BlueStar CS, as a certified partner of Deepdive, offers our expertise in identification and collection of electronically stored information (ESI).

In recent years, the courts and clients have been setting higher standards and expectations for information gathering for legal counsel. It’s been said that a requesting party ought to be able to obtain discoverable material from an electronic source to the same extent as from a file cabinet. At the first hint of litigation, relevant documents need to be located and protected from spoliation. Yet the methods of eDiscovery in use today are too often disruptive, expensive, and slow.

To reduce their liability and comply with regulations, most corporations have policies about where certain documents should be stored. In practice, though, employees don’t always follow policies and may save an important document almost anywhere. The key documents you need could be accidentally copied to a laptop, backed up to an external drive, or even forgotten on a file server that the IT department doesn’t even know exists. By the time a matter is subject to litigation, no one may know where all relevant documents are located, if they ever did in the first place. It’s no surprise, then, if you rely on the faulty memories of employees or the advice of IT staff, your discovery process may come up short.

Wouldn’t it be nice, then, if you had a tool that would automatically discover all potential sources of data on a corporate network, did it quickly and unobtrusively, and allowed you to narrow your search to what’s truly relevant. Finding more relevant documents in a shorter period of time not only increases your chance of success in the courtroom, but also leads to higher client satisfaction.

One of the key features of the Deepdive Discovery appliance that distinguishes it from other eDiscovery tools on the market today is its ability, through patent-pending technology, to automatically detect which laptops, workstations, and file servers are connected to a network, so that potential storage locations for relevant documents can be quickly identified and targeted for search. The appliance was designed to be operated as independently as possible by a single user or small team with little or no IT support. Once properly configured, the appliance will map an entire network within a few minutes and produce a report showing all networked workstations and servers it discovered.

Housed in a mini-tower and weighing just 24 pounds, the Deepdive Discovery appliance is a portable device that can be carried in, quickly installed, and then removed when the discovery process is complete. It doesn’t need to be located in a server room and can be connected anywhere convenient on the target network through a 10/100 Ethernet port. The appliance is “headless;” that is, it has no monitor or keyboard. It can be managed entirely over the network from any PC or laptop with a standard browser. Initial network configuration uses Wizards and is no more complicated than setting up a home router.

Since no two networks are exactly alike, the Deepdive Discovery appliance uses several different techniques for scanning a network and locating file shares. It can be used in both Windows-compatible domains and workgroups, and the network discovery process will cross network segments if security policies and router configurations permit. The appliance does not join the domain itself and remains invisible to network browsing by Windows users on the network.

If a DHCP server is available, the appliance can obtain WINS and DNS server addresses from the DHCP server.For compatibility with older operating systems, it will use NetBIOS-over-TCP/IP (port 137/139) to locate file shares, and for more recent operating systems, raw SMB over TCP/IP (port 445). If available, the appliance will also use Active Directory or other LDAP-compatible directory services to located network resources.

As a result, the Deepdive appliance will routinely discover all Windows-compatible workstations and servers (Windows 9x/NT/2000/XP/2003) on a local network segment. It will also discover file shares on Linux, Unix, and other servers that support the platform-independent CIFS (Common Internet File Systems) protocol. Depending on the network configuration, servers using NFS, Netware, or other protocols may be also discovered and appear on reports, although the appliance won’t be able to access their file shares.

Once the network discovery process is complete, the Deepdive Discovery appliance will list all workstations and servers it has identified and whether credentials (i.e. user name and password) are required for access. Some file shares that are publicly accessible will appear immediately under the names of the machines where they are located, but most machines and their file shares on corporate networks are password protected.

In a Windows domain, the domain or enterprise administrator account has access, by default, to all the machines on the domain, but certain machines may require a different set of credentials. In a workgroup, there is no central directory and each machine may have its own administrator password. In any case, the appliance generates a network report that you can use for reference to obtain whatever additional credentials needed. Once you have the proper credentials, you can re-run the network discovery and it will identify all accessible file shares (i.e. directories) on the network. You can then select the machines and file shares that you wish to investigate further.

The Deepdive Discovery appliance offers Group and User security, so that you can establish different levels of access for individual users of the appliance or groups of users. Recognizing that some information in an organization may be highly sensitive, you may wish to restrict the ability to access certain machines or file shares to specific individuals, while allowing the rest of your team to access the bulk of the information on the network.

Once you have selected the machines and file shares that you want to investigate further, the next step is to generate an index of the files. Normally, you wouldn’t want to index all the files available, since the vast majority, such as application programs, will be irrelevant to your investigation. Indexing more files than are needed also takes much longer than needed and consumes disk space. Therefore, the appliance provides tools to narrow your search to just the types of documents (e.g., text files, spreadsheets, etc.) that may be of interest.

The appliance can index several machines at once. No software or agent is loaded onto a machine to index it, but it does need to remain connected to the network. Indexing consumes very little network bandwidth, and generally, users will not notice when there machine is being indexed. Nevertheless, you can schedule indexing to run after hours or at off-peak times to avoid any interference or appearance of interference with normal business operations.

Once the index is created, it is possible to search hundreds of thousands of documents, including attachments embedded within Outlook mail archives, within seconds. The Deepdive Discovery appliance includes an embedded version of popular search engine, DTSearch, and supports are wide variety of basic and complex search types that will meet even the most demanding discovery applications.

Search results enable you to learn the location of a document, examine metadata, and even read the contents without altering the document itself. If you wish, you can also open a copy of the file in its native format or copy it to another location. While viewing the search results, an “area of interest field” allows you to tag a specific machine, directory, or file for further study. Both search results and “areas of interest” can be captured in separate reports that may be saved to HTML files or in a CVS (comma-delimited) format that can be viewed in Excel and many other applications.

A Deepdive Discovery appliance can be used alone or in combination with other eDiscovery tools in your arsenal. The appliance even has a SOAP API, so that it can integrate easily with other tools and services over the network. Once relevant documents are located, you can choose the process to preserve the documents that is most prudent and fits your needs, whether that is imaging drives or copying the documents to another location. The time you save by using the Deepdive Discovery appliance will leave more time for preparing your case and achieving your client’s goals in court.