E-Discovery Mapping for Backup Data Search
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional backup systems lack sufficient information to enable thorough electronic discovery searches, as they do not adequately track file access, modification, creation, or deletion events by users, making it difficult for legal teams to find relevant files during litigation or investigations.
Innovation Solution
A system and method that create e-Discovery mapping information by correlating file access events with backup data, using event data and backup catalog information to map file access events to respective file data, allowing for efficient searches of backup data for files accessed, modified, created, or deleted by specific users or groups during specified time periods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional backup systems store only file data without event data, then storage space is conserved and system simplicity is maintained, but the ability to perform e-Discovery searches is insufficient
Solution Approach 1:
The system collects and stores file access event data during normal backup operations, before any e-Discovery search is needed. This preliminary collection of event data (creation, modification, deletion, access events with timestamps and user information) ensures that when e-Discovery searches are required, the necessary information is already available without needing to retroactively gather it.
Solution Approach 2:
The patent introduces an intermediary component (backup system with event data collection capability) that bridges the gap between file server operations and e-Discovery requirements. This intermediary captures event data from file servers and maintains it in association with backup data, enabling e-Discovery searches without modifying the core backup or file server systems.
2Reliability
If backup systems collect and store detailed file access event data for all users, then e-Discovery search capability is improved, but data storage requirements and system complexity increase
Solution Approach 1:
The backup system is designed to serve multiple functions: traditional backup operations, event data collection, and e-Discovery searching. By making the backup system universal and multi-functional, the patent avoids creating separate specialized systems, thereby reducing overall system complexity while maintaining comprehensive e-Discovery capabilities.
Solution Approach 2:
The system allows flexible configuration of event data collection parameters, such as which file servers to monitor, which user groups to track, and what types of events to record. This parameter-based approach enables the system to adapt to different organizational needs and complexity levels, storing only the necessary event data rather than all possible data universally.
3Measurement precision
If backup systems implement comprehensive event data collection and mapping, then file retrieval accuracy for legal proceedings is improved, but processing time and computational resources increase
Solution Approach 1:
The system pre-processes and structures event data during backup operations, creating organized event logs with standardized formats and associations with backup data. This preliminary organization means that when e-Discovery searches are executed, the system is searching through pre-structured data rather than raw unprocessed information, significantly reducing search processing time while maintaining high identification accuracy.
Solution Approach 2:
The patent replaces manual or brute-force search methods with automated, structured querying mechanisms. The system uses organized event data structures and efficient search algorithms to quickly locate relevant files based on user, timestamp, and event type criteria, substituting computational efficiency for manual review processes.
Data Source
AI summary
Various embodiments of a system and method for enabling electronic discovery (e-Discovery) searches to be performed on backup data in a computer system are disclosed. The system and method may operate to receive backup data for a set of files and backup catalog information indicating meta-data for the files, such as the data locations of the files within the backup data. The system and method may also receive event data indicating access history for the files, and may create e-Discovery mapping information based on the event data and the backup catalog information. The e-Discovery mapping information may map file access events specified by the event data may to the meta-data for the respective files in the backup data. The e-Discovery mapping information may enable the backup data to be searched to find files relevant to a legal proceeding or investigation.