EMAIL COMMUNICATION ANALYSIS
Embodiments of the present disclosure are directed to a method for processing computer readable electronic files in an investigation in a computer system including a processor coupled to a display and an electronic storage device coupled to the processor. The method includes the processor accessing the electronic files and related data from a data source. The accessed files and related data are culled by the processor based on predetermined filter criteria. The processor stores the remaining files and related data in a third-party data repository and maps a set of electronic files and related data stored in the third-party data repository into a predetermined database schema. The mapped files and related data are analyzed by the processor, which applies a status decision on them. The analyzed electronic files and related data are submitted to a third-party e-discovery processing application based on the applied status decision.
1 . A method of analyzing communications associated with an investigation in a computer system including at least one processor and at least one electronic storage device coupled to the at least one processor comprising:
the at least one processor storing computer readable electronic files and associated data corresponding to communications associated with the investigation in the at least one storage device;
the at least one processor identifying sources and destination address data included in the electronic files and associated data for the communications;
the at least one processor using the electronic files and related data to determine the number and direction of the communications among the source and destination addresses;
the at least one processor graphically representing communications by establishing a node for each of the source and destination addresses and extending lines between the nodes to represent a number and direction of communications between addresses associated with the nodes; and
employing the graphical representation to identify previously unknown witnesses or depositories of data that should be considered in the investigation.
2 . The method of claim 1 wherein:
for each communication, the at least one processor fills a communications table with data from each communication wherein each destination address receives a separate entry in the table and the table includes the source address corresponding to each destination address; and
the at least one processor retrieves data from the communications table to create the graphical representation.
3 . The method of claim 1 wherein the investigation includes a discovery request.
4 . The method of claim 1 wherein a plurality of addresses are mapped to a single communication party represented as a single node in the graphical representation.
5 . The method of claim 4 wherein the plurality of addresses mapped to a single communication party correspond to communicators in a department or entity.
6 . The method of claim 1 wherein the destination addresses include addresses designated as to, cc and bcc addresses when the communication includes e-mail communications.
7 . The method of claim 1 wherein a thickness of each line corresponds to the number of communications between addresses associated with the nodes of each line.
8 . The method of claim 1 wherein the color density of each line corresponds to the number of communications between addresses associated with the nodes of each line.
9 . The method of claim 1 wherein clicking in the line in the graphical representation causes the at least one processor to display communications represented by the click line.
10 . A computer system for analyzing communications associated with an investigation comprising:
at least one processor;
at least one electronic storage device coupled to the at least one processor; and
at least one display coupled to the at least one processor, wherein:
the at least one processor stores computer readable electronic files and associated data corresponding to communications associated with the investigation in the at least one storage device;
the at least one processor identifies source and destination address data included in the electronic files and associated data for the communications;
the at least one processor uses the electronic files and related data to determine the number and direction of the communications among the source and destination addresses;
the at least one processor graphically represents communications on the display by establishing a node for each of the source and destination addresses and extends lines between the nodes to represent a number and direction of communications between the addresses associated with the nodes; and
the at least one display displays the graphical representation to identify previously unknown witnesses or depositories of data that should be considered in the investigation.
11 . The system of claim 10 wherein the at least one processor fills a communications table with data from each communication wherein each destination address receives a separate entry in the table and the table includes the source address corresponding to each destination address; and
the at least one processor retrieves data from the table to create the graphical representation.
12 . The system of claim 10 wherein the investigation includes a discovery request.
13 . The system of claim 10 wherein a plurality of addresses are mapped to a single communication party represented as a single node on the graphical representation.
14 . The system of claim 13 wherein the plurality of addresses mapped to a single communication party correspond to addresses of communicators in a department or entity.
15 . The system of claim 10 wherein the destination addresses include to, cc and bcc addresses when the communications include e-mail communications.
16 . The system of claim 10 wherein the thickness of the lines corresponds to the number of communications between addresses associated with the nodes of the lines.
17 . The system of claim 10 wherein the color density of the lines corresponds to the number of communications between addresses associated with the nodes of the lines.
18 . The system of claim 10 wherein clicking on a line in the graphical representation causes the at least one processor to display on the at least one display communications represented by the clicked line.