INTAKE UTILITY
Embodiments of the present disclosure are directed to a method for processing computer readable electronic files in an investigation in a computer system including a processor coupled to a display and an electronic storage device coupled to the processor. The method includes the processor accessing the electronic files and related data from a data source. The accessed files and related data are culled by the processor based on predetermined filter criteria. The processor stores the remaining files and related data in a third-party data repository and maps a set of electronic files and related data stored in the third-party data repository into a predetermined database schema. The mapped files and related data are analyzed by the processor, which applies a status decision on them. The analyzed electronic files and related data are submitted to a third-party e-discovery processing application based on the applied status decision.
1 . A method of eliminating electronic files irrelevant to an investigation in a computer system including at least one processor and at least one electronic storage device coupled to the at least one processor comprising:
the at least one processor receiving a collection of unprocessed, electronic, computer readable files and storing the electronic files in the at least one storage device;
the at least one processor retrieving each electronic file from the at least one storage device and determining file system information from the file, the at least one processor storing the file system information in the at least one storage device in association with the file;
the at least one processor determining a hash value of each electronic file;
the at least one processor receiving search criterion including one or more of file system date range, file type, file path, or whether the hash value can be found in a list of hash values for electronic files know to be irrelevant to the investigation;
the at least one processor comparing each electronic file and/or the associated file system information to the received search criterion to determine the files that meet the search criterion as a positive result;
the at least one processor, when the hash value is selected as one of the search criterion, determining whether the hash value is not on the list of hash values as a positive result; and
the at least one processor providing the electronic files with positive results to an e-discovery application provided on the computer system and populating an electronic file with identifying information concerning those electronic files not resulting in a positive result.
2 . The method of claim 1 wherein the list of hash values known to be irrelevant includes hash values from the National Software Library compiled by the National Institute of Standards and Technology.
3 . The method of claim 1 wherein the file type indicates a format of electronic files.
4 . The method of claim 1 wherein the file path indicates a location from which an electronic file was obtained.
5 . The method of claim 4 wherein the search criterion produces a positive result when the electronic file is from a specified file path.
6 . The method of claim 4 wherein the search criterion produces a positive result when the electronic file is not from a specified file path.
7 . The method of claim 1 wherein the investigation includes a discovery request.
8 . The method of claim 1 further comprising:
the at least one processor receiving the list of hash values for electronic files known to be irrelevant;
at least one processor storing in the at least one storage device all hash values with predetermined digits in common with other hash values in the list of hash values in tables, wherein the number of predetermined digits is between one and less than all of the digits in the hash values;
the at least one processor receiving the hash value of each electronic file;
at least one processor identifying the table including the hash values having the predetermined digits in common with the received hash value;
at least one processor searching for the received hash value in the identified table stored in the at least one electronic storage device;
the at least one processor determining a positive result when the received hash value is not in the identified table; and
the at least one processor not indicating a positive result when the at least one processor determines that the received hash value is in the identified table.
9 . A system of eliminating electronic files irrelevant to an investigation comprising:
at least one processor; and
at least one electronic storage device coupled to the at least one processor, wherein:
the at least one processor receives a collection of unprocessed, electronic, computer readable files and stores the electronic files in the at least storage device,
the at least one processor retrieves each electronic file from the at least one storage device and determines file system information from the file, the at least one processor storing the file system information in the at least one storage device in association with the file,
the at least one processor determines a hash value of each electronic file,
the at least one processor receives search criterion including one or more of file system date range, file type, file path, or whether the hash value can be found in a list of hash values for electronic files know to be irrelevant to the investigation,
the at least one processor compares each electronic file and/or the associated file system information to the received search criterion to determine the files that meet the search criterion as a positive result,
at least one processor, when the hash value is selected as one of the search criterion, determines whether the hash value is not on the list of hash values as a positive result, and
at least one processor provides the electronic files with positive results to an e-discovery application provided on the computer system and populates an electronic file with identifying information concerning those electronic files not resulting in a positive result.
10 . The system of claim 9 wherein the list of hash values known to be irrelevant includes hash values from the National Software Reference Library compiled by the National Institute of Standards and Technology.
11 . The system of claim 9 wherein the file type indicates a format of a file.
12 . The system of claim 9 wherein the file path indicates a location from which an electronic file was obtained.
13 . The system of claim 12 wherein the search criterion produces a positive result when the electronic file is from the specified file path.
14 . The system of claim 12 wherein the search criterion produces a positive result when the electronic file is not from the specified file path.
15 . The system of claim 9 wherein the investigation includes a discovery request.
16 . The system of claim 9 wherein:
at least one processor receives the list of values for electronic files known to be irrelevant to the investigation;
the at least one processor stores in at least one electronic storage device all hash values with predetermined digits in common with other hash values in the list of hash values in tables, wherein the number of predetermined digits is between one and less than all of the digits in the hash values;
the at least one processor receives a hash value of an electronic file;
the at least one processor identifies the table including the hash values having the predetermined digits in common with the received hash values;
the at least one processor searches for the received hash value in the identified table stored in the at least one electronic storage device;
the at least one processor determines a positive result when the received hash value is not in the identified table; and
the at least one processor does not indicate a positive result when the at least one processor determines that the received hash value is in the identified table.