encase ediscovery presentation w v3 1 enfscsolatech.tistory.com/attachment/cfile25.uf@... ·...

The World Leader in eDiscovery & Digital Investigations™

© 2008 Guidance Software, Inc. All Rights Reserved.

EnCase® eDiscoveryEnforce legal holds and automatically search, identify, collect, preserve and process electronically stored information across the network

David Petty, VP Guidance Software , ENFSC, 10-14-2008


P A G E 1

AgendaAgenda

Guidance Software Overview

Today’s eDiscovery Challenges

The EnCase eDiscovery Solution

Demonstration

Summary & Next Steps


P A G E 2

Guidance SoftwareThe Recognized Leader in Digital InvestigationsGuidance SoftwareThe Recognized Leader in Digital Investigations

Large, Global Customer BaseOver 27,000 users of EnCase® Forensic WorldwideOver 500 customers of EnCase® Enterprise including:

— More than 100 of the Fortune 500 and over half of the Fortune 50— Deployed on over 10 million desktops, laptops and servers

The Leading Court-Validated TechnologyUsed in over a million cases worldwideAuthenticated in over 50 published court cases and validated under Daubert/FryeCourts have taken “judicial notice” of the validity of EnCase software

Top-ranked Software by Industry AnalystsReceived Gartner’s highest rating for eDiscovery SoftwareForrester calls it “The de-facto industry standard for remote desktop collection”

World-Class Training ProgramOver 4,500 corporate, law enforcement & govt professionals trained annually

Top-Ranked Professional Services Organization“Top 5” eDiscovery Software & Services Provider in Socha-Gelbmann survey


P A G E 3

Global Training FacilitiesGlobal Training Facilities


P A G E 4

““We originally thought of EnCase Enterprise as an e-forensic tool only. However, Guidance Software’s solution addresses virtually every aspect of information security and eDiscovery.”

Litigation Counsel, Dell

EnCase® Enterprise – The Industry Standard Platform for Conducting Network InvestigationsEnCase® Enterprise – The Industry Standard Platform for Conducting Network Investigations


P A G E 5

Today’s eDiscovery Challenges Companies face skyrocketing eDiscovery costs, growing legal risk, and FRCP compliance requirements

Today’s eDiscovery Challenges Companies face skyrocketing eDiscovery costs, growing legal risk, and FRCP compliance requirements

Companies are asking; “How do we….”Companies are asking; “How do we….”

Enforce legal holds

search and collect relevant ESI across the network without disruption

preserve ESI and prevent spoliation

avoid over-collection and the associated costs

reduce or eliminate high outsourced processing fees

quickly determine if we have a case

comply with the Federal Rules

“The challenge that many organizations have today is meeting the increasing number of legal discovery

requests. The average cost of a single case can easily exceed $1.75 million.”

Source: Gartner Inc., Nov 2007


P A G E 6

EnCase eDiscovery The recognized leader for the search, identification, collection, preservation and processing of ESI

EnCase eDiscovery The recognized leader for the search, identification, collection, preservation and processing of ESI

A highly scalable eDiscovery solution

Operates from a central location, with no disruption to end-users

Highly flexible, automated search & collectionbased on:

— File type (e.g., .doc, .xls, .ppt)— Key words (target specific content)— Metadata (created, last-written/last-accessed times, etc.)— Patterns (e.g., social security or credit card numbers)— Hash values (i.e., “digital fingerprints”)— Custodians (by user name or SID)— Foreign Language Support (Unicode & code pages)

Court-validated preservation & prevents spoliationFully Integrated post-collection processingPush-button load-file export into review platforms for attorney review & production

“EnCase eDiscovery is the only product I’m aware of that offers the capability to

conduct detailed searches across an entire organization’s IT system and to return individual user files that respond to the search criteria...the cost savings on just one piece of litigation can be significant.”

Scott Carlson Esq, Seyfarth ShawNew Jersey Law Journal


P A G E 7

EnCase eDiscoveryThe In-House eDiscovery SolutionEnCase eDiscoveryThe In-House eDiscovery Solution

““The collection tool of choiceThe collection tool of choice among many of the other eamong many of the other e--Discovery vendors in Discovery vendors in addition to enterprises. For many organizationsaddition to enterprises. For many organizations …… this is as good as it getsthis is as good as it gets..””

eDiscovery MarketScope Note, Jan ‘08Source:


P A G E 8

eDiscovery with EnCase eDiscoveryeDiscovery with EnCase eDiscovery

EnCase eDiscovery Simplifies and streamlines the eDiscovery processEnCase eDiscovery Simplifies and streamlines the eDiscovery process

““Guidance Software is the de-facto standard for remote desktop collection software” . “The eDiscovery Vendor Landscape”, July 2007

Forrester Research, Inc.


P A G E 9

EnCase eDiscovery Key BenefitsEnCase eDiscovery Key Benefits

Order of magnitude cost savingsEnables an in-house process that is highly efficient due to its scalability, ability to cull at the point of collection, and integrated processing capabilities

Highly defensibleEnables the implementation of defensible & repeatable eDiscovery process, which facilitates compliance with the new Federal Rules and leverages widespreadjudicial acceptance of EnCase

No business disruptionOperates over-the-network from a central location to search, collect, and process ESI without disrupting employees

TIM

E &

MO

NE

Y

5 days total!

Search, Identify, Collect/preserve

and Process

EnCase eDiscovery

Traditional eDiscovery

7 weeks for data

identification

5 weekends to collect & preserve

Up to $1,200 per GB for processing

Savings of up to 90%

Savings of up to 90%

Case Study


P A G E 10

ResultsSolutionSituation

Case StudyFortune 100 Oilfield Services CompanyEnCase eDiscovery

Case StudyFortune 100 Oilfield Services CompanyEnCase eDiscovery

Subject to a myriad of litigation and government oversight around the world

Numerous small to midsize lawsuits cost $200,000 to $1 million each in vendor fees, with aggregate costs in the tens of millions annually

Bring eDiscovery in-housewith EnCase® eDiscovery

Eliminate unnecessary imaging and over-collectionwith targeted searches

Highly flexible search and the ability to cull at the point of collection reduces amount of data collected

Integrated processing eliminated the need to outsource processing

eDiscovery matters from small to large are now handled in-house

In one small case, the amount of data collected was reduced by an order of magnitude, with savings of about $250,000 from the projected total case cost of $300,000

Aggregate cost savings for small to midsize lawsuits are in the millions of dollars annually

“In one large case we were able to cull 9.2 million documents to 600,000. On that case, using EnCase eDiscovery, we were able to save $3 million in processing and attorney review costs”

Senior CounselFortune 100 Oilfield & Technology Services Company


P A G E 11

ResultsSolutionSituation

Case StudyFortune 100 Insurance CompanyEnCase eDiscovery

Case StudyFortune 100 Insurance CompanyEnCase eDiscovery

Large US corporation with class action lawsuit.

1100 custodians across 120 locations

Needed to search all custodians, with 30 keywords plus Exchange mailboxes and file shares

Post collection culling & processing required

EnCase® eDiscovery and GSI’s Professional Services Division (PSD)

Inclusive keyword search, with collection all relevant information.

Collection and secondary culling from a central location

24TB collected in first 2 weeks with collection time/costs reduced over 85%

Over US$2 million in savings for collection & processing

Saved $400k/mth on hosting fees

Established a repeatable, defensible process for future litigation.

ROI in first case

Using EnCase eDiscoveryfor other litigation and HR, Fraud, and internal threat investigations

“The software paid for itself in the first use, saving us more than 85%, created instant ROI, and helped us establish an internal, repeatable, systemized, and defensible process in

compliance with the Federal Rules of Civil Procedure”Senior Litigation Counsel, Fortune 100 company



EnCase® eDiscovery v3.1Enforce legal holds and automatically search, identify, collect,preserve and process electronically stored information across the network


P A G E 13

EnCase® eDiscovery v3.1 – EnCase® Command CenterEnCase® eDiscovery v3.1 – EnCase® Command Center

Ease of Use Enhancements - New User Interface

- EnCase Command CenterEnCase Command Center

- More intuitive flow

- Configure tasks/jobs

- Track status

- Distributed processing

- Launch directly to ECC -- EnCase Command Center can belaunched directly from its desktop icon, and it will run EnCase minimized; or it can be launched from within EnCase, no need to launch EE first and then click on EnScripts


P A G E 14

EnCase® eDiscovery v3.1 – HighlightsEnCase® eDiscovery v3.1 – Highlights

FrameworkFramework’’s Architectures Architecture (see next slide) will consist of a:

- Centralized database that communicates with all the othercomponents in the framework

- Command Center, where the user sets up jobs/tasks through auser interface which interacts with the DB

- Examiner Service, which communicates with the DB to process jobs executed by the Command Center.

All Stores & Outputs UnifiedAll Stores & Outputs Unified

Output FormatsOutput Formats: Logical Evidence File (LEF), Load File – Concordance, Load File – Summation, Load File – EDRM XML

PST archive (output to 2003/2007 compatible PSTs), NSF archive (only for Domino/NSF input),


P A G E 15

Improved Workflow EnCase® Command CenterImproved Workflow EnCase® Command Center


P A G E 16

EnCase® eDiscovery v3.1 – Compatibility and Supported VersionsEnCase® eDiscovery v3.1 – Compatibility and Supported Versions

Compatibility & Supported Versions

• EE Command Center shall be compatible with EnCase version 6.11.3EnCase version 6.11.3.

• Databases: MS SQL, MySQL, SQL Express

• Email Stores: Domino/Lotus/NSFDomino/Lotus/NSF Versions 6.0.3, 6.5.4, 7 (Domino version 8 will be supported in an upcoming release) Exchange/PSTExchange/PST 2003, 2007

• Document Stores: DocumentumDocumentum v5.3 v5.3 (OpenText LiveLink v9.5.0.1 will be supported in an upcoming release)

• EECC Examiner: previous supported platforms, 32-bit, 64-Bit (not supported for all Connectors except Documentum), and Vista (x32 and x64)

• SAFE: 32 bit only (but supported in 32 bit mode on 64 bit systems too) – XP and Vista


P A G E 17

EnCase® eDiscovery v3.1 – Enhanced ProcessingEnCase® eDiscovery v3.1 – Enhanced Processing

Enhanced Processing- EDRM XML Load File SupportEDRM XML Load File Support

Summary: Create output to an EDRM XML load file that can be validated with an EDRM tool to comply with industry standard format (In addition to our support of Concordance and Summation).

- Global Global DeduplicationDeduplicationSummary: Global Deduplication – When collecting documents for a case, this feature allows usersto collect and produce (ex. LEF #1), and then perform additional collections (LEF #2)while deduplicating across the entire data set (ex. Deduplicates LEF #2 against LEF #1).

- Proximity SearchingProximity SearchingSummary: Proximity Searching allow users to search for keywords or terms in proximity to another keyword or term.Enhanced Search features During Processing

- Collection IndexCollection IndexSummary: The Collection Index would use the Index capabilities of EnCase Enterprise to index the collected files in the LEF and run searches using the index.

- Bit 9 Integration with ConditionsBit 9 Integration with ConditionsSummary: The new architecture of conditions will allow a staged approach to running conditions, with the first pass being a comparison with the Bit9 Database (so a user could exclude any files that match good files/hashes in the Bit9 DB before running subsequent conditions).


P A G E 18

EnCase® eDiscovery v3.1 – Enhanced Search and CollectionEnCase® eDiscovery v3.1 – Enhanced Search and Collection

Enhanced Search and Collection Capabilities- ECM Connector - connector to connector to DocumentumDocumentum v5.3v5.3 Integration

Summary: DocumentumDocumentum is a document repository. Connectors provide a standardized EnScript interface to connect to various file and email repository systems to extract documents, emails and related information. The Command Center will leverage this functionality to collect, search, and further cull documents found in these repositories for specific users.

- Searching of Encrypted DataSummary: Decrypt and search EFS and S/MIME EFS and S/MIME encrypted files on remote custodians. Ability to search encrypted documents and emails, which can be decrypted “on the fly”, permitting a search of the contents as if the files and emailswere not encrypted. Enhanced Search Features During CollectionEnhanced Search Features During Collection

- Auto Collect (Force Collect) Protected/Encrypted FilesAuto Collect (Force Collect) Protected/Encrypted FilesSummary: Allow user to force collection of password protected and encrypted files by checking a box in the interface. This would be useful for both emails and files within a network environment.

- Search both binary and extracted view search simultaneously


P A G E 19

EnCase® eDiscovery v3.1 – Enhanced eMail SupportEnCase® eDiscovery v3.1 – Enhanced eMail Support

Enhanced Email SupportEnhanced Email Support- New Email Servers supportedNew Email Servers supported- Exchange 2007, Lotus/Domino 7

Summary: Utilizing the new EnCase Connectors, Lotus / Domino version 7 will now be supported (and Lotus/Domino 6.5.4 and 6.0.3 will continue to be supported, but now leveraging the Connector). A Scan NSF tool will be incorporated that repairs corrupted NSF files so that they can be processed successfully.

- Enhanced Searching of ExchangeEnhanced Searching of Exchange (Calendar, etc) & Lotus NotesLotus Notes(Document library, calendar, etc)

Summary: Users will now be able to search non-mail items in Exchange and Notes, like calendar, contacts, tasks.

- Lotus Notes Recursive Message ProcessingLotus Notes Recursive Message ProcessingSummary: This feature would allow the Email Processor to search recursive messages in Lotus Notes, on both Domino Servers and from static NSF files.

- Can Output to Can Output to PSTsPSTs -- we have the ability to create PSTs as output of Exchange search


P A G E 20

EnCase® eDiscovery v3.1 EnCase® eDiscovery v3.1

EnCase Command Center v3.1 Screen Shots


P A G E 21

EnCase® eDiscovery v3.1 – ScreenshotCasesEnCase® eDiscovery v3.1 – ScreenshotCases


P A G E 22

EnCase® eDiscovery v3.1 – ScreenshotSourcesEnCase® eDiscovery v3.1 – ScreenshotSources


P A G E 23

EnCase® eDiscovery v3.1 – ScreenshotTargetsEnCase® eDiscovery v3.1 – ScreenshotTargets


P A G E 24

EnCase® eDiscovery v3.1 – ScreenshotCriteriaEnCase® eDiscovery v3.1 – ScreenshotCriteria


P A G E 25

EnCase® eDiscovery v3.1 – ScreenshotSystemsEnCase® eDiscovery v3.1 – ScreenshotSystems


P A G E 26

EnCase® eDiscovery v3.1 – ScreenshotCase Screening ReportEnCase® eDiscovery v3.1 – ScreenshotCase Screening Report


P A G E 27

EnCase® eDiscovery v3.1 – ScreenshotExcluded/Included ChartEnCase® eDiscovery v3.1 – ScreenshotExcluded/Included Chart


P A G E 28

EnCase® eDiscovery v3.1 – ScreenshotExecutive SummaryEnCase® eDiscovery v3.1 – ScreenshotExecutive Summary


P A G E 29

EnCase® eDiscovery v3.1 – ScreenshotFile LogEnCase® eDiscovery v3.1 – ScreenshotFile Log


P A G E 30

EnCase® eDiscovery v3.1 – ScreenshotCase Overview ReportEnCase® eDiscovery v3.1 – ScreenshotCase Overview Report


P A G E 31

EnCase® eDiscovery v3.1 – ScreenshotCase DetailEnCase® eDiscovery v3.1 – ScreenshotCase Detail


P A G E 32

Why Guidance Software?The Trusted Solution of Global Market LeadersWhy Guidance Software?The Trusted Solution of Global Market Leaders


P A G E 33

What Our Customers are Saying…What Our Customers are Saying…

“EnCase Enterprise saved us more than $1mm in the first 6 months of use. It also allowed us to complete a critical M&A discovery issue that would have been impossible with any other options in the market today”

CSO & VP, Risk ManagementMcAfee, Inc.

“Guidance Software’s solution addresses virtually every aspect of information security and eDiscovery. It saves money, saves time, and produces better results whether the task is internal investigation or eDiscovery.”

Litigation CounselDell, Inc.

“In one large case we were able to cull 9.2 million documents to 600,000 for collection. On that case, using the eDiscovery Suite, we were able to save $3 million in processing and attorney review costs”

Senior CounselHalliburton, Inc.


P A G E 34

“Guidance Software is the de-facto industry standard for remote desktop collection software.”

The eDiscovery Vendor Landscape, July 2007Forrester Research, Inc.

“The collection tool of choice among many of the other eDiscoveryvendors in addition to enterprises. For many organizations … this is as good as it gets.”

Debra Logan, Research Vice President MarketScope for E-Discovery and Litigation Support VendorsDecember 2007

What the Analysts are Saying…What the Analysts are Saying…

“The company’s products are unique in that they have a proven track-record of court admissibility”

Vivian Tero, Sr. AnalystWorldwide Legal Discovery and Litigation Support Infrastructure 2007–2011


P A G E 35

“[Guidance Software has a] ‘best of breed’ reputation and long history within the legal and compliance community.”

Roth Capital PartnersSoftware Equity ResearchOctober 2007

“Guidance Software is the leading pure-play provider of eDiscovery software”

Lehman Brothers – Global Equity Research GroupMarket Research Report, May 2007

“Guidance Software’s technology is a game-changer….Spending in its sector (eDiscovery) is currently skewed toward labor intensive and inefficient solutions for which Guidance Software offers significant ROI enhancement” Morgan Stanley Software Analyst Team

2007 Research Report

What the Financial Community is Saying…What the Financial Community is Saying…



Thank You

encase ediscovery presentation w v3 1 enfscsolatech.tistory.com/attachment/cfile25.uf@... ·...

Documents