Appendix A: Glossary

Active Directory

A directory service designed by Microsoft in which Windows servers acting as Domain Controllers provide a central system for managing user accounts, security groups, computers, printers and other members of the network (referred to as the "domain"). Active Directory Domain Controllers typically provide networking services such as DNS, WINS (NetBIOS name resolution), DHCP, etc. Active Directory can be accessed via LDAP.

See also: Domain, Domain Controller, Workgroup

Administrator

See Collection Administrator

See Systems Administrator

See Local Administrator

Administration Console

A Collection Center component, installed on one or more computers (typically on a small number of systems), allowing Collection Administrators to set up, manage and monitor the ECC system. Using Administration Console, a Collection Administrator can manage the Collection process for the entire organization. The following ECC entities can be configured via Admin Console:

Entities	Description
Cases	A name associated with one or more Collections.
Collections	A Collection defines one or more jobs which can be run from a computer where ECC Client is installed. Collections consist of file collection Targets, file selection Criteria, Destination paths and scheduling information.
Targets	File locations to be processed (e.g. copied to a Destination).
Custodians	People or entities responsible for files at specific Targets.
Groups	Sets of Custodians. By selecting individual Custodians or Groups of Custodians, you can quickly select the Targets associated with those Custodians or Groups.
Criteria	Filename patterns, file content types and date ranges used to restrict the files being processed.
Destinations	File locations where collected files are stored.
Schedules	Allow Collection Runs to occur at specific dates and times.

Note: Each of the above terms has its own Glossary entry containing more details.

Case

Each Case may represent a separate legal matter, a phase of litigation, or other collection project. An organization may have only a single Case, or numerous Cases. Each Collection is associated with one Case, so Cases are used to organize Collections for different projects.

Client

ECC Client is a Collection Center component, installed on several computers (typically on a large number of systems), which will execute Collections that were set up via Administration Console.

ECC Client gathers files from local hard disks or accessible network shares. It can also run the other kinds of ECC collection tasks, such as disk image collection, RAM capture, network packet capture, SharePoint collection, launching commands, file deployments, etc.

See also: Worker PC

Collection

A specification for processing files or running a program or script, using one or more ECC Client computers to perform the actual processing.

Collections can be one of the following types:

Type	Description
Collect	Copies files meeting the selection criteria from one or more Target locations. The copies are saved at the specified Destination as raw files or packed within a FileSafe file. Original files in each Target location are left unaltered by collection activity.
Collect and Delete	Moves files from the Target locations to the Destination. First the files which meet the selection criteria are collected and saved at the specified Destination, then the original files are deleted.
Delete	Deletes files meeting the specified selection criteria from the specified Target locations.
Survey	Lists files meeting the specified selection criteria and residing in the specified Target locations. File listings include metadata such as creation date, MD5 hash value, etc.
Launch Command	Executes the specified non-interactive program or script on the computer associated with each selected Target.

Both the data locations and the ECC Client computers are specified by one or more Target selections. Collections also specify the file selection Criteria, the Destination path to save collected files to (for certain collection types), and a start time.

Each collection belongs to a specific Case. A Case may have multiple Collections, e.g. a Collection from all executive's computers, another Collection from all manager computers, a third Collection from non-managerial staff, and a fourth from server files. Collections could also be distinct due to different file selection criteria, such as file modification date range or file specification patterns.

Before a Collection can be created, ECC Client must be installed on one or more computers on the network, and Custodians and their associated Targets must be added via ECC Administrative Console.

See also: Target, Selection Criteria, Job XML Template, Job, JobFile, Survey Only Collection

Collection Administrator

A designated staff member with authorization to manage the Collection process using the ECC Administration Console. Collection Center permits multiple Collection administrators; ECC Administration Console may be installed on multiple computers.

Collection administrators typically coordinate with senior management and computer systems administrators to:

Obtain authorization and access to workstation and server computers across the organization, as needed

Oversee or conduct the installation of ECC Server, ECC Administration Console and ECC Client

Oversee or conduct the export of mailbox and public folder data stores from Microsoft Exchange Server to PST files

Collection administrators typically coordinate with the legal team and/or with project managers involved in the file collection project to:

Set up Cases, designate Custodians and the file locations (Targets) those Custodians utilize, establish Groups of Custodians, and to configure Destinations and Schedules for individual Collection runs. All these tasks are accomplished through the Administration Console.

Collection Configuration

A named bundle of settings, used as a template for creating new Collections quickly. A Collection Configuration can include any of the fields available in the first four pages of the New Collection Wizard, as well as the name of the underlying Job XML Template from the fifth page of the Wizard.

Crawl

The process by which a running Collection searches through various Targets (file locations) to gather files. The crawl process notes each file and sub-folder to be processed, along with statistics such as the total number of files and total bytes.

A Survey Collection can crawl drives, folders and network shares to generate logs of what would be processed – without actually processing any files.

See also: Crawl Database, Survey Only Collection

Crawl Database

A database, consisting of two files, created by ECC Client and saved in the Logs sub-folder for each Target:

Destination Folder\{Case Name}\{Collection Name}\{Custodian Name}\{Target Name}\Logs

The database contains the list of files and folders detected during the Collection's crawl process, along with statistics such as the total number of files and total bytes to be processed.

The database also stores log entries which record the status of the full collection process, including a list of files successfully processed, the total number of files and total bytes processed, plus any errors or warnings that occurred.

The \Logs folder and the database files within it should be retained for as long as necessary, according to your organization's policies.

See also: Crawl, Examining Collection Logs & Reports

Custodian

People or entities responsible for files at specific Targets. Custodians are typically specific managers and staff who keep files relevant to a Case.

Once the organization's Custodians and their specific Targets are entered into the system, it is very easy to select the files to be processed in a given Collection run.

Destination

A folder or network share where collected files are stored, and the format in which the files will be saved. The Destination can be a folder on a portable hard disk but is more often a network share on a server volume, NAS device or SAN device.

Care must be taken to specify Destinations with sufficient free disk space to store the collected files. If multiple Collections will store files at Destinations residing on the same physical disk or array, take care to:

Ensure free disk space is sufficient to store files from all the Collections.

Ensure Collections are scheduled to run in a staggered fashion, if necessary, so that disk I/O at the Destination does not become a performance bottleneck.

See also: Destination Type, FileSafe, Native Files, HTML

Destination Type

The kind of files that a Collection will save at the specified Destination.

Destination Types (formats) include:

Type	Description
Native Files	Copies of the original files
FileSafe	An evidence file format, containing multiple files and folders with metadata intact
HTML	For storing files collected from SharePoint servers

See also: Destination, FileSafe, Native Files, HTML

Disk Image Collection

A complete copy of a logical volume or an entire physical disk. Disk images include all the readable data for the volume or disk, including any unallocated sectors (which can contain the content of deleted files).

Because disk images are much larger than a "targeted file collection", they take more time to capture and transmit, as well as take more disk space to store. Furthermore, more time and disk space are required for disk images when performing any subsequent indexing and searching of the data (using a program such as Nuix Workstation™, licensed separately). For these reasons, disk images are generally used only for critical matters such as criminal investigations, or when mandated by a court order.

See also Physical Disk, Logical Volume, Targeted File Collection

Domain

A private Active Directory network which may include computers, printers, users, groups and organizational units across one or more connected local area networks. A domain can also refer to a top-level domain registered in the Internet's public Domain Name System (DNS), such as google.com.

See also: Active Directory, Domain Controller, Domain Name, Workgroup

Domain Controller

A server on an Active Directory network responsible for the network directory of users, security groups, computers, printers, etc. Such servers typically run Microsoft Windows Server 2008 or newer. Each new version of Windows Server has come with a new version of Active Directory.

When a domain user logs into a computer that is a member of the domain, their login is authenticated by a Domain Controller. Login scripts for Active Directory domains generally live on a domain controller.

See also: Active Directory, Domain, Domain Name, Workgroup

Domain Name

The name of the private Active Directory domain. This is typically a single word, e.g. MYDOMAIN; however, domain names may end in a suffix, such as MYDOMAIN.org, MYDOMAIN.com, or MYDOMAIN.net.

User IDs are sometimes prefixed with the Domain Name and a backslash, e.g. MYDOMAIN\MyUser, to distinguish domain User IDs from local User IDs.

Domain names can also refer to public domains registered in the Internet's public Domain Name System (DNS), such as google.com.

Computers on the domain are identified by their computer hostname together with the domain name and domain suffix, e.g. mycomputer.mydomain.org. Such names are referred to as Fully Qualified Domain Names, and appear in URLs such as https://mycomputer.mydomain.org:9443. IP address resolution is handled by DNS and the hosts file.