Using Tasks for Automated Processes

[jon.pearse]

Introduction:

The Tasks feature allows the user to run predefined processes either directly after the indexing process has completed, or at a later stage. In this article we will look at using the Tasks feature to automate the searching, filtering and export processes associated with an eDiscovery matter.

 

Note:

This example is for demonstration purposes only. Your searching, filtering and export requirements will likely be different to what is used here. Also, we start the tasks from the point of running searches. This presumes that all other required checks and pre-processing tasks, such as investigating items that were not processed (e.g. OCR and encrypted items) have been completed.

 

Basic ED processing/filtering steps:

For this example we will cover the following basic eDiscovery processing steps.

·         Search/filter the data in the case using a keyword list and a date range.

·         Show the top level parents for the items that were respondent to the searches.

·         Deduplicate the top level parents.

·         Return all family items. This shows email attachments and all embedded items.

·         Remove the irrelevant items such as folders, containers, embedded items and non document types. This leaves the remaining items which are ready for review.

·         Export the document ready for review to a load file.

 

 

Creating the Tasks:

In Intella Desktop the Tasks wizard is located under the File menu. Start the Task wizard and click on the New button in the Tasks window. Type a name for the task. I have used a prefix of '01 -' in the task name. Using a sequential prefix makes it is easier to see the order for the tasks.

 

Step 1 allows you to search for items. In this case we will select the 'Keyword list' option from the dropdown. Once done we can either select a keyword list which is already in the case, or we can load a keyword list from a file. Next, click on the 'Add' button to the right and select 'Date' from the dropdown. Enter the date parameters.

 

Step 2 allows the user to refine the search. We don't use Step 2 for this task.

 

Step 3 allows the user to apply actions to the results. In this case we are going to tag the respondent items. Hierarchy tags are available so we will set all of the output tags under a top level tag named 01 - eDiscovery Processing, e.g. 01 - eDiscovery Processing/01.01 - KWSearch-DateRange

 

 

 

 

The second task is configured to return all of the parent items from the items which were respondent to the search and date filter. Like we did for the first task, click on New and type a name for the task.

 

In Step 1 we want to select the tag that holds the items that were respondent to the search criteria. This is basically the starting dataset to be filtered further.

 

Note that we tagged the results in the first task into a hierarchical tag. This tagging structure must be maintained for the starting dataset in Step 1 of this second task. E.g. 01 - eDiscovery Processing/01.01 - KWSearch-DateRange

 

Click the Add button for Step 2 and use the dropdown to select the 'Identify parents' option. Select the Top level parents radio button and check the check box for 'Add items that are already top level parents'.

 

In Step 3, tag the items into a new tag under the tag group '01 - eDiscovery Processing', e.g.

'01 - eDiscovery Processing/01.02 - Show Top Level Parents'.

 

 

 

 

Once the top level parents have been identified, we need to create a task to deduplicate the top level parents. Create a new task and name it appropriately.

 

In Step 1 select the tag that holds the top level parent items.

 

Click the Add button for Step 2 and use the dropdown to select the 'Deduplicate results' option.

 

In Step 3, tag the items into a new tag under the tag group '01 - eDiscovery Processing'.

 

 

 

 

Now that we have our top level items deduplicated, we need to bring back the family for those items. Create a new task and name it appropriately.

 

In Step 1 select the tag that holds the deduplicated top level parent items.

 

For Step 2, click the Add button and use the dropdown to select the 'Identify children' option. Select the 'All descendants' radio button, and check the 'Ignore folders' checkbox.

 

In Step 3, tag the items into a new tag under the tag group '01 - eDiscovery Processing'.

 

 

 

 

The next step is to add the top level parents and family items into one tag, then clean up the dataset to remove any embedded items and containers such as zip files and PST files. We have already extracted the content of these files so we no longer need the container or zip files. Click on New and type a name for the task.

 

In Step 1 select the Match dropdown, and select 'Any' from the list. We need to set this to 'Any' as we will be adding all of the date from the two tags, we don't want just the intersection of the tags.

 

Still on Step 1, enter the tag name that holds the deduplicated top level parent items. Also, click the Add button to the right and enter the tag name that holds the family items.

 

Click the Add button for Step 2 and use the dropdown to select 'Suppress irrelevant items' 

 

In Step 3, tag the items into a new tag under the tag group '01 - eDiscovery Processing'.

 

 

 

 

We now have all of our respondent data de-duplicated and the family items returned. Although we have cleaned out the irrelevant items, there may be other file types in the dataset that we need to clean out. These could be items located in System and Others categories under the Type facet.

 

We need to create a saved search for this task as we will be using Exclude searches. To create the saved search for this process:

·         Run a search over the tag the contains the items with the irrelevant items removed.

·         Run Exclude searches over the Containers, System and Others categories under the Type facet.

 

Once complete, click on the Save button in the Results box on the right, and enter a name for your saved search. E.g. '02 - Excluded: System, Others, Containers'

 

Once done, open the Tasks wizard again. Click on New and type a name for the task.

 

In Step 1 select the Saved Search option, and use the second dropdown to select the newly created Saved Search. Note that a Saved Search can also be loaded from a file.

 

We don't use Step 2 for this process.

 

In Step 3, tag the items into a new tag under the tag group '01 - eDiscovery Processing'.

 

 

This concludes the searching and filtering tasks to provide a dataset ready for review/export.

 

 

 

 

Exporting the results:

Now that we have our dataset ready for export, we can go ahead and create a task to export the data to a load file. Click on New and type a name for the task.

 

In Step 1 select the tag option, and enter the tag name that holds the items which are ready for review.

 

We don't use Step 2 for this process.

 

In Step 3, select Export from the dropdown. Select your pre-configured load file template from the list.

 

 

 

 

Once the tasks have been created and run, they should look like this.

 

 

 

[Bryan La Rock]

Hi!

I'm fairly new to automation through Tasks, but I'm making good progress so far.  That being said, I can't seem to find a way to filter results by Custodian.  Is this possible in Tasks?

As an workaround, I created tags for each of my custodians, since I figured I could filter by Tag in Tasks.  Unfortunately, this is still not quite doing the trick for me.  This works well for a single custodian, but the technique fails when I need to filter with a list of custodians (since the Tag filter in Tasks only allows for one tag).

I'd appreciate any suggestions for how I might get this to work.

Thanks!

Bryan

[jon.pearse]

Hi Bryan,

You can add additional Tag criteria when creating tasks. So you could add tags for 2 or more custodians as a starting dataset for your task. E.g.

[Bryan La Rock]

Hey Jon!

Thanks for the suggestion.  I actually did consider this (and I probably should have mentioned this in my original post).  The problem is that I have a lot of other criteria in addition to the custodians for these searches.  There are keyword searches and date ranges as well.  Therefore, I need to keep the overall logic to "match all" as opposed to "match any".  If I add multiple custodian tags, this will break the search.

Ideally, it would be best if Custodian were an option in Tasks (with the ability to select one or more custodians).  It would also be fantastic if Tasks allowed you to create logical groups of nested AND/OR conditions for situations like this.

That being said, do you have any other suggestions?  For this case, I ended up creating tags for groups of custodians.  This allowed me to use the Tag option in Tasks to search multiple custodians at once.  This is not a good solution, though, as it requires quite a bit of extra work to set up the custodian groups.

Thanks again!

Bryan