ORGANIZATION BASED ON HASH VALUES
Embodiments of the present disclosure are directed to a method for processing computer readable electronic files in an investigation in a computer system including a processor coupled to a display and an electronic storage device coupled to the processor. The method includes the processor accessing the electronic files and related data from a data source. The accessed files and related data are culled by the processor based on predetermined filter criteria. The processor stores the remaining files and related data in a third-party data repository and maps a set of electronic files and related data stored in the third-party data repository into a predetermined database schema. The mapped files and related data are analyzed by the processor, which applies a status decision on them. The analyzed electronic files and related data are submitted to a third-party e-discovery processing application based on the applied status decision.
1 . A method of eliminating electronic files irrelevant to an investigation in a computer system including at least one processor and at least one electronic storage device coupled to the at least one processor comprising:
the at least one processor receiving a list of hash values for a plurality of computer readable electronic files which are not relevant to the investigation;
the at least one processor storing in the at least one electronic storage device all hash values with predetermined digits in common with other hash values in the list of hash values in tables, wherein the number of predetermined digits is between one and less than all of the digits in the hash values;
the at least one processor receiving a hash value of an electronic file;
the at least one processor identifying the table including the hash values having the predetermined digits in common with the received hash value;
the at least one processor searching for the received hash value in the identified table stored in the at least one electronic storage device;
the at least one processor determining the electronic file associated with the received hash value is irrelevant to the investigation if the hash value is found among the hash values in the identified table; and
the at least one processor generating a log of the irrelevant electronic files.
2 . The method of claim 1 wherein the hash values are MD5 values.
3 . The method of claim 1 wherein the predetermined digits are the first two hexadecimal digits of the hash values.
4 . The method of claim 1 further comprising:
the at least one processor repeatedly retrieving an updated list of hash values for a plurality of computer readable electronic files which are not relevant to the investigation;
the at least one processor searching the existing list for each hash value in the updated list;
the at least one processor adding those hash values from the updated list not previously in the existing list.
5 . The method of claim 1 wherein the investigation includes a discovery request.
6 . The method of claim 1 further comprising the at least one processor determining the electronic file associated with the received hash value is relevant to the investigation if the hash value is not found among the hash values in the identified table.
7 . A computer system for eliminating electronic files irrelevant to an investigation comprising:
at least one processor; and
at least one electronic storage device coupled with the at least one processor, wherein:
the at least one processor receives a list of hash values for a plurality of computer readable electronic files which are not relevant to the investigation;
the at least processor stores in the at least one electronic storage device all hash values with predetermined digits in common with other hash values in the list of hash values in tables,
wherein the number of predetermined digits is between one and all of the digits in the hash values;
the at least one processor receives a hash value of an electronic file;
the at least one processor identifies the table including the hash values having the predetermined digits in common with the received hash value;
the at least one processor searches for the received hash value in the identified table stored in the at least one electronic storage device;
the at least one processor determines the electronic file associated with the received hash value is irrelevant to the investigation if the hash value is found among the hash values in the identified table; and
the at least one processor generates a log of the irrelevant electronic files.
8 . The system of claim 7 wherein the hash values are MD5 values.
9 . The system of claim 7 wherein the predetermined digits are the first two hexadecimal digits of the hash values.
10 . The system of claim 7 wherein at least one processor:
repeatedly receives a list of hash values for a plurality of computer readable electronic files which are not relevant to the investigation;
searches the existing list of hash values for hash values in the updated list which are not in the existing list; and
adds those hash values not previously in the existing list to the existing list.
11 . The system of claim 7 wherein the investigation includes a discovery request.
12 . The system of claim 7 wherein the at least one processor determines that the electronic file associated with the received hash value is relevant to the investigation if the hash value is not found among the hash values in the identified table.