Transcription
The Clearwell E-Discovery Platform v7.1.2 - Product Review GuideClearwell provides a single product for the identification, collection, processing, analysis, review, and production phases ofe-discovery that dramatically reduces the cost, time, and complexity of e-discovery. Whether deployed within thecorporation or hosted by a Clearwell certified service provider, the Clearwell E-Discovery Platform:1. Enables IT or Legal teams to easily identify and collect from all critical data sources in a forensically sound manner2. Accelerates document processing, allowing users to gain immediate visibility into case facts and estimate the sizeand cost of e-discovery3. Brings a new level of transparency to e-discovery search, enabling a more collaborative and defensible process4. Delivers interactive analysis and culling capabilities to prune large datasets to much smaller, more relevant ones5. Enables a flexible end-to-end e-discovery workflow, from identification and collection to review and production,eliminating the costly movement of data across multiple, disparate tools6. Provides comprehensive case management, auditing, and reporting capabilities, enabling users to monitor caseprogress in real-time across the entire e-discovery lifecycleThis document can be used to guide you through the Clearwell E-Discovery Platform’s various capabilities. Workingthrough the guide’s suggested workflow will provide reviewers with a good sense of the typical e-discovery process usingClearwell. The guide uses a fictional case, SEC v Tamas Corp., in which you are the Director of E-Discovery, Scott Miller,in order to demonstrate this workflow.As you know, every case is different and there are several features and capabilities not covered throughout the guide.We encourage users to go through the workflow described in this guide first and then explore the application in moredetail. 2012 Symantec. Confidential1 of 47Symantec eDiscovery Lab Guide
Clearwell within the EDRMThe Clearwell E-Discovery Platform is available as an easy to administer physical or virtual appliance that is up andrunning quickly with minimal IT resources. Since the product’s web-based interface is extremely intuitive and user-friendly,most attorneys, litigation support professionals, and IT / security teams are productive immediately with minimal training.As an end-to-end e-discovery solution, it allows users to streamline their entire e-discovery process from identification &collection through review & production with a single product. The following instructions will guide you through a typical ediscovery workflow, beginning with identification and working all the way through production.Figure 1: Clearwell provides a single, integrated platform for end-to-end e-discovery, from identification through production. 2012 Symantec. Confidential2 of 47Symantec eDiscovery Lab Guide
Case Overview: SEC v Tamas Corp.You are Scott Miller, working for the Tamas Corporation as Director of E-Discovery. Mike Tamas, DavidCarter, Phil Smith, and Sally Burton are key employees with the Tamas Corporation and are alleged by theSEC to be involved in an accounting scheme that resulted in falsified 2008 earnings. Your team hasdecided to target approximately 20 key custodians and is looking for documents created in 2005 andforward stored a variety of different sources.For this lab, the data has already been collected using Clearwell Collection modules and added to the case ready forprocessing.Throughout the guide, you will:1. Audit the new collection to ensure that it is complete and all necessary data is available2. Perform intelligent culling to quickly identify and remove non-relevant documents3. Utilize Clearwell’s Transparent Search for keyword searching generation of defensible search reports4. Analyze email Discussion Threads to help perform an early case assessment5. Utilize term analysis to understand additional keywords relevant to the case6. Use an integrated review module to rapidly review and redact relevant documents7. Produce a responsive document8. Review produced documents before sending them to opposing counsel 2012 Symantec. Confidential3 of 47Symantec eDiscovery Lab Guide
Getting StartedClearwell’s web-based platform makes accessing the Clearwell appliance and your case data easy from anywhere. Inthis section you will: Log into the Clearwell appliance 2012 Symantec. Confidential4 of 47Symantec eDiscovery Lab Guide
Login to the Clearwell E-Discovery PlatformFirst, access the Clearwell application using your web browser. Login using User “clearwell” and password “clearwell”.The application is provided as a web-based solution for which administrators assign users with appropriate accesscontrol rights. Users can login anywhere that has a secure Internet connectionSummary of Benefits: Enables effective collaboration between IT, litigation support professionals, and inside andoutside counsel.1. Enter Clearwell2. Enter Clearwell and clickLog In 2012 Symantec. Confidential5 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionPre-ProcessingThe Clearwell Pre-Processing Module provides you with a holistic view of all collected Electronically Stored Information(ESI) prior to processing. You can filter case data and audit the collection phase, thereby reducing data volumes andlowering the risk of sanctions. Furthermore, understanding total data volumes allows legal teams to better estimate thecost and duration of downstream e-discovery phases. In this section you will: Analyze a new data collection and determine exactly how much data will be sent down-stream forprocessing and review in order to provide accurate case budget and timeline estimates Filter unnecessary file types from the collection in order to reduce downstream costs Audit a new data collection to ensure that all required data is available thereby avoiding sanctions 2012 Symantec. Confidential6 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionAnalyze the New CollectionYou’ll notice that Collection 3 has yet to be processed based on the Progress meter (0%). Select this collection toanalyze and audit it before processing. Clearwell supports more than 400 files types including Guidance LEF (L01) andE01 files.Summary of Value: Provides ability to quickly check the status of processing jobs and directly access evidence files.1. Click on PreProcessing Options 2012 Symantec. Confidential7 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionAnalyze the New CollectionNow, isolate Collection 3 and optimize the viewing range.2. Select Relative from theData Axis drop-down menu1. Click none to deselect all thecollections. Then,checking the boxSales Managers toisolate collection 3 2012 Symantec. Confidential3. Expand the ProcessingOptions pane by clicking onthe separation line anddragging it down8 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionFilter by File TypeHere you will filter the data prior to processing by Date Range, Size, or File Type to reduce downstream data volumes.You have determined that .ppt and multimedia files are not relevant to the case, so you want to eliminate them beforeprocessing. The graph below shows the effects of various processing actions and stages and provides the total datavolume to be processed.Summary of Value: Allows users to reduce data before processing, saving processing costs. Additionally, Clearwell’spre-processing statistics show you exactly how much data will be processed, which is instrumental in estimatingdownstream e-discovery costs and developing case budget and timelines. 2012 Symantec. Confidential9 of 47Symantec eDiscovery Lab Guide
Identification-CollectionAmount Data volume after uncompression (extractingcompressed files suchas .zips)1. De-selectMicrosoft PowerPoint and AllMultimedia Files(sound andvideo) to excludethem fromprocessing-Review-ProductionData volume after deNISTing (removal ofsystem-generated files)Data volume after applyingprocessing filters3. Note that theamount of data to beprocessed should be740.4 MBFinal data volume tobe processed. Thiswill be used toestimate downstreamcosts and timeline2. Click Apply 2012 Symantec. Confidential10 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionAnalyze the New CollectionYou can analyze the new collection using various graphs such as Summary, Document Type, Custodian, andTimeline.1. Select different graphoptions using the Analysisdrop-down menu. Finishby selecting Timeline 2012 Symantec. Confidential11 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionAudit the New CollectionFor this collection, you’ve asked IT to collect data from December 2004 to December 2008. Using Timeline analyticsyou can verify that data has been collected over that range. However, when you zero-in on David Carter’s collectionyou can identify that 4 months of data is missing – good catch! This issue can now be addressed at the beginning of thecase.Summary of Benefits: Ensures that there are no data “time gaps” and that sanctions are avoided.1. De-Select SalesManagers. Thenclick on the icon toexpand “Carter,David”. Then selectall for “Carter,David”4. Click on Search &Analysis to navigate tonext functional areaThe grey arearepresents dataexcluded fromprocessing options. Theyellow represents dataselected for processing.3. Scroll to the right tofind the timegapbetween 4/07 and 8/072. Select All Dates insteadof Dates with Data in theShow Drop-down Menu 2012 Symantec. Confidential12 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionProcessingThe Clearwell E-Discovery Platform intelligently filters and processes case datasets in hours instead of days. As aresult, you can analyze relevant case data sooner and gain insight into case facts almost immediately. 3-5X faster processing than competitors Comprehensive de-duplication across all case documents Automated processing, eliminating manual effortFor the purposes of this review we will not actually process the documents. They have been processedahead of time. 2012 Symantec. Confidential13 of 47Symantec eDiscovery Lab Guide
AnalysisThe Clearwell E-Discovery Platform reduces downstream review workload by enabling users to rapidly search and culldown case datasets to only the relevant data—typically 10-20% of the original case dataset. As a result, you review onlywhat is relevant. During Processing, the Clearwell Platform performs additional analysis on the case data to power aunique set of analysis features. These features allow users to “slice-and-dice” case data in dozens of different ways touncover case facts and review information in context. In this section you will: Perform intelligent culling to quickly identify and remove non-relevant documents Utilize Clearwell Transparent Search for targeted keyword searching Generation a defensible search report detailing keyword searches and refinements Analyze email Discussion Threads to perform early case assessment Utilize term analysis to understand additional keywords that might be relevant to the case 2012 Symantec. Confidential14 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionSearch & Cull-Down - Perform a Search for All Case DocumentsFirst, pull up the view of all case documents.Click Go 2012 Symantec. Confidential15 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionPerform Intelligent CullingThe search metrics towards the top of the screen reveal that there are 14,102 documents in this case. Our usersregularly use the Clearwell E-Discovery Platform for cases with 1M-10M documents. First, use Clearwell’s Auto-Filters toexplore the case and look for ways to cull non-relevant documents. A great place to start is often in identifying irrelevantemail. Irrelevant email messages generate false positives during keyword searching so it is beneficial to identify and cullthem out upfront. For this case you will remove all email coming from irrelevant domains.1. Click the Sender Domain arrow to expand the list ofsender domains2. Click the none link to de-select all domains3. Which email domains look like obvious spam senders?Select wsj.com, espn.com, ebay.com, itunes.com,amazon.com4. Click the Apply Filters button to only return email fromthe selected non-relevant domains 2012 Symantec. Confidential16 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionBulk Tag Non-Relevant DocumentsNote the updated search counts after filtering for just the non-relevant domains. Approximately half of the casedocuments consist of email from irrelevant domains. You will now bulk tag these emails as Not Relevant. By clickingthe Detail button, you can review the content of the email to confirm that it is irrelevant.Summary of Value: Bulk tagging irrelevant documents at the beginning of the process allows you to significantly reducethe number of irrelevant documents sent downstream to review, drastically reducing the overall cost of e-discovery.1. Click Actions and select Tag 2012 Symantec. Confidential17 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-Production2. Select Tag only the document parents – chooseNext.3. The sample screen allows you to select a randomsample of documents – typically for Quality Controlchecks. 2012 Symantec. Confidential18 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-Production4. Expand Early CaseAssessment and selectNot Relevant – Check.Then click Next.5. The Confirm screen provides a summary of selections.Click Finish to perform the tag operation. 2012 Symantec. Confidential19 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionPerform a Basic Keyword SearchNote the updated search counts. Next, you will perform Basic Keyword Searching against the untagged documents.You are interested in finding documents related to falsified earnings. But you need to make sure you find all relatedword variations (falsify, falsification, falsifies, earning, earnings, etc). As a result, you will initially perform a wildcardsearch for fals* AND earn*.1. In the Search field, enter the followingexactly as it appears (case sensitive):fals* AND earn*2. Click Go 2012 Symantec. Confidential20 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionEvaluate the ResultsYou’ll notice 997 documents were returned for the search query false* AND earn*. Examine the first few results andconfirm that there are some false positives (files that do not relate to falsified earnings) included in the results2. In order to refine these results usingTransparent Search, click the AdvanceSearch button1. Click Detail to expand the contentof the message or file. Notice thatsearch terms are highlighted in theemail and in any attachments. Alsonotice that the content does not relateto falsified earnings (Dale Earnhardt isnot part of this investigation), i.e. it is afalse positive 2012 Symantec. Confidential21 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionPerform Transparent Keyword SearchingNow you will use Clearwell’s Transparent Search to conduct the same search. Transparent Search allows you to: Preview search hits to eliminate false positives before searching. Efficiently sample search results to determine relevancy of terms and support defensibility of the search process.(Not demonstrated in this workflow) Generate a defensible search report documenting all aspects of the search. Perform multiple searches simultaneously, saving significant time during search and during review of searchresults. (Not demonstrated in this workflow)First, you will use Search Preview to identify wildcard hits within the dataset and select relevant term variations only. 2012 Symantec. Confidential22 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-Production1. Click the Search Preview icon to preview thesearch term matches before re-executing thesearch 2012 Symantec. Confidential23 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionPerform Search PreviewThe Search Preview window displays all of the wildcard matches exactly as they exist in this case along withcorresponding hit counts for emails and files. This will allow you to zero in on the intended variations and eliminate asignificant amount of terms that would have returned false positives and identify relevant case facts more rapidly.1. Click the top checkbox to de-select all Variations2. Scroll down in the list and check only falsification,falsifications, falsified, falsify, falsifying, falsity3. Drop down this selection and select earn* 2012 Symantec. Confidential24 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionPerform Search Preview1. Click the top checkbox to de-select all Variations2. Scroll down in the list and check only earning,earnings (price[month]-co , earnings, earningsat-ris, earnings-at-risk, earnings-enhancing,earnings.xls, earnings- 363. Click the OK button 2012 Symantec. Confidential25 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionPerform the Keyword SearchYou selected only 14 of 47 possible term variations. The Search Preview allowed us to exclude 33 terms that wouldhave generated a significant number of false positives.Summary of Value: Reduces the downstream review volume, lowering the total cost of e-discovery. Also enablesusers to more rapidly identify pertinent documents, thereby accelerating early case assessments.Now, perform the search.1. Click the Run Search button 2012 Symantec. Confidential26 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionEvaluate Transparent Search ResultsNotice that there are 79 documents returned after using Transparent Search, as opposed to the 997 documentsreturned using basic keyword search. Also, notice the term falsified earnings now appearing in the first document.Nice work using transparent search to rapidly identify the relevant evidence! After this, you will view the automaticallygenerated Search Report.Summary of Value: Transparent Search reduces false positives – in this case there was a 91% reduction in the numberof potentially relevant documents to review, significantly reducing downstream review costs. Transparent search alsoallowed you to quickly identify relevant documents, which accelerates early case assessments.1. Notice the reduceddocument account andrelevant keyword hits 2012 Symantec. Confidential2. Click the Report linkto generate a searchreport based on thesearch queries andresults27 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionGenerate a Search ReportOnce you’ve completed your Transparent Search, you will generate a search report. Clearwell provides a search reportbased on all of the search queries, refinements, and their results. The report can be exported so you will share this withyour outside counsel and you’ll be bringing a copy of this report to the Meet & Confer.Summary of Value: Automatic reporting proves invaluable in bolstering the defensibility of your search process.3. Click 79 Documents link to navigateback to the search results1. Click Show Keyword Detail toexpand the detail for each searchquery2. Examine the detail. Along withdetailed counts, this report includes theterm variations that wereincluded/excluded using SearchPreview. 2012 Symantec. Confidential28 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionBulk Tag Responsive DocumentsOnce you are back in the search results view, you will tag the 79 documents as Potentially Responsive. You will usethe same workflow used when bulk tagging the not relevant documents before. You’ll ask your outside counsel toreview and redact all the documents tagged here.1. Click the word Tag to reveal tagging options.2. Click Potentially Responsive then click Check3. Select the radio button for 100 % of documents4. Click the Apply button 2012 Symantec. Confidential29 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-Production1. Choose Tag only thedocument parents.2. Click on Tags. This showsyou can skip the sample sectionif you wish.3. Expand early caseassessment and choosepotentially responsiveClick Next.4. Check the summary then clickFinish. 2012 Symantec. Confidential30 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionPerform Discussion Thread AnalysisClearwell provides a variety of features to perform deep analysis of case documents. These features allow users toestablish timelines and chains of events, uncover additional key custodians, and identify important keywords.Read through the content of the first document in the list. “Wall Street Earnings numbers”!?! - it looks awfully suspiciousand deserves some additional analysis.1. Click the Detail link to viewthe contents of the email2. Read through the content of the first email in thelist with the subject Wall Street EarningsNumbers3. Click the Discussion (15) link. This means thisemail is part of an email thread with 15 emails. 2012 Symantec. Confidential31 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionPerform Thread AnalysisDuring processing, Clearwell identifies email threads across emails, files, and custodians and then graphicallyrepresents the thread timeline. This email thread was started by Phil Smith. He initially sent the email to Bernie, Jenny,Robert, and Matt and each of those people took action by forwarding/replying to the email. This allows you to determinewho knew what, and when.Summary of Value: Viewing a visual thread makes it easy for you to develop a chronology of actions and identifycustodians involved and how they relate to one another. This is extremely valuable when conducting early caseassessments and when trying to identify all relevant custodians in a case.1. Examine the individuals in the thread tree.This gives us insight into other importantcustodians that are involved2. Hover over a Mike Tamas to see all emailaliases associated with this custodian3. Click on a few of the names in the discussionthread to examine their correspondences in thisdiscussion 2012 Symantec. Confidential32 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionPerform Term AnalysisDuring processing, Clearwell’s Term Analysis extracts key terms and phrases from documents and then presents themchronologically. You’ve just uncovered the secret project name “Project Football”, unraveling a whole trail of evidence.Summary of Value: Helps uncover code words or secret project names that weren’t previously considered for keywordsearching.1. Click the Terms tab andreview the list of terms.Which term in the list seemssuspiciously out of place?2. Click the arrow next to theterm project footballpayment to expand thesnippet view.This is a code phrase theexecutives were using tohide their activity. 2012 Symantec. Confidential33 of 47Symantec eDiscovery Lab Guide
ReviewThe Clearwell Review Module is designed to accelerate the document review process, improve reviewer consistency,and support a flexible e-discovery workflow. The Review Module supports native review and does not require priorconversion of documents to TIFF. In this section you will: Explore Clearwell’s review module features including Decision-Tree Tagging, Persistent Hit-Highlighting,Related Items Window, and Breadcrumb Navigation. Review a document and tag it using Decision-Tree Tagging View the document natively within Clearwell’s integrated Native Viewer Apply a redaction and assign a reason code 2012 Symantec. Confidential34 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionNavigate to the Review Document BatchYou’re now moving from ECA mode to legal review mode. Review Mode allows the user to rapidly review and tagdocuments. First, select the document set to review.1. Open the Documents drop-down menuand expand the Review menu by clicking onthe button to the left of Review.2. Expand Review Set #13.Select Batch-0014. Click GO 2012 Symantec. Confidential35 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionSelect Review Mode and Optimize SettingsThe Clearwell E-Discovery Platform provides a fully integrated review module that you will navigate to with the click of amouse. First, you want to highlight your search terms and optimize the review screen real estate to accelerate review.You can simultaneously highlight hits in different colors from multiple queries.Summary of Value: Integrated review module enables simple and rapid iteration between phases and eliminatesmanual errors encountered when exporting and importing data between multiple, disparate tools.3. Click the Filter Close Arrow to collapsethe filter pane and increase screen realestate for the reading pane1. Check thePrevious Search:[Any: fals*AND.]4. Click to change to the right-most ViewingMode which opens the Review Mode view2. Click Actions then selectHighlight terms 2012 Symantec. Confidential36 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionReview and Tag a DocumentClearwell’s review module and allows you to rapidly review and tag documents. The Review Module supports bothHTML (shown below) and native file review. Clearwell’s Decision-Tree Tagging provides the ability to tag documentsusing a customizable, multi-layer tree structure that directs reviewers into key decision points. Below, you’ll notice theRelated Items window and Breadcrumb Navigation feature.Summary of Value: Decision-Tree Tagging Prevents errors and minimizes the number of clicks needed to accuratelytag a document. Related Items makes it easy for you to review files in context with other related files, and BreadcrumbNavigation ensures you never get lost while navigating through related items.Decision-TreeTagging Windowwith customizabletags. The Taggingand Related Itemswindows can bepopped-out tomaximize screenreal estateBreadcrumbNavigations toolprovides a quickand simple way tonavigated betweenrelated itemsThe Related Itemswindow automaticallydisplays documentsrelated to thedocument beingreviewed. Reviewingrelated documentstogether improvesconsistency, eliminatesredundant review, andenables bulk decisionsDocument reviewwindow featuringmulti-search hithighlighting 2012 Symantec. Confidential37 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionReview and Tag a DocumentNow, you will apply a tag to this document. Evaluating this document, it appears to be both Responsive and AttorneyClient Privileged. When clicking the Attorney Client tag you’ll notice that the appropriate parent tags above areautomatically applied.Summary of Value: Improves the speed and accuracy of tagging decisions.2. Click the icons next toReview to expand theoptions. Click the iconsnext to Responsive andPrivileged as well to view allthe tagging options3. Check Attorney Client.This automatically applies thePrivileged and Responsivetags1. Expand the Tagging paneby clicking on the separationline and dragging it down 2012 Symantec. Confidential38 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionView the Document File NativelyNext, you will view the document natively. Clearwell provides the ability to review documents in their native formatwithout requiring each application to be loaded on a reviewer’s workstation. Both text search and hit highlighting withindocuments are also available.Summary of Value: Accelerates location of pertinent terms within documents.1. Click the Text button andselect Native/Image*Note*You may need to installActiveX Control the firsttime you view a documentnatively. If your webbrowser asks you to installthe Bravia Client pleaseallow it to do so and clickInstall Document Viewerand then click Run 2012 Symantec. Confidential39 of 47Symantec eDiscovery Lab Guide
g-Analysis-Review-ProductionRedact Privileged InformationClearwell enables reviewers to quickly and easily redact documents in multiple colors, apply reason codes, and verifyredactions prior to production. The redaction menu provides tools for manually redacting specific text, pages, or areaswithin a document or for performing search and auto-redactions for keywords, phrases, and personal information.2. Select theredaction toolby clicking onthe circled icon1. Click the Native buttonand select Redaction, thenDefault. This displays theredac
Clearwell provides a single product for the identification, collection, processing, analysis, review, and production phases of e-discovery that dramatically reduces the cost, time, and complexity of e-discovery. Whether deployed within the corporation or hosted by a Clearwell certified service provider, the Clearwell E-Discovery Platform: 1.
