Sample Powerpoint Explaining Data the process of eDiscovery

Global CompuSearch, llcDigital Forensics and Electronic Discovery

Brandon Jelinek, MCP (Director of eDiscovery)

[email protected] | 509.443.9293

Practical Tech Advicefor the Non-Tech Attorney

National Business InstituteSeminar




Brandon Jelinek• Microsoft Certified Professional• Forensics and eDiscovery past 7 years.• Father of 4 children that will never be

able to hide anything from dad

1982-2014 : (32 Years)• Software programmer from Basic, to C#,

to Java• Hardware support from entry level

technician to Regional Director of Technologies covering 9 states.

• Awarded “Most costly computer system in the Office”




Our CompanyGCS is based in Spokane and has a unique team, built to address the wide variety of digital evidence used in the courtroom.

Digital Evidenc

e

Forensic Analysis

SpecialistMobile Devices

Specialist

Computer Security

Specialist

Corporate eDiscovery Specialist

Investigations Specialist

Computer Systems Specialist

Video and Image

Specialists

Trial SupportSpecialist

• Digital Forensics

• eDiscovery• Secured

Litigated Data Storage




Technical challenges with eDiscovery




The Basics of What we are asking of TechnologyThere are only 10 types of people in the world. Those who understand binary and those who don’t.




Layer 1 (On our screen)Like the layers of an onion. The evidence we are looking for has layers of complexity.




Layer 2 (The Real Text)The text in the document actually looks like this before microsoft word reformats it.

8÷£á..QÃ2.ö.UX.Á£¾CX..!.. º°¬.EÝ¶*¥Áªmsý,.2.»Ñ..¡¢\.¨.gðëj¥.p.ìÕ²..¥.¯X·ôù..ï\ê.ð.î)Í.Â{D¸.õô.V]ë.¯Öà.·)Ë.ÀûlpÙÏs..¯.oÎ_EIò{.3ìÊlo¿.-RùYX_âÒ.Ó.ª©uV.ÙÎ~..uÎØ.¶..V½3ü+...ïô°[G9¼.¤ÃN®3..mp..wãq.)P.¶÷ .õQ©.ëL...¦ªÕ.c.:XKÏZ¨.+z"¤-.¥Û..ú.G®û.WüÀÐ{.æ57...XÇË.5._......Q5F..V2@.[±²ù..Å.].PÔ.îfö|À..ëÇ Ýtx:ËDGKr..¸.¦±¥a...)ÝnF³³ÅùL$Z,Øý.T¿ËÒsa..:ÄÉNæ.ø·ú:ôLE.p;Ï$.¸N.3æruíÉ`+¨ZÕ1ÔN5.6ç..GÕ.ôÿ.èZNÖÄZ..M.â-¥ØhAÌºuÄõÄî±¦í)eÚeúS..z2}..OxÚ42õ¤.Á.M'x4..]dã7sJ...â<ÉiCüÌ.â"/kEÜH£Ö]¢%hP«Á.©ûË@öO¦.0óÔ æ.'.E6ó.aö..ñ.3Ï¯Ù`^z.Y¤.½ÁlYùÖlû...'©l .{.]Ä_Þ@W.bM0¨ùO..Ús,b.É.&x6È.å.'(Å4çJ.ý>*°í..+ñ[email protected]{¥).Ä.XÐ4¡...ò.CoÎÄ¾.é.ØzÁ.´,Hø±~Vm.O½pÐDO.À..ði«Ê³UÙ.Û.°7± /TDV2Æü.Ë.ÁãFþÜ..©§,U\&}]ºz}9(.ºjÏ¶E©/.©èS9¡..M'C)A±-R& É.îcW)..W.W,{.¢*)&ÞkÙ@.¿î²Í.íù.&.È.R;¹÷.K.O½ôÇçò.Ñ..®.. ..i¢.xï44Óïå5;S¨¨m.&.êÄ`d..9!3(÷..Û$:B6.Ý.CV_/óø³Ú.'îß.mG¿.i\lÍvIê.µ..Nv¤2uiþðÞûòy.ß«íf.nÙ.*.ÎÛ..¥¤ß«í.¦âq'ouºMýzÒ¯éðL.o¢)ÜNÏ..!¼#.6s..ä.£Ê.o..G#fÝÇ[email protected];!.¡ó·...åGûÆH.É°¥j.kÂ.¯?ó.KcÖ2}E%6..Ö\g=@3øEfþLût$..D|.T«6.Na.JíJèM)<.¨ý.¶û«Ø@Í.fb&wWkÃ6B2Ý[).¬.ë2hxÃ.»Aï_l´g..KßÀ.½.3óÅwøí..¢g6É.àà³D\ø®Æ..Ã.2¹3U=-ì..e=Çb>).V¹.Ü³7á/Sf¬.øª..¨o.~¸Ô#Ô Û9@àÓL.¢ÚH[.X.ÍTM{¨ºª³..\Ä.¦¦~[®Å..tÐ0·N.Ê.º4n¾M...í.$hè.a.#ÖjÊcÁ|.©@ÎÄ..®*]ÚfA...*a.øÀ²NpÜüoLe.á"7..0.+râ|7tên.¥iePÇó·ÃeÆÅuøþ©Qr.©ï©..,îS]0Ô.f.d.m?ÂôJü0..c,..àLõ;Lì..ªßa2Ì¦mÝ:Ðõ*TMØ¥ïUW´áÎ¹Í¸¦é.r×.m©B§,ÿ.¯ù(Eª .åà.-B0Ø8k.©=-.É.c.ÂêéxbÏÔ.Vi×¦.j..mQÀ¬..§çË.¹|.Ëw.9.=]Ä..kE..¡üG¾èá.ß..¿ÝÀü.y.D®î¥.ý.j_*@U¡x.ÛØ.¦..¶éª¾?Á¶PhQ¡P.ñÐvhíK³x.å.0õ.XüÚ.ÿ17þÛn0:Gü:ÂS..5à.Ç.ÊÆ6&;¡¼.O^É5¶. »û. x^¾2¼¸:sm.Ù|. n.ØfG¾óR§.*¬.e ª..ÖW¶ºÌú.Ä."7}..¯1..ºÃ« .×yÌÝ¾æwðü.þø -û .T.7%î´j÷.fè°é×¤²-?Üæ.úZßêÇ[êZ#Ë..-ÞP_],.OÎd..0Y2 .Rù¢º¾bç|!×¹Ú5¸ddó:^r!ê<Á!x{Ò.à.C...þ.wðüY-.êðmô&.üÔÐµ.o..D.w$´v.éóµ%.B[0MÑ.ZT<ù:..Ih.Ý.?ìbv¼¥.ªÙi£7Í...jv¼..ßì¤..Ïþ...ÿÿ..PK..........!.[}Ãs....YG......word/numbering.xmlì\Ûnã6.}/Ð.0.ø1±n.lc..íDE.ÛEÑMÑgYfbau.%Û.×ý.~B?k.¡CÑR¬.%.¾D(ô.Ç.HÍçÌ..).øøÝuz[.CÛ÷¦.t+=äYþÊö^¦Â_OÆÍHè..é LÇ÷ÐTxE¡ðñî×_>ì&ÞÆ]"7ö`/.ì.k*¬£(..¡µF®.Þº¶.ýÐ..n-ß.øÏÏ¶..;.¯.²(.ñ..ö-..0ÎÂô¶f(ì.s.£ù.òàYÏ>vÍ(¼õñËÀ5ñ·Mp.£.fd/mÇ.^alQK.ñ§Â.{.½@7©@¤Ë.´ÿHzà..%Ï¥=ï}kã"/..8ÀÈ..|/\ÛÁ..¼£..ëD¤m..[×IîÛ..Zx^ªr.9¸Çæ.¦âmÀÂp%ÆXÑN®Cí@æ÷mVó#Jb.2û.!C¤24.!ûÌD.×´½t.>Ó... q..ÿ.ýM.




Layer 3 (HEX the rule 4,8,16,32,64,128…)F010101010100F0001D0001ABB0000900019866CC0101001080010F8FD01010011DEB88D01018000160101D00000101CAD9D68CB8D01017CEAA9C00017B700116A0010E0001CED7FB69D7DD6898001000000100D6BEE00108D6E9B0101D6DE010100100001E90101F60001010186001001008C9ECF6010099D600100001F790100B000000110000010180100EB0010FAF000000108E00100101601000100A0010CAF01008801010100FBA010100000001000198C0011A9010100009B0011E001001000011D0001B0001FBC700118A01000101C0100CB00000011B901010010801016F01018B7D01000001A770100A000100108EFB68010001000101010186D800116E68DCD6ED00019CB0010AB00010100E00000011D6DC01010100C7801000001D0011001190001B9CBCAEFB0101001100110010601018EF0010BE0011700010010CED88AC00100010010096A000000100101F010100100001700110101F6BCD600118B6E8F0001C000100100000000070011BEDC0000B0001C6F0100900000100C000101006A010070001FA01010011ED0011DFAD7B7BC0101D0100801017010179D670010CB0101C0011FEB900108B7D8A00009EAAB010000016AB00019ADBEAD7D7AB80011001101000001F0001001000100101A60011B6FD0010FE66600000100DBDBE9001000119001096F0001010189001086A00110011D01000101CE970011E0101A010100110000A6EBEC010160011D8EBD0010C6880101DE8800100010C0101B6C0011D000080100000101016001180010C001170101600119DFAA60001E7701017E0001B00000011FE00007700006C0101A77BCF6AEE01000011ADDF70011CA901016CB80000F000079010000110101600000100D6D0011601009001078B0011E010100010100E01000000600000001A87ACDA98AD901007A0001010000017C7BDA9BDD0010960101B0100CD0000EACCC6A0010666DE01008E0101000001010010A80100001160101D0001E00018DCA6660100ACCA010001018FED0101010160011AFA001001016C0010D0101B6990000800010011A00010001860100C010100108EE8000187DEB001000100100B0100B00118E0001B0001000100110101AD0010760100CB69ADA9A0101ED0011900106C887700117010100010000F00010100001070001C0001001101009B0101D76B9A8670010D60101A0011901019B80011F0001CCEF770000F010100116BBEA001190101AC7DAC000076DD90001C001178C010088B0000801000101D01009C80000001100006DBEC01010100001101019AD00100100001190010E9ACCA68E

Numbers 0-9Letters A-FMake up a system called HEX. Which used for grouping bits.




Layer 4 (The Real data on your device)000000001011101000000001000000010000000000000000110110110000000100000001111011100110111100000001000000001110011111001011000000010000000011111101011010011011100000000000000100011001101111010000000100000000000000000001000110111010011100000000000100011100000000000000000001101010111101100000000000000001000000010000000110011101000000010000000110100000000000000000110110001001101100000000101110100000000100000001000000000000000011011011000000010000000111101110011011110000000100000000111001111100101100000001000000001111110101101001101110000000000000010001100110111101000000010000000000000000000100011011101001110000000000010001110000000000000000000110101011110110000000000000000100000001000000011001110100000001000000011010000000000000000011011000100110110000000010111010000000010000000100000000000000001101101100000001000000011110111001101111000000010000000011100111110010110000000100000000111111010110100110111000000000000001000110011011110100000001000000000000000000010001101110100111000000000001000111000000000000000000011010101111011000000000000000010000000100000001100111010000000100000001101000000000000000001101100010011011000000001011101000000001000000010000000000000000110110110000000100000001111011100110111100000001000000001110011111001011000000010000000011111101011010011011100000000000000100011001101111010000000100000000000000000001000110111010011100000000000100011100000000000000000001101010111101100000000000000001000000010000000110011101000000010000000110100000000000000000110110001001101100000000101110100000000100000001000000000000000011011011000000010000000111101110011011110000000100000000111001111100101100000001000000001111110101101001101110000000000000010001100110111101000000010000000000000000000100011011101001110000000000010001110000000000000000000110101011110110000000000000000100000001000000011001110100000001000000011010000000000000000011011000100110110000000010111010000000010000000100000000000000001101101100000001000000011110111001101111000000010000000011100111110010110000000100000000111111010110100110111000000000000001000110011011110100000001000000000000000000010001101110100111000000000001000111000000000000000000011010101111011000000000000000010000000100000001100111010000000100000001101000000000000000001101100010011011

Bits…No matter how you store them they are the actual data.




The task before usFindRead

ReduceProduce




Find data in systemsPersonalDesktop Computer Laptop Computer Facebooks’s Computer

Phones and Tablets Web Storage




Find data in systemsPersonalPlayStations Home Network Storage Cameras




Find data in systemsSmall Business




Find data in systemsMedium Business




Large Business




The hidden data (Meta Data)ADDRESS 500 FOLDERTYPE 501 BITMASK 510 PATTERN_START 484 PATTERN_TEXT 497 PATTERN_DATE 496 PATTERN_NUMERIC32 495 PATTERN_NUMERIC64 494 PATTERN_END 498 LIST 4096 MULTIVALUED 4096 BODY_PLAIN 0 Plain BODY_HTML 1 HTML BODY_RTF 2 RTF BODY_RTFCOMP 5 RTF Compressed BODY_IMAGE 3 Image BODY_CODE 4 Code BODY_BASE64 6 Base 64 BODY_LOTUSBINARY 7 Binary CONTENT_ENCODING_NONE 0 None CONTENT_ENCODING_BASE64 1 Base 64 CONTENT_ENCODING_QUOTED_PRINTABLE 2 Quoted Printable CONTENT_ENCODING_UUENCODED 3 UU Encoded TYPE_DBX 0 Outlook Express (DBX) TYPE_AOL 1 AOL Personal Filing Cabinet TYPE_PST 2 Outlook (PST) TYPE_LOTUS 3 Lotus (NSF) TYPE_EDB 4 Exchange (EDB) TYPE_MIME 5 MIME Email Message TYPE_MBOX 6 MBOX TYPE_SHAREPOINT 7 SharePoint store TYPE_VAULT 8 Symantec Enterprise Vault Store TYPE_EXCHANGE 9 Exchange store TYPE_MSG 10 MSG File TYPE_EML 11 EML File TYPE_DXL 12 DXL File TYPE_LIVELINK 13 LIVELINK TYPE_DOCUMENTUM 14 DOCUMENTUM TYPE_POP3 15 POP3 TYPE_IMAP 16 IMAP TYPE_SHAREPOINT_2 17 SharePoint store TYPE_P8 18 IBM FileNet P8 Store TYPE_IBMCM 19 IBM Content Manager Store TYPE_AMAZON_S3 20 Amazon S3 Store TYPE_CONNECTIONS 21 IBM Connections Store TYPE_LOTUS_QUICKR 22 Lotus Quickr Store TYPE_EMLX 23 EMLX TYPE_BOX 24 BOX SMIME_STATE_NONE 0 None SMIME_STATE_DECRYPTED 1 Decrypted SMIME_STATE_SIG_VERIFIED 2 Signer verified SMIME_STATE_DEC_SIG_VERIFIED 3 Decrypted/Signer verified SMIME_STATE_SIG_NOT_VERIFIED 4 Signer not verified SMIME_STATE_DEC_SIG_NOT_VERIFIED 5 Decrypted/Signer not verified SMIME_STATE_NOT_DECRYPTED 8 Encrypted DOCTYPE_EMAIL 0 Email DOCTYPE_CONTACT 1 Contact DOCTYPE_APPOINTMENT 2 Appointment DOCTYPE_JOURNAL 3 Journal DOCTYPE_NOTE 4 Note DOCTYPE_STICKYNOTE 5 Sticky Note DOCTYPE_TASK 6 Task DOCTYPE_DOCUMENT 7 Document DOCTYPE_CMS_METADATA 8 CMS Metadata LINKTYPE_DATABASE 1 Database link LINKTYPE_VIEW 2 View link LINKTYPE_DOCUMENT 3 Document link LINKTYPE_ANCHOR 4 Anchor link LINKTYPE_HOTSPOT_LINK 5 Hotspot link LINKTYPE_HOTSPOT_FORMULA_URL 6 Hotspot formula URL LINKTYPE_HOTSPOT_TEXT_URL 7 Hotspot text URL LINKTYPE_HOTSPOT_TEXT_POPUP 8 Hotspot text popup LINKTYPE_HOTSPOT_FORMULA_POPUP 9 Hotspot formula popup LINKTYPE_HOTSPOT_ACTION 10 Hotspot action ENVELOPE_TYPE_ROOT_FOLDER 1 Root folder ENVELOPE_TYPE_INTERNET_FAVORITE 2 Internet favorite ENVELOPE_TYPE_DOWNLOAD_MANAGER 3 Download manager ENVELOPE_TYPE_DOWNLOADED_FOLDER 4 Downloaded folder ENVELOPE_TYPE_DOWNLOADING 5 Downloading ENVELOPE_TYPE_DOWNLOAD_LINK 6 Download link ENVELOPE_TYPE_EMAIL_RECEIVED1 7 Email ENVELOPE_TYPE_EMAIL_RECEIVED2 8 Email ENVELOPE_TYPE_EMAIL_OUTBOX 10 Email outbox ENVELOPE_TYPE_NEWMAIL_FOLDER 11 New mail folder ENVELOPE_TYPE_WRITTEN_EMAIL 12 Email ENVELOPE_TYPE_BOOKMARK 13 Bookmark ENVELOPE_TYPE_POSTINGS_OUTBOX 16 Postings outbox ENVELOPE_TYPE_ADDRESS_LIST 17 Address list ENVELOPE_TYPE_ADDRESS_BOOK 19 Address book ENVELOPE_TYPE_EXTRA_VISUAL 29 Extra visual ENVELOPE_TYPE_SIGNATURES 23 Signatures ENVELOPE_TYPE_BUDDY_AWAY 24 Buddy away ENVELOPE_TYPE_BUDDY_PREFS 25 Buddy prefs ENVELOPE_TYPE_BUDDY_ICONS 26 Buddy icons ENVELOPE_TYPE_JUNK 30 Junk ENVELOPE_TYPE_EXTRA_ICONS 34 Extra icons ENVELOPE_TYPE_DEVICES_FOLDER 200 Devices folder ENVELOPE_TYPE_LOCALITIES_FOLDER 201 Localities folder ENVELOPE_TYPE_CONNECTION_TYPE 202 Connection type ENVELOPE_TYPE_ACCESS_TYPE 203 Access type ENVELOPE_TYPE_COUNTRY_CODE 204 Country code ENVELOPE_TYPE_AREA_CODE 205 Area code ENVELOPE_TYPE_ACCESS_NUMBER 206 Access number ENVELOPE_TYPE_ACCESS_NAME 207 Access name ENVELOPE_TYPE_PFC_VERSION 305 PFC version ENVELOPE_TYPE_EMAIL_ATTACHMENT 65535 Email attachment NONE 0 None PICTURE 1 Picture APPLICATION 2 Application APPLICATION_DATA 3 Application Data ARCHIVE 4 Archive CODE 5 Code COMMUNICATION 6 Communication DATABASE 7 Database DOCUMENT 8 Document DOCUMENT_CHART 9

Document - Chart DOCUMENT_FAX 10 Document - Fax DOCUMENT_PRESENTATION 11 Document - Presentation DOCUMENT_SPREADSHEET 12 Document - Spreadsheet EMAIL 13 Email ENCRYPTION 14 Encryption EXECUTABLE 15 Executable FONT 16 Font FORENSIC 17 Forensic INTERNET 18 Internet LIBRARY 19 Library MISC 20 Misc MULTIMEDIA 21 Multimedia MULTIMEDIA_AUDIO 22 Multimedia - Audio MULTIMEDIA_VIDEO 23 Multimedia - Video PLUGIN 24 Plug In SCRIPT 25 Script WINDOWS 26 Windows UNKNOWN 27 Unknown FOLDERCAT 28 Folder IT_NONE 0 None IT_ENTRY 1 Entry IT_FILE 2 File IT_EMAIL 3 Email IT_DOCUMENT 4 Document IT_RECORD 5 Record MSG_PHONETERMINATED 0 Phone Terminated MSG_PHONEORIGINATED 1 Phone Originated MSG_DELIVERYREPORT 2 Delivery Report MSG_PICTURE_MSG 3 Picture SMS MSG_PICTURETEMPLATE 4 Picture Template MSG_UNKNOWN 5 Unknown NETWORK_HOME 6 Home NETWORK_ROAM 7 Roaming NETWORK_NONE 8 None NETWORK_SEARCHING 9 Searching Network NETWORK_NOTSEARCHING 10 None, Not searching NETWORK_NOSIM 11 None, No SIM FILE_DIRECTORY 12 Directory FILE_JAVAJED 13 Java Jed FILE_IMAGE 14 Image FILE_RINGTONE 15 Ringtone FILE_JAVAJAR 16 Java Jar FILE_JAVARMS 17 Java Rms FILE_FILE 18 File CALL_DIALED 19 Dialed CALL_MISSED 20 Missed CALL_RECEIVED 21 Received ENTRY_VOICEMAILBOX 22 VoiceMailbox ENTRY_SPEEDDIAL 23 Speed Dials ENTRY_CALLERGROUP 24 Caller Groups ENTRY_OWNNUMBERS 25 Own Numbers MEMORY_SIMCARD 26 SimCard MEMORY_PHONE 27 Phone MEMORY_STORAGE_CARD 28 Storage Card MEM_ALL 29 Entire Memory MESSAGE_SEND_REQUEST 128 m-send-req MESSAGE_SEND_CONFIRMATION 129 m-send-conf MESSAGE_NOTIFICATION_INDICATOR 130 m-notification-ind MESSAGE_NOTIFY_REPONSE 131 m-notifyresp-ind MESSAGE_RETRIEVE_CONFIRMATION 132 m-retrieve-conf MESSAGE_ACKNOWLEDGE_INDICATOR 133 macknowledge-ind MESSAGE_DELIVERY_INDICATOR 134 m-delivery-ind RESPONSE_REQUIRED 128 Required RESPONSE_NOT_REQUIRED 129 Not Required REPORT_ALLOWED 128 Yes REPORT_NOT_ALLOWED 129 No HIDE_SENDER 128 Hide SHOW_SENDER 129 Show MESSAGE_CLASS_PERSONAL 128 Personal MESSAGE_CLASS_ADVERTISEMENT 129 Advertisement MESSAGE_CLASS_INFORMATIONAL 130 Informational MESSAGE_CLASS_AUTO 131 Auto PRIORITY_LOW 128 Low PRIORITY_NORMAL 129 Normal PRIORITY_HIGH 130 High MESSAGE_STATUS_EXPIRED 128 Expired MESSAGE_STATUS_RETREIVED 129 Retrieved MESSAGE_STATUS_REJECTED 130 Rejected MESSAGE_STATUS_DEFERRED 131 Deferred MESSAGE_STATUS_UNRECOGNIZED 132 Unrecognized STATUS_OK 128 Ok STATUS_ERROR_UNSPECIFIED 129 Unspecified error STATUS_ERROR_SERVICE_DENIED 130 Service denied STATUS_ERROR_MESSAGE_FORMAT_CORRUPT 131 Corrupt message format STATUS_ERROR_SENDING_ADDRESS_UNRESOLVED 132 Unresolved sending address STATUS_ERROR_MESSAGE_NOTFOUND 133 Message not found STATUS_ERROR_NETWORK_PROBLEM 134 Network problem STATUS_ERROR_CONTENT_NOTACCEPTED 135 Content not accepted STATUS_ERROR_UNSUPPORTED_MESSAGE 136 Message not supported ALARM_NONE 34 None ALARM_TONE 35 Tone ALARM_SILENT 36 Silent CALENDAR_SCHEDULE 37 Schedule CALENDAR_ANNIVERSARY 38 Anniversary CALENDAR_TASK 39 Task CALENDAR_CALENDARENTRY 40 Miscellaneous CALENDAR_BIRTHDAY 52 Birthday CALENDAR_MEETING 53 Meeting CALENDAR_CALL 54 Call CALENDAR_REMINDER 55 Reminder CALENDAR_PERSONAL 59 Personal CALENDAR_APPOINTMENT 60 Appointment CALENDAR_HOLIDAY 61 Holiday CALENDAR_NATLHOLIDAY 62 National Holiday CALENDAR_ENTERTAINMENT 63 Entertainment CALENDAR_BREAKFAST 64 Breakfast CALENDAR_LUNCH 65 Lunch CALENDAR_DINNER 66 Dinner CALENDAR_EDUCATION 67 Education CALENDAR_TRAVEL 68 Travel CALENDAR_PARTY 69 Party CAL_VACATION 70 Vacation CAL_BUSINESS 71 Business CALENDAR_UNKNOWN 56 Unknown TASK_PRIORITY_HIGH 41 High TASK_PRIORITY_MEDIUM

42 Medium TASK_PRIORITY_LOW 43 Low TASK_STATUS_DONE 44 Done TASK_STATUS_NOT_DONE 45 Not Done TON_UNKNOWN 0 Unknown TON_INTERNATIONAL 1 International TON_NATIONAL 2 National TON_NETWORK_SPECIFIC 3 Network Specific TON_DEDICATED_ACCESS 4 Dedicated Access NPI_UNKNOWN 0 Unknown NPI_ISDN_TEL 1 ISDN / Telephony NPI_DATA 3 Data NPI_TELEX 4 Telex NPI_PRIVATE 9 Private STATUS_DELETED 0 Deleted STATUS_READ 1 Incoming - Read STATUS_UNREAD 3 Incoming - Unread STATUS_SENT 5 Outgoing - Sent STATUS_UNSENT 7 Outgoing - Unsent STATUS_DRAFT 9 Outgoing - Draft STATUS_UNKNOWN 255 Unknown RECUR_NEVER 46 Never RECUR_DAY 47 Daily RECUR_WEEK 48 Weekly RECUR_OTHER_WEEK 49 Every other week RECUR_MONTH 50 Monthly RECUR_YEAR 51 Yearly TYPE_UNRESOLVED 65535 Mandatory TYPE_UNKNOWN 0 Unknown Browser TYPE_IEWIN 1 Internet Explorer (Windows) TYPE_IEMAC 12 Internet Explorer (Mac) TYPE_MOZILLA 2 Mozilla (Windows/Mac) TYPE_OPERA 3 Opera (Windows/Mac/Linux) TYPE_SAFARI 4 Safari (Mac) TYPE_MOZILLA3 5 Mozilla 3 (Windows/Mac) TYPE_CHROME 6 Chrome (Windows) DOWNLOAD_STATUS_NOT_STARTED -1 Not Started DOWNLOAD_STATUS_DOWNLOADING 0 Downloading DOWNLOAD_STATUS_FINISHED 1 Finished DOWNLOAD_STATUS_FAILED 2 Failed DOWNLOAD_STATUS_CANCELED 3 Canceled DOWNLOAD_STATUS_PAUSED 4 Paused DOWNLOAD_STATUS_QUEUED 5 Queued DOWNLOAD_STATUS_BLOCKED 6 Blocked DOWNLOAD_STATUS_SCANNING 7 Scanning COOKIE_URL_DOMAIN 0 Domain COOKIE_URL_HOST 1 Host COOKIE_URL_UNKNOWN 2 Unknown INTERNET_ARTIFACT_UNKNOWN 0 Unknown Type INTERNET_ARTIFACT_HISTORY 1 History INTERNET_ARTIFACT_HISTORY_DAILY 2 History\Daily INTERNET_ARTIFACT_HISTORY_WEEKLY 3 History\Weekly INTERNET_ARTIFACT_TYPE_HISTORY_TYPED_URL 4 History\Typed URL INTERNET_ARTIFACT_HISTORY_VISITED_LINK 5 History\Visited Link INTERNET_ARTIFACT_HISTORY_FORMS 6 History\Forms INTERNET_ARTIFACT_CACHE 7 Cache INTERNET_ARTIFACT_CACHE_AUDIO 8 Cache\Audio INTERNET_ARTIFACT_CACHE_CODE 9 Cache\Code INTERNET_ARTIFACT_CACHE_HTML 10 Cache\HTML INTERNET_ARTIFACT_CACHE_IMAGE 11 Cache\Image INTERNET_ARTIFACT_CACHE_TEXT 12 Cache\Text INTERNET_ARTIFACT_CACHE_VIDEO 13 Cache\Video INTERNET_ARTIFACT_CACHE_XML 14 Cache\XML INTERNET_ARTIFACT_CACHE_UNKNOWN 15 Cache\Unknown Type INTERNET_ARTIFACT_DOWNLOADS 16 Downloads INTERNET_ARTIFACT_BOOKMARKS 17 Bookmarks INTERNET_ARTIFACT_COOKIES 18 Cookies INTERNET_ARTIFACT_TYPE_KEYWORD_SEARCH 19 Keyword Search INTERNET_ARTIFACT_TYPE_LOGIN_DATA 20 Login Data INTERNET_ARTIFACT_TYPE_TOP_SITES 21 Top Sites INTERNET_ARTIFACT_TYPE_AUTOFILLS 22 Autofills INTERNET_ARTIFACT_TYPE_CACHE_FONTS 23 Cache\Fonts HISTORY_VISIT_TRANSITION_UNKNOWN 0 Transition Unknown HISTORY_VISIT_TRANSITION_LINK 1 Transition Link HISTORY_VISIT_TRANSITION_TYPED 2 Transition Typed HISTORY_VISIT_TRANSITION_BOOKMARK 3 Transition Bookmark HISTORY_VISIT_TRANSITION_EMBED 4 Transition Embed HISTORY_VISIT_TRANSITION_REDIRECT_PERMANENT 5 Transition Permanent Redirect HISTORY_VISIT_TRANSITION_REDIRECT_TEMPORARY 6 Transition Temporary Redirect HISTORY_VISIT_TRANSITION_DOWNLOAD 7 Transition Download VISIT_TYPE_TRANSITION_LINK 0 Transition Link VISIT_TYPE_TRANSITION_TYPED 1 Transition Typed VISIT_TYPE_TRANSITION_AUTO_BOOKMARK 2 Transition Bookmark VISIT_TYPE_TRANSITION_AUTO_SUBFRAME 3 Transition Auto Subframe VISIT_TYPE_TRANSITION_MANUAL_SUBFRAME 4 Transition Manual Subframe VISIT_TYPE_TRANSITION_GENERATED 5 Transition Generated VISIT_TYPE_TRANSITION_START_PAGE 6 Transition Start Page VISIT_TYPE_TRANSITION_SUBMIT 7 Transition Submit VISIT_TYPE_TRANSITION_RELOAD 8 Transition Reload CHROME_DOWNLOAD_STATE_IN_PROGRESS 0 In Progress CHROME_DOWNLOAD_STATE_COMPLETE 1 Complete CHROME_DOWNLOAD_STATE_CANCELLED 2 Canceled CHROME_DOWNLOAD_STATE_REMOVING 3 Removing CHROME_ENTRY_STATE_NORMAL 0 Normal CHROME_ENTRY_STATE_EVICTED 1 Evicted CHROME_ENTRY_STATE_DOOMED 2 Doomed

“What you see and what you don’t see is what you should get.”

Our Forensic and eDiscovery software has over 500 properties associated with files.




Reading the data Cause of Grey Hair

The most frustrating part is the error message never give you a good solution. Go ahead click the Help.




Reducing the load Get Rid of trash

• Eliminate duplicates

• Remove junk mail• Remove

documents similar to

• Remove system files




Producing it to others Production types

• PDF production on removable media

• Native format production

• Printed production

• Load File production

• PST email production

Sample Powerpoint Explaining Data the process of eDiscovery

Documents

Transcript of Sample Powerpoint Explaining Data the process of eDiscovery