Profile scanner

1. A method for identifying users of personal computers within a network for the purposes of associating the personal computers with custodians in an electronic discovery, comprising:

accessing, by a computing device processor, the personal computers via the network;

querying, by a computing device processor, a profile list stored on each personal computer for user-identifying data, wherein the user-identifying data includes (1) one or more network user identifications, each network user identification associated with a user of the personal computer, and (2) log-on data associated with each personal computer including a last date and time each user logged on to the personal computer and a number of log on occurrences for each user over a predetermined period of time;

transmitting, via the network, for each personal computer, computer-identifying data associated with the personal computer and the user-identifying data associated with one or more users of the personal computer;

determining, by a computing device processor, one or more matches between the network user identifications and custodian entries in a custodian directory; and

in response to determining the one or more matches, linking, by a computing device processor, (1) the computer-identifying data of the personal computer associated with the matched network user identification and (2) the log-on data associated with the matched network user identification to the matched custodian entry in the custodian directory.

2. The method of claim 1 , wherein linking the computer-identifying data further comprises adding the computer-identifying data to the matched custodian entry in the custodian directory.

3. The method of claim 1 , wherein querying the profile list comprises reading, by a computing device processor, a registry key list.

4. The method of claim 1 , wherein the computer-identifying data comprises a computer name.

5. The method of claim 1 , wherein the computer-identifying data comprises an IP address.

6. The method of claim 1 , wherein querying the profile list further comprises reading, by a computing device processor, a registry key list stored on the personal computer, wherein the registry key list comprises at least one registry key.

7. The method of claim 6 , wherein the user-identifying data comprises at least a portion of one of the registry keys in the registry key list.

8. The method of claim 1 , further comprising:

presenting, by a computing device processor, the computer-identifying data to an electronic discovery manager upon an identification of at least one of the one or more users as a subject for electronic discovery.

9. The method of claim 1 , wherein the user-identifying data is transmitted in conjunction with the transmission of the computer-identifying data.

10. A method for identifying users of personal computers within a network for the purposes of associating the personal computers with custodians in an electronic discovery system, comprising:

installing, by a computing device processor, on the personal computers, a tool configured to identify and transmit, to a database server, computer-identifying data and user-identifying data associated with one or more users of a personal computer, wherein the user-identifying data includes (1) one or more network user identifications, each network user identification associated with a user of the personal computer, and (2) log-on data associated with each personal computer including a last date and time each user logged on to the personal computer and a number of log on occurrences for each user over a predetermined period of time;

accessing, by a computing device processor, a preexisting custodian directory comprising data relating to the custodians;

locating, by a computing device processor, in the directory a custodian entry that comprises data matching the user-identifying data of one of the users; and

based on location of the custodian entry, automatically linking, by a computing device processor, (1) the computer-identifying data (1) the log-on data associated with the custodian to the custodian entry.

11. The method of claim 10 , wherein the tool is configured to transmit the computer-identifying data and the user-identifying data every time a user logs on to a personal computer.

12. The method of claim 10 , wherein the user-identifying data comprises a network user identification.

13. The method of claim 10 , wherein the computer-identifying data comprises a computer name.

14. The method of claim 10 , wherein the computer-identifying data comprises an IP address.

15. The method of claim 10 , wherein linking the computer-identifying data to the custodian entry further comprises recording, by a computing device processor, the computer-identifying data in the custodian entry.

16. The method of claim 10 , further comprising:

storing, in computing device memory, the computer-identifying data in a database configured to be in communication with the directory.

17. The method of claim 10 , further comprising:

presenting, by a computing device processor, the computer-identifying data to an electronic discovery manager upon an identification of the user as a subject for electronic discovery.

18. A system for identifying users of personal computers within a network for the purposes of associating the personal computers with custodians in an electronic discovery system, comprising:

a plurality of personal computers;

an electronic discovery management server including a memory and a processor in communication with the memory;

a profile scanning tool stored in the memory, executable by the processor and configured to:

scan the personal computers,

query a profile list stored on the personal computer for user-identifying data,

wherein the user-identifying data includes (1) network user identification associated with a user and (2) log-on data associated with each personal computer including a last date and time each user logged on to the personal computer and a number of log on occurrences for each user over a predetermined period of time, and

initiate transmission of computer-identifying data associated with the personal computer and the user-identifying data associated with one or more users of the personal computer; and

a database server in network communication with the plurality of personal computers and configured to receive the computer-identifying data and the user-identifying data from the plurality of personal computers and store the computer-identifying data in a database,

wherein one of the electronic discovery management server or the database server is further configured to determine one or more matches between the network user identifications and custodian entries in a custodian directory and, in response to determining the one or more matches, linking (1) the computer-identifying data of the personal computer associated with the matched network user identification and (2) the log-on data associated with the matched network user identification to the matched custodian entry in the custodian directory.

19. A computer program product for maintaining a custodian management system in for the purposes of performing electronic discovery in an enterprise environment, the computer program product comprising a non-transitory computer readable medium having computer readable program instructions stored therein, wherein said computer readable program instructions comprise:

first instructions configured for accessing the personal computers via a network;

second instructions configured for querying a profile list stored on each personal computer for user-identifying data, wherein the user-identifying data includes (1) one or more network user identifications, each network user identification associated with a user of the personal computer, and (2) log-on data associated with each personal computer including a last date and time each user logged on to the personal computer and a number of log on occurrences for each user over a predetermined period of time;

third instructions configured for transmitting, for each personal computer, computer-identifying data associated with the personal computer and the user-identifying data associated with one or more users of the personal computer;

fourth instructions configured for determining one or more matches between the network user identifications and custodian entries in a custodian directory; and

fifth instructions configured for, in response to determining the one or more matches, linking (1) the computer-identifying data of the personal computer associated with the matched network user identification and (2) the log-on data associated with the matched network user identification to the matched custodian entry in the custodian directory.