Glossary

• Active Data: Active data is information residing on the direct access storage media of computer systems, which is readily visible to the operating system and/or application software with which it was created and immediately accessible to users without restoration, modification ,or reconstruction (i.e., word processing and spreadsheet files, programs and files used by the computer’s operating system).

• Archival Data: Archival data is information that is not directly accessible to the user of a computer system but that the organization maintains for long-term storage and record keeping purposes. Archival data may be written to removable media such as a CD, magneto-optical media, tape or other electronic storage device, or may be maintained on system hard drives in compressed formats (i.e., data stored on backup tapes or disks, usually for disaster recovery purposes).

• ASCII (Acronym for American Standard Code): ASCII is a code that assigns a number to each key on the keyboard. ASCII text does not include special formatting features and therefore can be exchanged and read by most computer systems.

• Backup Data: Backup data is information that is not presently in use by an organization and is routinely stored separately upon portable media, to free up space and permit data recovery in the event of disaster.

• Chain-of-Custody: a process used to maintain and document the chronological history of electronic evidence. A chain-of-custody ensures that the data presented is "as originally acquired" and has not been altered prior to admission into evidence. RenewData maintains an electronic chain-of-custody link between all electronic data and its original physical media throughout the production process.

• Coding: Document coding is the process of capturing case-relevant information (i.e. author, date authored, date sent, recipient, date opened, etc.) from a paper document

• Computer Forensics: Computer forensics is the use of specialized techniques for recovery, authentication, and analysis of electronic data when a case involves issues relating to reconstruction of computer usage, examination of residual data, and authentication of data by technical analysis or explanation of technical features of data and computer usage. Computer forensics requires specialized expertise that goes beyond normal data collection and preservation techniques available to end-users or system support personnel.

• Data Extraction: the process of removing files and meta-data from backup tapes.

• De-duplication: De-Duplication ("De-Duping") is the process of comparing electronic records based on their characteristics and removing duplicate records from the data set.

• Deleted Data: Deleted data is data that, in the past, existed on the computer as live data and which has been deleted by the computer system or end-user activity. Deleted data remains on storage media in whole or in part until it is overwritten by ongoing usage or "wiped" with a software program specifically designed to remove deleted data. Even after the data itself has been wiped, directory entries, pointers, or other metadata relating to the deleted data may remain on the computer.

• Discovery: a pre-trial process in which each party tries to find all the information held by the other party and by certain third parties that is relevant, probative and can be admitted into evidence at trial. Each party is required to cooperate with the other to the extent required by the relevant rules of civil procedure.

• Discovery Review/Production Tools:  Powerful databases such as Summation and Concordance that allow users to review/produce up to millions of pages of discovery very efficiently through filtering process such as coding, searchable text (ocr) while enabling users to flag, tag, hi-lite, organize large amounts of data at a click of a button.

• Document: Fed. R. Civ. P. 34(a) defines a document as "including writings, drawings, graphs, charts, photographs, phone records, and other data compilations." In the electronic discovery world, a document also refers to a collection of pages representing an electronic file. E-mails, attachments, databases, word documents, spreadsheets, and graphic files are all examples of electronic documents.

• Electronic Discovery: The discovery of electronic documents and data including e-mail, Web pages, word processing files, computer databases, and virtually anything that is stored on a computer. Technically, documents and data are "electronic" if they exist in a medium that can only be read through the use of computers. Such media include cache memory, magnetic disks (such as computer hard drives or floppy disks), optical disks (such as DVDs or CDs), and magnetic tapes.

• Email Message Store: A top most e-mail message store is the location in which an e-mail system stores its data. For instance, an Outlook PST (personal storage folder) is a type of top most file that is created when a user’s Microsoft Outlook mail account is set up. Additional Outlook PST files for that user can be created for backing up and archiving Outlook folders, messages, forms and files. Similar to a filing cabinet, which is not considered part of the paper documents contained in it, a top most store generally is not considered part of a family.

• ESI: Electronically Stored Information

• File Server: When several or many computers are networked together in a LAN situation, one computer may be utilized as a storage location for files for the group. File servers may be employed to store e-mail, financial data, word processing information or to back-up the network.

• Filtering: electronic filtering of e-mails and files for privilege or by keyword, file type or name. Filtering removes files that don't fit the search criteria and reduces the volume of data that requires further investigation.

• Forensically Sound Procedures: procedures used for acquiring electronic information in a manner that ensures it is "as originally discovered" and is reliable enough to be admitted into evidence. Such procedures are defined in part by the US Department of Justice publication "Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations."

• Format: The internal structure of a file, which defines the way it is stored and used. Specific applications may define unique formats for their data (i.e., "MS Word document file format"). Many files may only be viewed or printed using their originating application or an application designed to work with compatible formats. Computer storage systems commonly identify files by a naming convention that denotes the format (and therefore the probable originating application) (i.e., "DOC" for Microsoft Word document files; "XLS" for Microsoft Excel spreadsheet files; "TXT" for text files; and "HTM" (for Hypertext Markup Language (HTML) files such as Web pages). Users may choose alternate naming conventions, but this may affect how the files are treated by applications.

• FRCP: Federal Rules of Civil Procedure

• Fragmented Data: Fragmented data is live data that has been broken up and stored in various locations on a single hard drive or disk.

• GIF (Graphic interchange format): A computer compression format for pictures.

• Gigabyte (GB): A gigabyte is a measure of computer data storage capacity and is a billion (1,000,000,000) bytes.

• Hash: an algorithm that creates a value to verify duplicate electronic documents. A hash value serves as a digital thumbprint.

• Hosting:  Digital document repositories via an FTP to review data remotely.  Example solutions are Summation, Concordance FYI, and Clearwell.

• Inactive Record: Inactive records are those Records related to closed, completed, or concluded activities. Inactive Records are no longer routinely referenced, but must be retained in order to fulfill reporting requirements or for purposes of audit or analysis. Inactive records generally reside in a long-term storage format remaining accessible for purposes of business processing only with restrictions on alteration. In some business circumstances, inactive records may be reactivated.

• JPEG (Joint Photographic Experts Group): An image compression standard for photographs.

• Keyword Search: A search for documents containing one or more words that are specified by a user.

• Kilobyte (Kb): Approximately one thousand bytes of data is 1Kb of data.

• Legal Hold: A legal hold is a communication issued as a result of current or anticipated litigation, audit, government investigation or other such matter that suspends the normal disposition or processing of records. The specific communication to business or IT organizations may also be called a "hold," "preservation order," "suspension order," "freeze notice," "hold order," or "hold notice."

• Load File:  A file that relates to a set of scanned images or electronically processed files and indicates where independent files or pages belong together as documents including where they begin and end.  It may also contain metadata, coded data, text, etc.  Load files must be obtained and provided in prearranged formats to ensure transfer of accurate and usable images and data.

• Merge: the process of combining various e-mail files (i.e. Microsoft Outlook's .pst) into one file for de-duplication purposes.

• Metadata: Metadata is information about a particular data set which may describe, for example, how, when, and by whom it was received, created, accessed, and/or modified and how it is formatted. Some metadata, such as file dates and sizes, can easily be seen by users; other metadata can be hidden or embedded and unavailable to computer users who are not technically adept. Metadata is generally not reproduced in full form when a document is printed. (Typically referred to by the less informative shorthand phrase "data about data," it describes the content, quality, condition, history, and other characteristics of the data.)

• Native Environment: the original configuration (software, passwords, server configuration, etc.) of a backup tape or e-mail system (i.e. Microsoft Exchange).

• Native File: a file saved in the format of the original application used to create the file. Dealing with native files can minimize expensive per-page costs for the traditional TIFF and/or PDF processing and will maximize the relevant information available from the file.

• Native Format: Electronic documents have an associated file structure defined by the original creating application. This file structure is referred to as the "native format" of the document. Because viewing or searching documents in the native format may require the original application (i.e., viewing a Microsoft Word document may require the Microsoft Word application), documents are often converted to a standard file format (i.e., tiff) as part of electronic document processing.

• OCR (Optical Character Recognition): Optical character recognition is a technology which takes data from a paper document and turns it editable text data. The document is first scanned. Then OCR software searches the document for letters, numbers, and other characters.

• Parent-child Relationships: Parent-child relationships is a term used in e-discovery to describe a chain of documents that stems from a single e-mail or storage folder. These types of relationships are primarily encountered when a party is faced with a discovery request for e-mail. A "child" (i.e., an attachment) is connected to or embedded in the "parent" (i.e., an e-mail or Zip file) directly above it.

• PDF (Portable Document Format): An Adobe technology for formatting documents so that they can be viewed and printed using the Adobe Acrobat reader.

• Petabyte (PB): A petabyte is a measure of computer data storage capacity and is one thousand million million (1,000,000,000,000,000) bytes.

• Preservation Notice, Preservation Order: See Legal Hold.

• Processing:  The principal objective of electronic discovery processing is to prepare relevant files for efficient and expedient review (in most instances by attorneys), production and subsequent use. Additional specific goals of processing electronic documents include:
  • Capture and preserve the body of electronic documents;
  • Associate document collections with particular users (custodians);
  • Capture and preserve the metadata associated with the electronic files within the collections;
  • Establish the parent-child relationship between the various source data files;
  • Automate the identification and elimination of redundant, duplicate data with the given dataset;
  • Provide a means to programmatically suppress material that is not relevant to the review based on criteria such as keywords, date ranges or other available metadata;
  • Unprotect and reveal information within files; and
  • Accomplish all of these goals in a manner that is both defensible with respect to clients’ legal obligations and appropriately cost-effective and expedient in the context of the matter.

• Production: delivery of data or information in response to an interrogatory, subpoena or discovery order or a similar legal process.

• PST (Personal Folder File): The place where Outlook stores its data (when Outlook is used without Microsoft® Exchange Server). A PST file is created when a mail account is set up. Additional PST files can be created for backing up and archiving Outlook folders, messages, forms and files. The file extension given to PST files is .pst.

• Record Custodian: A records custodian is an individual responsible for the physical storage and protection of records throughout their retention period. In the context of electronic records, custodianship may not be a direct part of the records management function in all organizations.

• Records Management: Records Management is the planning, controlling, directing, organizing, training, promoting and other managerial activities involving the lifecycle of information, including creation,

• Records Retention Period, Retention Period: The length of time a given records series must be kept, expressed as either a time period (i.e., four years), an event or action (i.e., audit), or a combination (i.e., six months after audit).

• Records Retention Schedule: A plan for the management of records, listing types of records and how long they should be kept; the purpose is to provide continuing authority to dispose of or transfer records to historical archives.

• Residual Data: Residual Data (sometimes referred to as "Ambient Data") refers to data that is not active on a computer system. Residual data includes (1) data found on media free space; (2) data found in file slack space; and (3) data within files that has functionally been deleted, in that it is not visible using the application with which the file was created, without use of undelete or special data recovery techniques.

• Restore: To transfer data from a backup medium (such as tapes) to an on-line system, often for the purpose of recovery from a problem, failure, or disaster. Restoration of archival media is the transfer of data from an archival store to an on-line system for the purposes of processing (such as query, analysis, extraction or disposition of that data). Archival restoration of systems may require not only data restoration but also replication of the original hardware and software operating environment. Restoration of systems is often called "recovery".

• Sibling: A sibling is a document that shares a common parent with the document in question (e.g. two attachments that share the same parent email or are sibling documents in the same Zip file).

• Spoliation: Spoliation is the destruction of records which may be relevant to ongoing or anticipated litigation, government investigation or audit. Courts differ in their interpretation of the level of intent required before sanctions may be warranted.

• Terabyte (TB): A terabyte is a measure of computer data storage capacity and is one thousand billion (1,000,000,000,000) bytes.

• TIFF (Tagged Image File Format): One of the most widely supported file formats for storing bit-mapped images. Files in TIFF format often end with a .tif extension.

• Unstructured Data: data that is not in a delimited format. File types include word processing files, html files (web pages), project plans, presentation files, spreadsheets, graphics, audio files, video files and emails.

• ZIP: An open standard for compression and decompression used widely for PC download archives. ZIP is used on Windows-based programs such as WinZip and Drag and Zip. The file extension given to ZIP files is .zip.