METHOD AND APPARATUS FOR ELECTRONIC DATA DISCOVERY

[0001] 1. Technical Field

[0002] The invention relates to system integration in electronic data discovery. More particularly, the invention relates to a method and apparatus for communicating and managing automatic electronic data discovery collections and holds from electronic discovery management systems to disparate data sources in a uniform way.

[0003] 2. Description of the Prior Art

[0004] Electronic discovery, also referred to as e-discovery or EDiscovery, concerns discovery in civil litigation, as well as tax, government investigation, and criminal proceedings, which deals with information in electronic form. In this context, electronic form is the representation of information as binary numbers. Electronic information is different from paper information because of its intangible form, volume, transience, and persistence. Also, electronic information is usually accompanied by metadata, which is rarely present in paper information. Electronic discovery poses new challenges and opportunities for attorneys, their clients, technical advisors, and the courts, as electronic information is collected, reviewed, and produced. Electronic discovery is the subject of amendments to the Federal Rules of Civil Procedure which are effective Dec. 1, 2006. In particular, for example, but not by way of limitation, Rules 16 and 26 are of interest to electronic discovery.

[0005] Examples of the types of data included in e-discovery include e-mail, instant messaging chats, Microsoft Office files, accounting databases, CAD/CAM files, Web sites, and any other electronically-stored information which could be relevant evidence in a law suit. Also included in e-discovery is raw data which forensic investigators can review for hidden evidence. The original file format is known as the native format. Litigators may review material from e-discovery in any one or more of several formats, for example, printed paper, native file, or as TIFF images.

[0006] Currently, automatic propagation of collection requests, i.e. the process of collecting the data from data sources, and hold requests, i.e. the process when a data source is instructed to preserve certain data, from electronic discovery management systems to data sources is an emerging area in which standards and best practices have not been established. Current approaches to EDiscovery are expensive due to the repeated manual steps and processes. Also, there is no well established and agreed upon understanding of how automatic propagation of collection and hold requests can be accomplished in a way that is both robust and defensible. For example, evidence may be spoiled due to misuse or overhandling. Further, it is often necessary to repeat discovery due to the poor integrity afforded by current approaches.

[0007] For example, currently collections are performed in the following way:

• • [0008] A collection specialist receives a collection notice, which is a human-readable instruction typically sent by email.
  • [0009] The collection specialist uses a collection tool, such as search engine or forensic evidence collection software, to first search and identify, and then collect relevant content.
  • [0010] Then, the collection specialist can upload the collected content into an electronic discovery management system. Although, more typically, information is stored on a file share or CD/DVD.

[0011] It would be advantageous to remove or minimize human participation in the collection or hold process and to do so in a robust, fast, transparent, and legally defensible manner.

[0012] It would also be advantageous to upload and track all of the information collected in an evidence inventory management system, as well as from data sources to discovery management systems.

[0013] It would also be advantageous to provide a robust and defensible way of communicating electronic discovery collection and hold requests from electronic discovery management systems to data sources, as well as from data sources to discovery management systems.

[0014] The presently preferred embodiment of the invention provides a method and apparatus that removes or minimizes human participation in the collection or hold process, and that does this in a robust, fast, transparent, and legally defensible manner.

[0015] The presently preferred embodiment of the invention also provides a method and apparatus that ensures a robust and defensible way of communicating electronic discovery collection and hold requests from electronic discovery management systems to disparate data sources in a uniform way.

[0030] The presently preferred embodiment of the invention provides a method and apparatus that removes or minimizes human participation in the collection or hold process, and that does this in a robust, fast, transparent, and legally defensible manner.

[0031] The presently preferred embodiment of the invention also provides a method and apparatus that ensures a robust and defensible way of communicating electronic discovery collection and hold requests from electronic discovery management systems to disparate data sources in a uniform way.

[0032] Terms

[0033] For purposes of the discussion herein, the following terms have the meaning associated therewith:

[0034] Electronic Data Discovery (e-discovery or EDiscovery) is discovery of electronically stored evidence in civil litigation, as well as tax, government investigation, and criminal proceedings.

[0035] Data Source. Any information system that contains data relevant for EDiscovery. Examples are: a file system containing individual document files, a content management system, a transactional data driven application, an email server, an email archive, etc.

[0036] Collection. The process of collecting the data from Data Sources.

[0037] Hold (or Hold In Place). The process when a Data Source is instructed to preserve certain data, and to prevent modification or deletion of it.

[0038] EDiscovery Management Application (EMA). A software program responsible for managing Collections and Holds, which communicates collection and hold requests to Data Sources, and which collects content from Data Sources, and which manages an inventory of collected data.

[0039] Automatic Collection/Hold Component Model

[0040] The description below describes a presently preferred architecture for the invention, comprising the following components (see FIG. 1):

[0041] The EMA 11 communicates with the Connector 13 by calling connector Services 12, which may be Web Services, Structured HTTP requests, local or remote procedure calls, etc. For purposes of the discussion herein, the terms “service” and “service request” identify a communication call between the EMA and the Connector. In a practical application of the invention a Service, as described herein, does not necessarily map to a single Web Service because multiple different types of service calls may be wrapped as multiple methods of the same Web Service.

[0042] The Connector performs operations on the Data Source 15 by using whatever interface, i.e. local API 14, is provided by the Data Source.

[0043] The Connector can be an independent piece of software or can be a part of the Data Source or the EMA.

[0044] Communication Model

[0045] There are two major communication models in the presently preferred embodiment of the invention with regard to the direction of communication requests:

• • [0046] Uni-directorial, when all service calls are initiated by the EMA, and the Connector only responds to service calls; and
  • [0047] Bi-directorial, where the Connector can also initiate service calls to the EMA.

[0048] The invention herein disclosed generally applies to both communication models, unless the opposite is specifically noted.

[0049] Uni-Directorial Collection

[0050] The following services are required for uni-directorial collection communication. In particular, reference should be made to FIG. 2, which is an architectural flow diagram showing uni-directorial collection communication, in which process flow proceeds between the EMA 11 and the Connector 13 over time from left to right as indicated by the arrows on each exchange of information represented by a solid or dashed line.

[0051] Configuration service—the EMA requests configuration information from the Connector. Such information may contain query templates, information on a subset of services supported by a connector, information on versions of services supported by a connector, information on preservation capabilities of a Data Source/Connector, and/or information of limitations on a connector implementation, as described below.

[0052] Validation service (optional)—the EMA sends proposed values of query parameters to the Connector, and the Connector validates these parameters and replies with an error description when the parameter values are invalid.

[0053] Collection Request Service—the EMA instructs the Connector to start a collection based upon provided query parameters. The Connector responds with an acknowledgement, collection information, or an error message.

[0054] Collection Request Readiness Service (optional)—the EMA checks whether the Connector is ready with the content to download. The Connector responds with an acknowledgement, collection information, or an error message.

[0055] Collection Reminder Request Service (optional)—the EMA instructs Connector to update an existing collection with newly arrived content. The Connector responds with an acknowledgement, collection information or an error message.

[0056] Collection Reminder Request Readiness Service (optional)—the EMA checks whether the Connector is ready with the content to download. The Connector responds with an acknowledgement, collection information, or an error message.

[0057] Un-staging Service—once the EMA has downloaded collected content, the EMA calls the un-staging service to indicate that the Connector may dispose of transient information needed to perform a collection transaction. The Connector responds with an acknowledgement, completion message, or an error message.

[0058] Un-staging Readiness Service (optional)—the EMA checks whether the Connector finished the un-staging process. The Connector responds with an acknowledgement, completion message, or an error message.

[0059] Services are called in the particular sequence which constitutes a Collection or Hold Transaction. Some service calls are optional, depending upon configuration of the Connector and results of previous calls; details will be apparent from the discussion below.

[0060] Uni-Directorial Hold Transactions

[0061] The following services are required for uni-directorial Hold transactions. In particular, reference should be made to FIG. 3, which is an architectural flow diagram showing uni-directorial hold communication, in which process flow proceeds between the EMA 11 and the Connector 13 over time from left to right as indicated by the arrows on each exchange of information represented by a solid or dashed line.

[0062] Configuration service—as described above.

[0063] Validation service (optional)—as described above.

[0064] Hold Request Service—the EMA instructs the Connector to start a hold based upon provided query parameters. The Connector responds with an acknowledgement, hold information, or an error message.

[0065] Hold Request Readiness Service (optional)—the EMA checks whether the Connector completed performing the hold. The Connector responds with an acknowledgement, hold information, or an error message.

[0066] Hold Reminder Request Service (optional)—the EMA instructs the Connector to update an existing hold with newly arrived content matching query criteria. The Connector responds with an acknowledgement, hold information, or an error message.

[0067] Hold Reminder Request Readiness Service (optional)—the EMA checks whether the Connector completed executing a hold reminder request. The Connector responds with an acknowledgement, hold information, or an error message.

[0068] Hold Release Service—When a hold is not needed any more, the EMA calls this service to indicate that the Connector may release the data on hold. The Connector starts a hold release process and responds with an acknowledgement, completion message, or an error message.

[0069] Hold Release Readiness Service (optional)—the EMA checks whether the Connector finished a hold release process. The Connector responds with an acknowledgement, completion message, or an error message.

[0070] The services are called in a sequence, which constitutes a Hold transaction. Some services are optional.

[0071] Bi-Directorial Collection Transactions

[0072] The following services are required for Bi-directorial collection transactions. In particular, reference should be made to FIG. 4, which is an architectural flow diagram showing bi-directorial collection communication, in which process flow proceeds between the EMA 11 and the Connector 13 over time from left to right as indicated by the arrows on each exchange of information represented by a solid or dashed line.

[0073] Configuration service—as described above.

[0074] Validation service (optional)—as described above.

[0075] Collection Request Service—as described above.

[0076] Collection Status Service (inbound)—the Connector notifies the EMA that collected content is ready for download, that a collection is in progress, or it notifies of an error.

[0077] Collection Reminder Request Service (optional)—as described above.

[0078] Collection Reminder Status Service (inbound)—the Connector notifies the EMA that collected content is ready for download, that a collection is in progress, or it notifies of an error.

[0079] Un-staging Service (optional)—as described above.

[0080] Un-staging Status Service (optional)—the Connector notifies the EMA whether un-staging has been completed, that an error happened during un-staging, or that un-staging is in progress.

[0081] Note that this model allows for both EMA pulling content from the Connector and the Connector pushing content to EMA. Note also that the content which is to be downloaded should not necessarily reside in a Connector. The Connector can stage it in any location accessible by the EMA.

[0082] Bi-Directorial Hold Transactions

[0083] The following services are required for bi-directorial hold transactions. In particular, reference should be made to FIG. 5, which is an architectural flow diagram showing bi-directorial hold communication, in which process flow proceeds between the EMA 11 and the Connector 13 over time from left to right as indicated by the arrows on each exchange of information represented by a solid or dashed line.

[0084] Configuration service—as described above.

[0085] Validation service (optional)—as described above.

[0086] Hold Request Service—as described above.

[0087] Hold Status Service (inbound)—The Connector notifies the EMA that the process of putting content on hold is completed, that it is in progress, or it notifies of an error.

[0088] Hold Reminder Request Service (optional)—as described above.

[0089] Hold Reminder Status Service (inbound)—the Connector notifies the EMA that the process of putting content on hold is completed, that it is in progress, or it notifies of an error.

[0090] Hold Release Service (optional)—as described above.

[0091] Hold. Release Status Service (optional)—the Connector notifies the EMA whether hold release has been completed, that an error happened during hold release, or that a hold release is in progress.

[0092] Note that the variety of services can be reduced, for example, by replacing all readiness services by a single “is operation complete” service, or status services in bi-directorial model can be replaced by a single “Operation Status” inbound service. Also, reminder services can be replaced with “Request” services passing existing Collection/Hold transaction IDs. However, for ease of explanation these are described as separate services. In general, an implementation of a Hold or Collection transaction may deviate from the ones described above, but these models should be used as reference to understand the invention.

[0093] Features of a Presently Preferred Embodiment

[0094] Data type-agnostic Automatic Collection

[0095] Various Data Sources require different sets of query parameters to identify the data targeted for a Collection or Hold. For example, an email archive may require a list of user mailboxes and a date range to produce a collection of emails, whereas a file system may require a root folder and last-modified date to produce files. Moreover, the same Data Source may require different sets of query parameters to produce data of different types, e.g. a Human Resource Management System may produce multiple reports, each requiring its own set of query criteria. Moreover, the same, Data Source may allow multiple sets of query parameters to produce documents of the same type. For example, files can be searched through simple and advanced searches. In these circumstances it becomes important for the EMA to configure itself dynamically, while letting the user fill in query parameters that are relevant to a Data Source chosen for Collection or Hold.

[0096] In the preferred embodiment, this task is solved through a Configuration Service that is available from the Connector and that responds to the EMA with a set of query templates, each template containing a number of query parameters. If there is more than one template, the EMA lets the user choose a query template. After that, the EMA dynamically generates a query parameter input form based upon query parameters specified in the chosen template. Then, the form is submitted to the Connector. In this way, the EMA becomes independent of the data type and query criteria or the Collection (Hold) that it orchestrates.

[0097] Collection/Hold Reuse

[0098] Query criteria filled in by the user when performing the Collection or Hold are saved by the EMA such that the user can search, either manually or automatically, through query criteria of existing Hold and Collection requests when the user needs to perform another hold or collection and determine whether there is a request that fully or partially satisfies the new query criteria.

[0099] Server Side Validation of the Dynamically Generated Collection (Hold) Query

[0100] When the user tries to submit the query to the EMA, the EMA may perform some validation on data in the query. For example, if the query contains a parameter of type “Date range,” the EMA may check whether the start date in the range is earlier than the end date. However, pushing more sophisticated validation logic into the EMA quickly results in a very complex format of the Configuration service, buggy implementations on the EMA and Connector side, and other side effects. Accordingly, in the invention validation information is passed to the EMA, for example, as a part of Query Template. For example, the parameter “Name” may have an attribute “required-true” which indicates that the EMA should check that the user entered a name in the query template form.

[0101] Another limitation of validating queries in the EMA is the inability to validate based on dynamic criteria. For example, it is desirable to make sure that the user typed in an existing mailbox alias, and new mailboxes are added to the archive all the time.

[0102] To avoid these problems, the Connector provides a Validation Service where the Connector receives exactly the same query request as it uses to perform a Collection or Hold, and performs a deep validation of the request parameters, possibly using dynamic data stored inside the data source.

[0103] Eliminating Unnecessary Evidence After Performing the Collection

[0104] During the operation, a Connector could have created copies of data targeted for collection. If these copies survive the Collection transaction, they may become unwanted evidence from the EDiscovery viewpoint, and the user of the Data Source may have a legal obligation to collect or preserve these data in future litigation. To avoid this, one embodiment of the collection method suggests that the Connector disposes of the data staged for a Collection immediately after the content has been collected, once it receives an unstaging call.

[0105] Freezing the Set of Collected Content During a Collection Transaction

[0106] To ensure defensibility, the collection method suggests that all of the data matching query criteria found in the Data Source are preserved during the collection transaction. This can be done in different ways for different types of Data Sources. For example, for a file system Data Source the Connector may copy each file it found matching the query criteria into a special staging area before it proceeds with searching the rest of files so that users cannot delete these files before they are collected by the EMA. For a content management system, the Connector may lock the file it finds to prevent deletion of the file, and unlock the file after the collection is completed.

[0107] Using a Configuration Service to Communicate to the EMA the Subset of a Collection/Hold Transaction Supported by the Connector

[0108] The Connector might not need to support the lowest common denominator set of services needed to complete a Collection or Hold transaction. For example, a Connector to a trading system in an investment bank may dynamically produce a user account status report in real time. Therefore, it does not require un-staging and un-staging readiness services to be implemented. The set of services implemented by the Connector can be communicated by the Connector to the EMA in response to a Configuration Service call so that the EMA does not call un-staging and un-staging readiness services after it completes a file download.

[0109] Collection of Content That Has Previously Been Put on Hold

[0110] A collection transaction may refer to a hold transaction instead of providing its own query parameters. In this way, the Connector collects all of the content that is currently on Hold within a given Hold transaction, or multiple Hold transactions. Optionally, the connector may perform a Hold reminder before responding to the Collection request to make sure that the latest data are put on hold.

[0111] Uni-Directorial/Bi-Directorial Communication Models

[0112] FIG. 6 is an architectural flow diagram that illustrates differences between uni-directorial and bi-directorial communication models according to the invention. FIG. 6 compares two embodiments of the invention, showing the benefit in some cases of implementing the communication model so that all service calls are initiated by EMA. This minimizes network setup work when the Connector resides outside the corporate firewall 60, and thus cannot initiate service calls to an EMA residing inside the firewall.

[0113] Collection Process with Reminders

[0114] FIG. 7 provides two flow charts showing the collection process with reminders (FIG. 7b) and the hold process with reminders (FIG. 7a) according to the invention.

[0115] Hold Reminder Services (FIG. 7a)

[0116] Hold requests can be continuous by nature. This means that if new data matching hold request query criteria has been added to the Data Source after the initial hold request has been executed, this data must be added to the hold. However, for many types of Data Sources it is hard to build a hold Connector that does this automatically. This is why the EMA can be designed so that it calls a Hold Reminder service of the Connector. Each time such service is called, it contains the identifier of the original hold transaction to which it belongs. This allows the connector to re-execute the search in the Data Source and add new data that fits the criteria to the existing hold.

[0117] Thus, the EMA performs the initial hold 70 and waits until it is time for a reminder 71. While waiting, the hold can be cancelled or released 72. Otherwise, the hold reminder is performed 73. Note that query criteria can be either recorded by the Connector during the original Hold Request Call or communicated by the EMA in each Hold Reminder request.

[0118] Collection reminder services (FIG. 7b)

[0119] A collection request can be continuous by nature when it is used for preservation. This means that if new data is added to the data source after the initial collection request has been executed, the new data must be collected by the EMA. However, in the uni-directorial communication model, the Connector cannot communicate newly found content back to the EMA. This is why EMA can be designed so that it calls the Collection Reminder services of the Connector. Each time such service is called it contains the identifier of the original collection transaction to which it belongs. This allows the Connector to re-execute the search in the Data Source and communicate newly found data to the EMA.

[0120] Thus, the EMA performs the initial collection 75 and waits until it is time to issue a reminder 76, while optionally collecting newly arrived content. While waiting, the collection can be cancelled or un-staged 77. Otherwise, the collection reminder is performed 78. Note that query criteria can be either recorded by the Connector during the original Collection Request Call or communicated by the EMA in each Collection Reminder request.

[0121] Asynchronous Handling of a Collection (Hold) Request

[0122] FIG. 8 provides two flow charts showing an asynchronous process in general (FIG. 8a) and use of an Un-Staging process in the collection transaction as a sample (FIG. 8b) according to the invention. Similar logic applies for all asynchronous processes, such as collection requests, hold requests, and hold releases.

[0123] It may take a substantial amount of time for a Connector to find the data that fits the query criteria during a collection or hold request or request reminder service call. It may take time for a connector to un-stage files or release the hold. To avoid communication timeouts, these operations can be performed by the Connector asynchronously. This means that the connector starts the process during the initial service call, e.g. a Collection Request Service call, and returns an acknowledgement in response. The operation readiness can be evaluated by the EMA, either through pinging the connectors for a readiness status, e.g. through a Collection Request Readiness Service call in a uni-directorial communication model, or by the Connector calling back to the EMA when the operation has been completed in a bi-directorial communication model.

[0124] The EMA may allow the Connector to choose whether to respond asynchronously or synchronously to a service request. To achieve this, the response to the request service should be of the same type as the response to the readiness service. For example, for both Collection Request and Collection Request Readiness services the response can be either acknowledgement (“Working on it”), or error (“collection request failed”), or it may be the payload, i.e. a list of collected files their URLs. In this way, fast connectors that do not need an asynchronous model can take advantage of the easier-to-implement synchronous option.

[0125] With regard to FIG. 8a, the EMA-side logic sends a request for an operation and receives an acknowledgement 80. If the operation times outs 81, the operation is cancelled 82. Else, the EMA-side logic waits 83 and then performs a readiness check 84. If the EMA-side logic is ready, the operation is completed 86; else, a determination is made whether the operation has timed out 81, i.e. the actual asynchronous business operation, such as collection or un-staging has timed out, and the process proceeds as discussed above.

[0126] With regard to FIG. 8b, the EMA-side logic sends an unstaging service request and receives an acknowledgement 90. If the operation times out 91, the collection transaction is cancelled 92. Else, the EMA-side logic waits 93 and then sends an un-staging readiness service request, to which it receives a response 94. If the response =“Done” 95, the collection transaction is completed 96; else, a determination is made whether the operation has timed out 91 and the process proceeds as discussed above.

[0127] FIG. 9 is a flowchart showing the logic that supports both synchronous and asynchronous communication, for example during the un-staging process, according to the invention. In FIG. 9, the EMA-side logic sends an unstaging service request and the EMA-side logic waits to receive a response 100. If the Response =“Done” 101, un-staging is completed 102; else, an acknowledgement is needed and the EMA-side logic waits 103. An un-staging readiness service request is sent and the EMA-side logic waits until a response is received 104, and the process continues as above.

[0128] Communication Through On-line Storage

[0129] FIG. 10 is block schematic diagram showing communication through an on-line storage medium, such as Amazon S3, or Nirvanix, according to the invention. In FIG. 10, the exchange of content is through an External On-line content store 113. The Connector may use an On-line data storage to communicate content between the Connector and the EMA. An example of such a storage is S3 hosted by Amazon. This also can be a locally hosted external on-line storage. In FIG. 10, the Connector resides in a first local area network 110 and the EMA resides in a second local area network 111. The Connector and EMA can communicate via a network, such as the Internet 112 with the on-line content store 113.

[0130] Sending Collected Content Directly to the EMA Data Store

[0131] FIG. 11 is a block schematic diagram showing the sending of collected content directly to EMA data store according to the invention. This aspect of the invention allows an import directly to a final location. Instead of transmitting collected content from the Connector to the EMA, the Connector may stage the content directly into the EMA collection repository 121 via a direct path 120 and point the EMA to the content in the repository via a communication with the EMAL 19.

[0132] Connector Limitations

[0133] FIG. 12 is a UI screen shot showing limitations of the connector implementation according to the invention. Some connectors may not fully implement the requirements described in a connector specification. For example, a connector to the file system may not be able to put on Hold the files that have been added and immediately deleted between two subsequent Hold Reminder requests. These limitations can be communicated to the EMA inside the response to a Configuration service and displayed by the EMA to a user so that the user becomes aware of these limitations and can act accordingly. Also, this information may be logged into the collection (hold) audit trail so other parties in litigation are aware of the technological limitations of the Connector.

[0134] UI Prompting for an Unsupported Hold

[0135] FIG. 13 provides two UI screen shots that show two steps (FIGS. 13a and 13b, respectively) in prompting that a hold is not supported, according to the invention. FIG. 13 is thus concerned with that aspect of the invention related to communication and interpretation of Data Source preservation capabilities.

[0136] Data Sources/Connectors can be classified according to their preservation capabilities in the following ways:

• • [0137] Those Data Sources/Connectors that do not need a hold request to preserve data because data is always preserved: Such data sources only require data to be collected for analysis and production purposes, thus their Connectors do not need to support Holds.
  • [0138] Those Data Sources/Connectors that require a hold request to preserve data: These data sources are issued Hold requests once the content needs to be preserved, and Collection requests when the content needs to be produced.
  • [0139] Those Data Sources/Connectors that cannot preserve data in place: Connectors to such Data Sources do not require to support Holds. Data are collected for both preservation and production purposes.

[0140] Connectors inform the EMA about their preservation capabilities through a Configuration Service. Based on this information, the EMA provides the user with proper preservation options. For example, if the user needs to preserve information in the data source that does not support Hold, the EMA may instruct the user to perform a collection for preservation.

[0141] FIG. 13 illustrates this aspect of the invention, where FIG. 13a shows a first step in which the user picks a data source file system which does not support a hold in place. At step 2, shown in FIG. 13b, the EMA does not allow the user to create a hold request, but only allows the creation of a collection request.

[0142] Service Ticket

[0143] FIG. 14 is a screen shot showing a sample. UI for a service ticket according to the invention. This aspect of the invention uses the automatic Collection and Hold infrastructure to communicate to a Technical Support Information System (TSIS) for manual Collections and Holds. Technical Support Information Systems are the systems that issue service tickets to service personnel (see FIG. 14). A ticket constitutes a task.

[0144] Collection and Hold Connectors may be implemented on top of the TSIS so that, once the Collection or Hold request service is called against the Connector, the Connector creates a Ticket in TSIS and fills the Ticket with the information coming from a Request Service.

[0145] Once the Collection or Hold task is executed by the person, the person changes the status of the Ticket, i.e. closes the ticket. This results in Connector changing the state to “Collection (Hold) Completed.” The scenario assumes that the user may not need to use Connector to communicate collected files to EMA. Instead, the user can upload the collected files directly to the EMA. In this scenario, the Connector communicates to the EMA the information that files are uploaded to the EMA, or other content repository, outside the collection transaction so that the EMA does not need to initiate a file download.

[0146] Benefits and Improvements

[0147] When compared to manual collections and holds, automatic collections and holds require the involvement of less personnel and thus provide employee cost savings. Further, when compared to manual collections and holds, automatic collections and holds minimize the chance that collection and hold instructions are misinterpreted during transmission. Increased collection transparency reduces the risk that a mistake made by an employee remains unnoticed during the collection process. Automatic collection and hold transactions also ensure a clear audit trail, thus making the legal hold process more defensible.

[0148] As opposed to collecting documents in an ad-hoc fashion, e.g. using whatever existing protocol is available, the preferred embodiment of the invention allows use of the same collection/hold programming logic across Data Sources that have very different characteristics, such as different latency in document search. This drives down the costs of development and quality assurance on both the EMA and Data Source sides. As opposed to collecting documents in an ad-hoc fashion, the preferred embodiment also guarantees that, once the files are identified for collection, they are collected, thus achieving better defensibility of the collection process.

[0149] The preferred embodiment of the invention allows the EMA to be agnostic to different types of documents that are supposed to be collected and to query parameters that are expected by different data sources, to collect different types of documents. This drives down the cost of the EMA-side implementation. The preferred embodiment also allows the EMA to derive different application logic, depending on different preservation capabilities exposed by a data source. Further, the preferred embodiment allows EMA users to minimize collection costs by re-using existing collections.

[0150] The preferred embodiment of the invention also allows for sophisticated validation of collection/hold request query parameters, thus avoiding wasted time and effort due to a Collection/Hold request failing on a later stage, and thus speeding up the Collection/Hold operation.

[0151] The preferred embodiment allows integration with Ticketing Systems using the same mechanism as integration with automated Data Sources.

[0152] The preferred embodiment also recognizes the continuous nature of a legal hold and provides mechanisms to update the set of documents that are put on hold or the set of documents that are collected for preservation, thus making such an implementation more accurate and defensible.

[0153] The preferred embodiment allows for communication between the EMA and data sources located outside the corporate firewall because it performs all the communication using outbound service calls.

[0154] Finally, but not by way of limitation, the preferred embodiment provides a mechanism for communicating the limitations of a connector implementation to a user who administers the collection.

[0155] Although the invention is described herein with reference to the preferred embodiment, one skilled in the art will readily appreciate that other applications may be substituted for those set forth herein without departing from the spirit and scope of the present invention. Accordingly, the invention should only be limited by the Claims included below.