheduled Search

Delete a Scheduled Search

View the Summary of Search Results

Flag Items for Review

Save a Review List

Review Items

Populate the Review Tab List

Sort the List

Read the Item Content

See Related Items

See Distribution List Members

Apply Tags

Apply Litigation Holds

Attach Comments

Apply a Litigation Hold to Custodian Content Sources

Create an Export Container

Export and Save Batches of Items

Generate an Auditor Activity Report

Chapter 5

CREATE AND VIEW