Category Archives: Information Access

Remote Collection: The Apple Pay of eDiscovery in a COVID-19 World

By: Craig Carpenter

I often continue doing things just because that’s the way I’ve always done them.  There is a level of comfort that comes from familiarity, and to be honest as I age I realize I can get more set in my ways (as my children often tell me), eschewing new ways of doing things – even if they are quicker or more efficient.  Sometimes it takes a major disruption to force change, as the eDiscovery market saw with accelerated adoption of Predictive Coding in the wake of the Great Recession.  This is true in many industries, including consumer products: witness the accelerated adoption of “contactless payment” like Apple Pay during the COVID-19 pandemic.  It has been available for years, but adopted mainly by younger generations while us old folks clung to credit cards and, in some cases, cash (gasp!).  But COVID-19 has changed this dynamic for many, myself included, as the prospect of touching a credit card machine is now unacceptable.  Whereas using Apple Pay was a ‘nice-to-have’ before COVID-19, it has become a ‘must-have’ now.  This type of resistance to change is arguably even more commonplace in the legal world, where convention and comfort often reign supreme.  How we have been conducting eDiscovery collection for years is a perfect example of clinging to outdated methods – but with the advent of COVID-19, this too is about to change for good.

Collection of digital evidence in legal proceedings was an implicit requirement under the Federal Rules of Civil Procedure (FRCP) long before it was codified explicitly in the 2006 amendments with the addition of Electronically Stored Information (ESI) under amended Rule 34(a)) as a “new” category.  I distinctly remember conducting discovery in 1998 and 1999 as a 3rd year law student and then 1st year associate for a Bay Area law firm: it was the proverbial “banker box” process, with all discovery in paper form.  In those days, even email messages and Word Perfect documents were simply printed out to be Bates stamped and reviewed in hard copy by hand.  Document review has always been tedious, but at least back then the volumes were significantly lower than they are these days.

During this timeframe, however, email and the dissemination of ever-greater volumes of electronic information it facilitated was exploding.  This, of course, meant that evidence (in the forensic context) and relevant information for eDiscovery was increasingly digital in nature.  So when discovery practitioners went looking for tools to help them preserve and collect digital information, where did they turn?  To the forensic world, of course, as the more stringent requirements and processes of criminal proceedings and evidence necessitated the development of such tools earlier than had been needed in civil discovery.  And if a tool was good enough for criminal proceedings, it should be plenty good enough for those in the civil world.  Thus, forensic tools like Guidance’s Encase® and AccessData’s FTK® which were built for law enforcement crossed over into the civil world.

However, the needs of the data collection process for civil discovery were and remain quite different from those of the criminal world:

  • On average civil discovery involves far more “custodians” (owners or stewards of information) than criminal proceedings, e.g. 5-15 custodians in civil matters vs. 1, maybe 2, in criminal
  • Whereas a typical criminal proceeding focuses on the communication media of one or occasionally a few alleged perpetrators (i.e. their cell phone, laptop, social media), civil discovery is typically significantly broader given the greater number of corporation applications and data repositories, including corporate email, file shares, ‘loose files’ (e.g. Word or Excel documents only stored locally), cloud storage repositories like Dropbox or Google Vault
  • Due to the larger number of custodians and typically broader data types to be searched, the volume of information in civil discovery is usually significantly greater than in a criminal proceeding
  • In handling criminal evidence there is a presumption that the alleged perpetrator may have tried to hide, alter or destroy evidence; absent very unusual circumstances, no such presumption exists in civil discovery
  • While confiscation of devices (laptops, desktops, cell phones, records) is the standard in criminal proceedings, the opposite is true in civil discovery. Custodians need their devices so they can do their jobs
  • Collection of evidence in criminal proceedings is handled by law enforcement (e.g. upon arrest or as part of a ‘dawn raid’ type of event), while the parties themselves conduct civil discovery (as a business process typically handled by legal or outsourced to service providers)

These differences were insignificant when data volumes were small and the data was relatively easy to get to, as was the case for many years.  And as the first technology on the market, forensic tools and vendors did a great job of building and defending their incumbency, through certifications, “court-cited workflows” and knowledge bases widely advertising their deep expertise in forensic collection as practiced by a cadre of forensic examiners leveraging their technical abilities into lucrative careers – thereby creating a significant barrier to entry for non-forensic eDiscovery collection tools and practitioners.

In spite of this strong incumbency, almost all corporate legal departments have long wanted a better approach to collection than forensic tools offered; many of their outside counsel have felt similarly.  They have long felt collection using forensic tools and workflows were and remain deeply flawed for eDiscovery in a number of ways:

  • Chronic overcollection: as forensic tools were built to capture all information, including things like slack space which can be important in criminal proceedings but are almost never even in scope in civil matters, the volume of data collected is far greater than needed. While service providers charging hourly professional services time and monthly per-GB hosting fees may not mind, for clients paying to collect/filter/host/review/produce knowingly unnecessary data this makes no sense and adds significant cost to the entire process, each and every time
  • Weeks or months-long process: because forensic tools must process data on a server before searching or culling it, they require physical access to a device (e.g. via a USB port). There is an option to copy entire drives with GBs of data through a VPN connection, but this approach has never worked well, if at all.  Given the coordination needed to gain physical access to devices which may be located in myriad different cities or countries, as well as the need to complete collection before paring down or even searching of data can begin, what should take hours or days instead takes weeks if not months
  • Highly disruptive: as each forensic image is being taken of each laptop or desktop, the user of each such machine must stop whatever they are doing and surrender their machine to the forensic staff for a day or more. Even if there is a spare laptop available, it will often have none of their ‘stuff’ on it.  Needless to say, this highly intrusive process makes each such worker far less productive and is very disruptive
  • “Recreating the wheel” every time: when the next matter arrives, can forensic examiners simply use the data from the last collection? Unfortunately, no, as each custodian has presumably created and received new data, necessitating the whole process from before be repeated.  Forensic collection quite literally recreates the wheel with every collection

By contrast, remote collection is designed specifically for civil eDiscovery.  It is built for a distributed workforce and requires no physical access to any devices.  A small software agent is installed on each device which creates its own local index; legal staff can then simply search this index for whatever ESI they want to find.  This distributed architecture facilitates ‘Pre-Case Assessment’, where search terms are sampled on data in-place, before any ESI is collected.  This turns the forensic collection workflow on its head, as analysis can be done from the very beginning of the preservation/collection process, allowing lawyers to gain insight far earlier in any proceeding and supporting a surgical collection process, leading to far lower data volumes (and therefore much lower eDiscovery costs).  And because remote collection can be an entirely cloud-based process, no hardware or specialized staff is required – in fact, collections can be done without IT ever being involved.

Why hasn’t the industry adopted remote collection before now?  Because everyone involved in the process except the client was benefited from it: forensic experts, service providers and forensic technology providers.  They had a strong incentive to keep things as they had always been, to the client’s detriment.  In a COVID-19 world, however, even these groups must change their workflows as physical access to devices has not only fallen out of favor – it is now impossible and perhaps even dangerous.  What remote employee would want a stranger to come to their home and take their laptop for hours?  That scenario is simply no longer an option.  Similarly to how touching a point-of-sale machine went from a minor inconvenience to a wildly irresponsible and even dangerous activity when Apple Pay is a far better approach, forensic collection in eDiscovery is in the process of giving way to remote collection.  Clients will be much better off for it.

Leave a comment

Filed under Best Practices, collection, Corporations, ESI, Information Access, Preservation & Collection, Uncategorized

X1 Changes the Game in Hybrid Cloud Search with Box Connector

by Barry Murphy

The Enterprise File Sync and Share (EFSS) category is hot right now.  This is not a surprising fact.  In the research document Parting Enterprise Users From Consumer EFSS Solutions Will Be a Challenge, Gartner estimates that, “by 2018, 50% of an enterprise’s data will reside external to the data center.”  EFSS vendors provide enterprises with more structured ways to collaborate and share information both on-premise and in the cloud.  The Gartner document goes on to state that, “an off-premises public cloud implementation of EFSS can help an organization isolate data from its data center and simplify easy sharing of information assets to individuals outside the firewall and located across multiple regions.”  For these reasons, EFSS vendors like Box are growing rapidly and gaining large enterprise customers.

Obviously, if half of an enterprise’s data will reside external to the data center, then half will still live within the data center or locally on users’ machines.  No matter where data is being stored, though, the fact remains that the ability to search that data will be critically important.  Workers still demand unified access to their most important information assets, and they want a highly intuitive search experience with fast-as-you-type search results regardless of where the data lives.  In other words, users require business productivity search.  X1, with the Box connector, provides just that in a way that not only pleases users, but also gives IT a lot of flexibility.

With X1’s Box Connector, users can now add Box accounts as data sources, and search emails, files, SharePoint, and now Box content in a single-pane-of-glass.

Box screenshot

Click to enlarge image

Not only do users get a single interface in which they can search across all of their critical content, but they also get all of the benefits that simply come with X1 – fast-as-you-type search results, full-fidelity document preview, and post-search actions (PSAs).  In the case of Box content, the PSAs are valuable because they are specific to things users would normally do within Box.  For example, directly in the X1 interface, users can elect to send a document as an attachment or as a link.

Click to enlarge image

Click to enlarge image

In addition, users can integrate Box more directly into their personal workflows because X1 will allow a PSA on content from other data sources (e.g. SharePoint) to Box.

This is important, as IT organizations like the flexibility that X1 provides in terms of how users can search Box content.  There is an option to index Box documents and store them in the users local index.  The content is not stored locally, but the index is, so users get immediate results.  Of course, it may not be feasible to have an index stored locally for a variety of reasons, so there is also an option for users to remotely query their Box account without the need to store each item in the local index.  IT also has fine-grained control over how indexing takes place.

Click to enlarge image

Click to enlarge image

Any solution that makes both end-users and IT happy is a promising one.  In this way, X1’s hybrid cloud search capability is a game-changer. As more and more organizations systematically use EFSS vendors like Box, this federated search capability will become even more important.  And, the great news is – it’s available right now from X1.

So far, beta customers are extremely enthusiastic about the search experience that X1 provides for content in Box.  In fact, we strongly believe that no other solution provides this kind of search experience across local and Box content.  Customers tell us that they can search and filter through Box content faster than ever before.  At X1, we would respectfully challenge anyone to identify a better solution for this purpose – neither we nor our many joint X1/Box customers are currently aware of one.

We invite you to try for yourself:

X1 Search is available for sale at $49.95 per license for single users (Box connector included), with an annual support fee of $19.95. Buy now >

Silent installation of the X1 Search client and other enterprise deployment options are available for large-scale deployments. For more information about enterprise licensing and purchases, please contact info@x1.com.

Leave a comment

Filed under Business Productivity Search, Desktop Search, Enterprise Search, Hybrid Search, Information Access

Amazon Re:Invent – With the Cloud, Avoid Mistakes of the Past

Last week, I had the opportunity to attend the Amazon Re:Invent conference in Las Vegas. Over 13,000 people took over the Palazzo for deep dive technical sessions to learn how to harness the power of Amazon Web Services (AWS). reinventThis show had a much different energy than other enterprise software conferences, such as VMworld.  Whereas most conferences feature a great deal of selling and marketing by the host, Amazon Re:Invent was truly more of a training show. Cloud architects spent a lot of time in technical bootcamps learning how AWS works and getting certified as administrators.

That is not to say that there was no selling or marketing going on; the exhibition hall featured myriad vendors that augment or assist with AWS deployments and solutions. The focus on the deep technical details, though, does point out the fact that we are still in the very early days of the cloud. Most of the focus of the keynotes was about getting compute workloads to the cloud – there was not a lot of mention of moving actual data to the cloud, even though that is certainly beginning to happen.  But, that is how the evolution goes. IT departments need to be comfortable moving workloads to the cloud as they begin to leverage the cloud. Building this foundation is also important to Amazon – the goal would be for many companies to completely outsource the IT data center.

It is important, however, to proactive plan for information management as more workloads and, importantly, data move to the cloud.  As the internet first emerged, companies dove into new technologies like email and network file shares only to create eDiscovery nightmares and make it virtually impossible to find information within digital landfills. It is key to learn from those mistakes rather than to repeat them when leveraging cloud-based technologies. In order to ensure both that end-users are happy with search experiences on data in the cloud and that Legal can do what they need to do from an eDiscovery standpoint. This means providing business workers with unified access to email, files, and SharePoint information regardless of where the data lives. It also means giving Legal teams fast search queries and collections. But, Cloud search is slow, as indexes live far from the information. This results in frustrated workers and Legal teams afraid that eDiscovery cannot be completed in time.

If a customer wanted to speed up search, it would have to essentially attach an appliance to a hot-air balloon and send it up to the Cloud provider so that the customer’s index could live on that appliance (or farm of appliances) in the Cloud providers data center, physically near the data. There are many reasons, however, that a Cloud provider would not allow a customer to do that:

  • Long install process
  • Challenging Pre-requisites
  • 3rd party installation concerns
  • Physical access
  • Specific hardware requirements
  • They only scale vertically

The solution to a faster search is a cloud-deployable search application, such as X1 Rapid Discovery. This creates a win-win for Cloud providers and customers alike. As enterprises move more and more information to the Cloud, it will be important to think about workers’ experiences with Cloud systems – and search is one of those user experiences that, if it is a bad one, can really negatively affect a project and cause user revolt. eDiscovery is also a major concern – I’ve worked with organizations that moved data to the cloud before planning how they would handle eDiscovery. That left Legal teams to clean up messes, or more realistically, just deal with the messes. By thinking about these issues before moving data to the cloud, it is possible to avoid these painful occurrences and leverage the cloud without headaches. At X1, we look forward to working closely with Amazon to help customers have the search and eDiscovery solutions they need as more and more data goes to AWS.

Leave a comment

Filed under Cloud Data, eDiscovery & Compliance, Enterprise eDiscovery, Enterprise Search, Hybrid Search, Information Access, Information Governance, Information Management

End-User Computing & Search Go Hand-In-Hand

webinar_works_landing

by Barry Murphy

Last week, John Patzakis here at X1 blogged about the VMworld 2014 event and how it has become the Comdex for enterprise IT.  I was at the show and it was very clear that end-users are the future of IT.  The trend has been talked about for quite some time and is commonly called the consumerization of IT.  The heat around that topic has tended to focus on devices and not as much on what is behind information access on those devices.  But, as BYOD takes off and mobility becomes increasingly important, enterprises care more and more about the flow and availability of information.  Why?  Because easy access to information is critical to the end-user acceptance of enterprise IT offerings; when users cannot quickly find what they are looking for, they reject what IT rolls out to them.  Without that end-user acceptance, there is no chance for a positive ROI on any IT project.

End-user experience is so key that VMware has named a division of its company “End User Computing.”  That EUC unit made several major acquisitions in the last year, including Airwatch and Desktone.  This is because technology providers need to win the battle with end-users.  For an example of a company that built its business on the backs of end-users and leveraged those relationships to bully its way into enterprise IT, look no further than Apple.  As VDI users have learned, it is critical to bake search requirements into virtual desktop deployments from the get-go in order to ensure an optimal user experience.  And, as Brian Katz points out in his blog, the same thing will hold true with mobile – usability will be key.  That is why we at X1 are so excited about the future.  X1’s user interface for search is second to none.  And, users actually rave about it.

In my days as an industry analyst, I rarely had technology users raving about the tools they were using.  And, I never ever had an enterprise search user tell me that their solution solved the challenge of finding information quickly.  The rabid users of X1 have been an eye opener for me.  In fact, an X1 customer recently polled its users and virtually every user said that X1 is easy to learn and use (no easy feat for a piece of enterprise software) and over 70% of users described their experience with X1 as very positive or positive.  Those numbers are unheard of in terms of technology satisfaction.

With what I’ve learned from my days as an analyst and in my time here at X1, I’ve come up with some ways to approach enterprise search in a way that is both IT and user-friendly.  We will share the knowledge in a webinar on October 9 at 1pm ET / 10am PT.  We’ve titled it, “Making Enterprise Search Actually Work by Putting User Experience First.”

In this “no-death-by-PowerPoint” webinar, attendees will not only learn, but actually see how to deploy enterprise search solutions in ways that make both end-users and IT departments happy.  This webinar will demonstrate both why and how to put end-user experience first.   Specifically, attendees will learn:

  • Why the human brain is the best analytical engine for business productivity search
  • How federation can save IT time, money, and headaches
  • How to best deploy search solutions in all IT infrastructures
  • How to achieve ROI on enterprise search in ways never seen in the past
  • That search can be like BASF – it can make many other technology deployments better, including VDI, SharePoint, and Enterprise Vault

I will be presenting on this webinar and will be joined by some special guests to be named later.  Come learn why search and end-user computing go hand-in-hand.

Register for the webinar here >

 

 

Leave a comment

Filed under Enterprise Search, Hybrid Search, Information Access, Information Management

Seeing The Full Picture On Hybrid Cloud

If it seems that a lot has been written about hybrid cloud lately, that’s because there has – it is one of the hottest topics in the technology world, if not the hottest.  hybrid cloudThe hybrid cloud is a combination of a private IT infrastructure and a public cloud.  The public and private cloud infrastructures then communicate over an encrypted connection and can port data and applications back and forth.  Hybrid cloud is hot because it delivers real benefits:  increased speed of access time and reduced latency because of an on-premise, private infrastructure that is accessible directly as opposed to through the internet; more flexibility to have on-premises infrastructure that can support the average workload and to leverage the public cloud when the workload exceeds the power of the private cloud component; and more flexibility in server designs that can lower the costs of storage.

These benefits (there are many more, but the list would be too long) have IT departments excited to leverage hybrid cloud.  As organizations gain experience with hybrid cloud, we are seeing more and more written about it.  Most of what is written focuses on the hard-core IT issues.  Industry blogs often dig deep in the ability to port applications from on-premise to the cloud and back without requiring re-architecting the apps or hitting major bumps in the workload function.  Or, they might be about the ability to migrate server workloads to the cloud.  This is clearly important stuff, but it is only painting half the picture.   No one is talking much about where the information feeding these applications lives, or about how to ensure the information is accessible as needed.

This is why we need to see the full picture on hybrid cloud.  The reality is the information will live all over the place and business workers will need unified access to it, without having to know the location.   We should be talking about hybrid search equally as much as we talk about the other issues related to hybrid cloud. This is because end-user search experience is extremely important to executing successful IT projects.  We have seen this up-close-and-in-person in the VDI market.  Many organizations rolled out virtual desktops to employees and followed the best practice of turning off Windows indexing.  When users went to search for their information, they were unable to do so and revolted.  That is a lose-lose scenario.  The solution, in that case, is X1 Search Virtual Edition – the only search solution that is architected specifically for VDI environments.

The lesson from VDI is simple:  do not forget the business workers that will need to do their jobs (which tends to require finding their important emails and files quickly and efficiently).   Products like X1 Rapid Discovery enable hybrid search that lets IT glean all the benefits of hybrid cloud while ensuring end-users are happy with their ability to find information.  If we learn from that lesson as we venture into the hybrid cloud, we can avoid the nightmares that come when users are less than thrilled with the solutions IT rolls out to them.  If we think about hybrid search now, IT departments embracing hybrid cloud can be heroes to the C-Level executives tracking performance and to the business workers they serve.

 

Leave a comment

Filed under Cloud Data, Hybrid Search, Information Access, Information Governance, Information Management, Virtualized Environment