eDiscovery Case Management¶

Overview¶

INDICA aims to provide you with a powerful data discovery & document review tool in an intuitive and user-friendly manner. For you to better set-up and manage your eDiscovery activities in INDICA, it is important to familiarize yourself with its main administrative features. This manual outlines INDICA’s eDiscovery administrative capabilities and walks you through how you can best manage cases as system administrator.

Note that this manual is written based on our demo environment, your actual interface might differ slightly from the screenshots below;

After you have created a case and set up user information correctly, go to ‘Manage Cases’ to set case settings, add your evidence and generate reports. On the top of the INDICA Manage Cases interface you can find a list of tabs which will allow you to navigate to the corresponding function pages, including the Home page, Settings, Datasources, Tags, Saved Queries, and Logs & Reports settings. Click on the tab and you will be directed to the targeted page.

Home Page¶

Home Page provides you with an overview of data activities and data status. As the case manager, you can enable/disable indexer, monitor eDiscovery progress, as well as generate reports directly from this page. On this page, you can find the statistics of the index that are shown for informational purposes. Item ‘parents’ are mails that are at the root of a thread, zip files that contain items, etc. Note that clicking ‘Clean Index’ will throw all data out of INDICA. When you add a new case, this page will be empty. Please check if the settings are correct before you move on.

Not-indexed documents are documents INDICA couldn’t read. Reasons for this are most likely rights issues, unknown encryption or corruption of files.

Settings¶

There are three sections in the Settings page where you can customize your INDICA eDiscovery (Look & Feel, General Settings and Search Settings), we will show you in the content below how you can better customize INDICA eDiscovery and make it work the best for you. Remember to click ‘Save Changes’ after your action, otherwise the system will not deploy any of the changes you made.

1. Look & Feel

In this section, you can customize INDICA eDiscovery to fit your corporate style. You can change the logo on the top left side into your own company logo and switch the interface colour into your company colour.

2. General Settings

Click on ‘General Settings’ and you will be directed to this page, here you can change different Indexer and usage settings.

Use first folder as Facet or Custodian name: enabling this allows you to have the first level folders as custodian name or filters on the frontend;
**Enable OCR:**enabling this will allow INDICA to extract information from images and image-PDFs; This action will increase indexing time.
Pre-create document views: we advise you to enable this to have a good document loading speed; this will also increase indexing time.
Only index email meta data: enabling this will fasten document loading, but only meta data will be shown at the frontend. Document contents will not be available;
Use nice document viewer: we advise you to enable this to have a nice view;
Disable this option to remove ACL from shares: enabling this will allow all users to have access to all files in INDICA;
Enable NLP library: we advise you to enable this to have better search results;
How many hits should be shown per page: you can decide how many hits will be shown per page in the frontend;
Enable comments: enable this if you want reviewers to leave comments in the frontend;
Enable Stemming: here you have the options to turn on/off stemming. Stemming can be enabled by choosing the language needed. The indexer will be restarted and a re-index is strongly advised.

3. Search Settings

In this page, you can add/delete stop words and synonyms which will affect the search results. INDICA will not analyze on the words on ‘stop word list’. Use the ‘boost query’ function to have certain search results appear above others or exclude certain results altogether.

Please refer to the content below for general search method, you can also use this for boosting queries:

INDICA provides the relevance level of matching documents based on the results found. To boost a query, use the caret, “^”, symbol with a boost factor (a number) at the end of the query you are searching. The higher the boost factor, the more relevant the query will be.

Boosting allows you to control the relevance of a document by boosting its query. For example, if you are searching for

jakarta apache

And you want the term “jakarta” to be more relevant boost it using the ^ symbol along with the boost factor next to the query. You would type:

jakarta^4 apache

This will make documents with the term jakarta appear more relevant. You can also boost Phrase Terms as in the example:

“jakarta apache”^4 “Indica search”

By default, the boost factor for each term or phrase is 1. Although the boost factor must be positive, it can be less than 1 (e.g. 0.2).

Datasources¶

1. Datasources Overview

After you have the previous steps set up correctly, you can go to ‘Datasources’ to add new evidence, edit information of existing evidence and delete certain evidence. INDICA supports various forms of evidence as shown below.

Data sources and file types that INDICA supports:

File shares;
Active Directory, Novel Directory, Open Directory, LDAP;
Websites/ WEBdav;
MySQL, MS SQL, PostgreSQL, Oracle, ODBC;
Mail servers: POP3, IMAP, MS Exchange (starting from 2003), Office 365, Amazon, WorkMail and more;
SharePoint (limited, depending on configuration);
Default connectors to DB;
Amazon S3 buckets;
E01/L01 evidence files;
UNIT4 – Alure;
MS Dynamics (in case of default setup, there is a possibility to make adjustments);
INDICA recognises over 400 file types: most common office formats and a lot of proprietary formats.

Noted that Most non- standard DB applications can be connected through direct DB connection. This might take up to a day to configure depending on the complexity of the environment.

2. Collections

Collections contain one or more data sources (for example shares, sites, email or data tabs). To edit/delete certain data collections, click on the corresponding button.

3. Fileshares

In this section, you can set Windows fileshares, SMB or CIFS, with or without authentication. Only read-rights are necessary for the share or the user connecting to the share.

Add new fileshares

To add a new fileshare source in INDICA, click on ‘Add New’. Fill in the information of targeted fileshare and access credentials of this fileshare. Click ‘Show as datatab’ if you want this evidence to appear as a tab in INDICA front end. Click ‘Check’ to examine if you have entered the credentials correctly so that INDICA can connect to this evidence. If the credentials are correct, click ‘Submit’ and the evidence will be instantly reflected on ‘Fileshares’ page.

Enter the information in the form of \usershare or \localhostusb$ when connecting to a USB drive.

We advise you to have a dedicated user or service account e.g. ‘INDICA’ for the connection to the shares. This user needs read rights to all the data that the INDICA appliance needs to access.

Check new fileshares added

To When the added data is fully processed, you can click ‘Info’ to see a visual summary of this evidence. The speed of data processing will depend on your data size, local network condition, OCR enabled/disabled and the condition of your hardware.

Edit/delete fileshares

To add or delete a certain evidence, click on the corresponding button on this page.

4. Sites

To index web sites or intranet sites, enter the information in the ‘sites’ section. Enter the name, the site and choose the spider interval (once, daily, weekly). If basic authentication is required, enter the site’s credentials.

Your reseller can set up form-based authentication for you if needed.

5. Email

Email integrations with security set on email owners can only work if Active Directory integration is turned on.

Email integration

After enabling the e-mail functionality, the e-mail connectivity can be chosen, either a POP archiving/catch all mailbox or EWS connections. In order to store the email archive on an external share, please set the share information in the Archiving section. If mail is enabled and there is no (Active) Directory integration enabled, a custom email domain can be set here too. Default is set to indica.lan.

POP3 Settings

Please fill in the server name, user name and password of the Catch all email box. The system will connect using the POP protocol, and store the email on the default archive location. You can choose to access it through a separate tab.

All email from the archive POP mailbox will be downloaded and removed from the mailbox. If needed, enter extra email aliases to the user in the list.

EWS Accounts

Most modern mail servers have EWS API connectivity. To make full use of this, please enter the users and passwords. A special user can be created to spider all the email. Keep in mind that INDICA needs to create an Email archive, so enough storage should be added to the system.

Tags¶

After adding evidence, you can go to ‘Tags’ to create/edit/delete tags. To nest tags, simply drag and drop and indent them. Click on ‘Lock tags’ after changes are made so they cannot be changed by other users afterwards. If you have tagged certain documents and want to export them, go to the bottom of this page, click on the targeted tags and then click ‘Export’. Documents will be ready for download at this page after you click ‘Export’.

Please be cautious when changing existing tags settings, any changes made to the existing tags might cause unexpected results in the frontend.

Saved Queries¶

At this page, you can see all saved queries made in the INDICA front end, you can also add new ones by clicking ‘Add New +’. Import/export query list is also possible at this page. If you want to see how many hits are generated from your search terms (including duplicates), click ‘Get Totals’.

Logs & Reports¶

For Logs & Reports, there is a query log where you can see all searches done by the users and they are also available for download. In INDICA Logging, you can see all the work information done by INDICA.

User action trails can be found in ‘Audit Log’, including tagging, commenting and etc.