Tag Archives: eDJ Group

April 16, 2014 · 11:59 AM

Social Discovery Requires An Investigative Platform

by Barry Murphy

Recent cases, such as the one John Patzakis blogged about last week and the case in Michigan where Facebook content led to the arrest of child-beaters, have put social discovery squarely in the spotlight.  While there are those in the industry that still think of social media as being a fringe element in the eDiscovery world, the evidence suggests otherwise.  The fact is that social media content is an integral part of business life.  eDJ Group research from last fall shows that 63% of eDJ’s survey respondents use external social media such as Twitter, LinkedIn, or Facebook for business purposes.

eDJ data on social media usage

Click on image to enlarge

In fact, usage of social media for business is growing and it will soon catch up to (and probably surpass) email.  We all know what happened with discovery of email – the inability to efficiently collect it practically created the eDiscovery industry.  Reinforcing the fact that social discovery has arrived are the sales numbers for X1’s social discovery product – which continue to grow exponentially – and word from service providers that they are doing Facebook collections thirty times per week.  I believe that social discovery is poised to become a big market in and of itself.

The challenge with social media – unlike email – is that much of the data resides outside the walls of an organization.  Collection of social media becomes a challenge.  Companies cannot simply call Facebook or Twitter and request all of the information for various custodians.  It is possible to take screenshots of various web pages or social media sits, but as John’s blog points out, screenshots are not necessarily admissible as evidence.  Plus, screenshots take a technical toll on eDiscovery – they can be difficult to index and may require OCR, which still may not be able to pull text out of the image.  Companies could write API connections to the social media publishers themselves, but that requires a ton of labor to not only build those connectors, but also to manage the almost weekly updates to the publishers’ APIs.  Instead, companies should look for an investigative platform.

A social media investigative platform will include:

  • Tight API connections to the major social media publishers like Facebook, LinkedIn, Twitter, and Instagram.  The API connection allows for the capture of unique metadata that each publisher adds to its data.
  • A web crawler and capture capability that creates a copy of the page to be stored for processing into a preservation repository.
  • The ability to keep data forensically sound. This requires calculating MD5 hash values of individual items upon capture and maintaining those values through export. The platform must keep logs and reports of all actions on data.  It also must be able to use metadata to establish chain of custody and authentication.

One of the points eDJ Group makes in its “Collection of Preservation of Social Media” report is to “[p]lan for more and more social media.  While companies can focus near-term efforts on the major publishers (Facebook, LinkedIn, Twitter), over time there will be more and more sources of social media for companies to govern.  The number of users of other social networks like Google+ and Tumblr continues to increase.  More and more companies share video content via YouTube.  And, just imagine the rich evidence that a site like FourSquare (which allows users to check in with their geographic location) could provide.”  Social discovery is here to stay and the stakes are getting higher.  The time to act and build the capability is now, not a year from now when you are already behind the eight-ball – that will only create the same situation we created by getting behind the curve with email.

Learn more about X1 Social Discovery here >

 

Leave a comment

Filed under Preservation & Collection, Social Media Investigations, Social Media Metadata

Tagged as , , , , , , , , , , , , , ,

April 8, 2014 · 8:50 AM

Cloud Search: Not As Simple As You Think

By Barry Murphy

Corporations and Government agencies are moving data to the Cloud in droves.  No matter which analyst firm you look to on Cloud storage adoption, you will find consistent results:

  • Forrester Research reports that 40% of enterprises surveyed indicated they have already rolled out workloads on public clouds or have near-term plans to do so and that the number will increase to 50% this year.
  • IDC predicts that from 2013–2017 public IT cloud services will have a compound annual growth rate (CAGR) of 23.5%, five times that of the IT industry as a whole.
  • Gartner says Cloud Computing Will Become the Bulk of New IT Spend by 2016 and that spending on public Cloud services will have a CAGR of 17.7% from 2011 – 2016, with spending on Infrastructure-as-a-Service (IaaS) itself will have a CAGR of 41.3% in that time period.
  • In eDJ Group’s recent Cloud services adoption fast poll, Greg Buckles found that less than 5% of respondents reported that all information is kept on-premise on company infrastructure and cloud services are not being actively considered.

Cloud-icon_magnifying-glassNo matter where data is being stored, though, the fact remains that the ability to search that data will be critically important.  Workers still demand unified access to email, files, and SharePoint information, and they want fast-as-you-type search results regardless of where the data lives.  In addition, Legal teams require that search queries and collections execute within specific time-frames.  But, Cloud search is slow, as indexes live far from the information.  This results in frustrated workers and Legal teams afraid that eDiscovery cannot be completed in time.

Lest you think this is not a big deal, consider the following story.  When I was at eDJ, we worked with a very large enterprise client that wanted to move its collaboration system to the Cloud.  The problem was that the Cloud system the client was contracting with could not meet the Legal Department’s requirements for speed of query results and collection.  This significantly slowed down the movement to the Cloud until the client had worked with the Cloud vendor to ensure that search and collection could execute at the necessary speeds.  The delay frustrated an IT team anxious to reap the promised benefits of the Cloud and cost the project team significant man-hours.

This story highlights the need to granularly define search and eDiscovery requirements before moving data to the Cloud.  Most “cloud search” solutions pass queries through connectors, and then the Cloud vendor needs to figure out where in its vast data center the index lives, find the content, return the query result, and then the customer will need to download all the content.  The result is a slow search and another copy of the data downloaded on premise, which basically defeats the purpose of moving to the Cloud in the first place.

If a customer wanted to speed up search, it would have to essentially attach an appliance to a hot-air balloon and send it up to the Cloud provider so that the customer’s index could live on that appliance (or farm of appliances) in the Cloud providers data center, physically near the data.  There are many reasons, however, that a Cloud provider would not allow a customer to do that:

  • Long install process
  • Challenging pre-requisites
  • 3rd party installation concerns
  • Physical access
  • Specific hardware requirements
  • They only scale vertically

The solution to a faster search is a cloud-deployable search application, such as X1 Rapid Discovery.  This creates a win-win for Cloud providers and customers alike.  As enterprises move more and more information to the Cloud, it will be important to think about workers’ experiences with Cloud systems – and search is one of those user experiences that, if it is a bad one, can really negatively affect a project and cause user revolt.

 

2 Comments

Filed under Cloud Data, Enterprise eDiscovery, Enterprise Search, Information Access, Virtualized Environment

Tagged as , , , , , , , , , ,

March 11, 2014 · 8:51 AM

X1 First To Offer Social Discovery Certification

by Barry Murphy

Education, training, and certification programs are foundational elements of any profession.  When it comes to relatively new functions like social media discovery, the importance of good training and certification options is amplified.  There is a dearth of expertise coupled with the need for corporations and law firms to address challenges quickly – that combination creates an immediate need for formal and effective training.

The activities within the eDiscovery profession tend to be specialized.  For example, forensic disk imaging requires a specific skill set that is very different from the skill set required to run predictive coding review workflows and projects.  As a result, generic eDiscovery certifications have yet to gain mainstream traction in a meaningful way.  This is not to say such programs are not valuable; they are.  However, given the lack of a standards board or independent third-party that has published a treatise on what it means to be qualified to perform “eDiscovery,” it is difficult for any one certification to be an industry standard.  Further, the eDiscovery profession is a sum of many tasks, most of which are performed by various team members (as opposed to one person being responsible for, or capable of performing, all).  What I hear from eDiscovery professionals when it comes to certification is that there is simply not enough definition as to what it means to be a certified eDiscovery professional.

One type of certification that is more important than ever is vendor-specific (or tool-specific) certification.  Previous eDJ Group research had validated the fact that training and education programs are critically important for the practice of eDiscovery.

Vendor certifications

Click on image to enlarge

For years, it has been critically important that forensic investigators be certified on the tools they use – such as Guidance Software’s Encase (EnCE, EnCEP) or AccessData’s FTK (ACE).  Likewise, the Relativity Certified Administrator credential (RCA) from kCura has gained significance in the hosting and review market.  As such, upon joining X1, I was very pleased to hear that the company will offer certification for our X1 Social Discovery tool.  Why is certification for the Social Discovery tool so important?  First, social media is now ingrained in our business lives.  eDJ Group research from September 2013 shows that almost two-thirds of workers now use external social networks like Facebook or LinkedIn for business purposes.

Social Media Part of Business

Click on image to enlarge

Second, social discovery is still fairly new and requires in-depth training.  With X1 Social Discovery, users need to understand how MD5 hash values of individual items are calculated upon capture and maintained through export. They need to understand the automated logging and reports that are generated. They need to be educated on the key metadata unique to social media & web streams that are captured through deep integration with APIs provided by the sites and how this metadata is important to establishing chain of custody and authentication.  Given these new challenges, a certification program just makes sense.  Even better, X1’s Social Discovery tool will be the only one on the market with a certification program in place.  That will be an important distinction in the market, especially given the large amount of law enforcement customers for the product (doing things by the book is extremely critical in law enforcement investigations).

The X1 Social Discovery Certification course, offered by DigitalShield, will cover:

  • Introduction to the foundational skills and knowledge needed to understand social media collection, analysis, review and delivery
  • Best practices for locating and collecting social media
  • Providing investigators, digital forensic examiners and eDiscovery practitioners with the technical skills to use X1 Social Discovery
  • Hands-on training using X1 Social Discovery to collect, manage, and analyze data from Twitter, YouTube, Facebook, webmail and websites

To sign up for the training or to learn more, click here >  

______________________________________________________________________

1 Comment

Filed under Social Media Investigations, Training and Certification

Tagged as , , , , , , , , , , , , , , , ,