eDiscovery Vocabulary

Data Field

**See Field.

DOS

**See MS-DOS.

Date/Time Normalization

**See Normalization.

Double Byte Language

**See Unicode.

Bitmap

A Bitmap provides information on the placement and color of individual bits, as well as allows the creation of characters or images by creating a picture composed of individual bits (pixels).

AVI (Audio-Video Interleave)

A Microsoft standard for Windows animation files that interleaves audio and video to provide medium quality multimedia.

Bit

A bit (binary digit) is the smallest unit of computer data. A bit consists of either 0 or 1. There are eight bits in a byte.

Application

A collection of one or more related software programs that enable an end-user to enter, store, view, modify, or extract information from files or databases. The term is commonly used in place of "program" or "software." Applications may include word processors, Internet browsing tools, spreadsheets, email clients, personal information managers (contact information and calendars), and other databases.

Document (or Document Family)

A collection of pages or files produced manually or by a software application, constituting a logical single communication of information, but consisting of more than a single stand-alone record. Examples include a fax cover, the faxed letter, and an attachment to the letter - the fax cover being the "Parent," and the letter and attachment being a "Child."

Encryption Key

A data value that is used to encrypt and decrypt data. The number of bits in the encryption key is a rough measure of the encryption strength; generally, the more bits in the encryption key, the more difficult it is to break.

Cache

A dedicated, high speed storage location that can be used for the temporary storage of frequently used data. As data may be retrieved more quickly from cache than the original storage location, cache allows applications to run more quickly. Web site contents often reside in cached storage locations on a hard drive.

Corrupted File

A file damaged in some way, such as by a virus, or by software or hardware failure, so that it is paratially or completely unreadable by a computer.

Digital Fingerprint

A fixed-length hash code that uniquely represents the binary content of a file.

Disc Partition

A hard drive containing a set of consecutive cylinders.

Coordinated Universal Time (UTC)

A high precision atomic time standard with uniform seconds defined by InternationalTime and leap seconds announced at regular internals to compensate for the earth's slowing rotation and other discrepancies. Leap seconds allow UTC to closely track UniversalTime, a time standard based not on the uniform passage of seconds, but on the Earth's angular rotation. Time zones around the world are expressed as positive or negative offsets from UTC. Local time is UTC plus the time zone offset for that location, plus an offset (typically +1) for daylight savings, if in effect. As the zero point reference, UTC is also referred to as Zulu time (Z).

Cookie

A message given to a Web browser by a Web server. The browser stores the message in a text file. The message is then sent back to the server each time the browser requests a page from the server. The main purpose of cookies is to identify users and possibly prepare customized Web pages for them.

Data Set

A named or defined collection of data.

ARMA International

A not-for-profit association and recognized authority on managing records and information, both paper and electronic, www.arma.org.

DVD (Digital Video Disc or Digital Versatile Disc)

A plastic disc, like a CD, on which data can be written and read. DVDs are faster, can hold more information, and can support more data formats than CDs.

Encryption

A procedure that renders the contents of a message or file scrambled or unintelligible to anyone not authorized to read it. Encryption is used to protect information as it moves from one computer to another and is an increasingly common way of sending credit card numbers and other personal information over the Internet.

Agent

A program running on a computer that performs as instructed by a central control point to track file and operating system events, and take directed actions, such as transferring a file or deleting a local copy of a file, in response to such events.

Comma Separated Value (CSV)

A record layout that separates data fields/values with a comma and typically encloses data in quotation marks (example: excel).

False Negative

A result that is not correct because it fails to indicate a match where one exists.

Exchange Server

A server running Microsoft Exchange messaging and collaboration software. It is widely used by enterprises using Microsoft infrastructure solutions. Among other things, Microsoft Exchange manages email, shared calendars and tasks.

Directory

A simulated file folder or container used to organize files and directories in a hierarchical or tree-like structure. UNIX and DOS use the term "directory," while Mac and Windows use the term "folder."

Container File

A single file containing multiple documents and/or files, e.g. .pst, .nsf and .zip files. The file must be ripped or decompressed to determine volume, size, record count, etc., and to be processed for litigation review and production.

Database Management System (DBMS)

A software system used to access and retrieve data stored in a database.

Domain

A sub-network of servers and computers within a LAN. Domain information is useful when restoring backup tapes, particularly of email.

DLT (Digital Linear Tape)

A type of backup tape that can hold up to 80 GB depending on the data file format.

Document Type or Doc Type

A typical field used in bibliographical coding. Typical doc type examples include correspondence, memo, report, article and others.

Digital Signature

A way to ensure the identity of the sender, utilizing public key cryptography and working in conjunction with certificates.

Extranet

An Internet based access method to a corporate intranet site by limited or total access through a security firewall. This type of access is often utilized in cases of joint defense, joint venture and vendor client relationships.

Application Service Provider (ASP)

An Internet-based organization hosting software applications on its own servers within its own facilities. Customers rent the use of the application and access it over the Internet or via a private line connection.

Clawback Agreement

An agreement outlining procedures to be followed to protect against waiver of privilege or work product protection due to inadvertent production of documents or data.

Client/Server

An architecture whereby a computer system consists of one or more server computers and numerous client computers (workstations). The system is functionally distributed across several nodes on a network and is typified by a high degree of parallel processing across distributed nodes. With client-server architecture, CPU intensive processes (such as searching and indexing) are completed on the server, while image viewing and OCR occur on the client. This dramatically reduces network data traffic and insulates the database from workstation interruptions.

Email (Electronic Mail)

An electronic means for communicating information under specified conditions, generally in the form of text messages, through systems that will send, store, process, and receive information and in which messages are held in storage until the addressee accesses them.

Electronic Image

An electronic or digital picture of a document (e.g. TIFF, PDF, etc.).

Backup Data

An exact copy of ESI that serves as a source for recovery in the event of a system problem or disaster. Backup Data is generally stored separately from Active Data on portable media. Backup Data is distinct from Archival Data in that Backup Data may be a copy of Active Data, but the more meaningful difference is the method and structure of storage that impacts its suitability for certain purposes.

Embedded Object

An object embedded within another object, often appearing as an icon or hyperlink.

Domino Daatabase

Another name for Lotus Notes Databases versions 5.0 or higher.

Data

Any information stored on a computer. All software is divided into two general categories: data and programs. Programs are collections of instructions for manipulating data. In database management systems, data files are the files that store the database information. Other files, such as index files and data dictionaries, store administrative information, known as metadata.

CRM (Customer Relationship Management)

Applications that help manage clients and contacts. Used in larger companies. Often a significant repository of sales, customer, and sometimes marketing data.

Archival Data

Archival Data is information an organization maintains for long-term storage and record keeping purposes, but which is not immediately accessible to the user of a computer system. Archival data may be written to removable media such as a CD, magneto-optical media, tape or other electronic storage device, or may be maintained on system hard drives. Some systems allow users to retrieve archival data directly while other systems require the intervention of an IT professional.

Coding

Automated or human process by which documents are examined and evaluated using pre-determined codes, and the results recorded. Coding usually identifies names, dates, and relevant terms or phrases. Coding may be structured (limited to the selection of one of a finite number of choices), or unstructured (a narrative comment about a document). Coding may be objective, i.e., the name of the sender or the date, or subjective, i.e., evaluation as to the relevancy or probative value of documents.

Boolean Search

Boolean Searches use the logical operators "and", "or" and "not" to include or exclude terms from a search.

Alphanumeric

Characters composed of letters, numbers (and sometimes non-control characters, such as @, #, $). Excludes control characters.

Broadband

Communications of high capacity and usually of multimedia content.

Compression

Compression algorithms such as Zip and RLE reduce the size of files saving both storage space and reducing bandwidth required for access and transmission. Data compression is widely used in backup utilities, spreadsheet applications and database management systems. Compression generally eliminates redundant information and/or predicts where changes will occur. "Lossless" compression techniques such as Zip and RLE preserve the integrity of the input. Coding standards such as JPEG and MPEG employ "lossy" methods that do not preserve all of the original information, and are most commonly used for photographs, audio, and video.

Computer Forensics

Computer Forensics is the use of specialized techniques for recovery, authentication and analysis of electronic data when an investigation or litigation involves issues relating to reconstruction of computer usage, examination of residual data, authentication of data by technical analysis or explanation of technical features of data and computer usage. Computer forensics requires specialized expertise that goes beyond normal data collection and preservation techniques available to end-users or system support personnel, and generally requires strict adherence to chain-of-custody protocols.

Cross-Custodian De-Duplication

Culls a document to the extent multiple copies of that document reside within different custodians' data sets.

Custodian De-Duplication

Culls a document to the extent multiple copies of that document reside within the same custodian's data set.

Application Metadata

Data created by the application specific to the ESI being addressed, embedded in the file and moved with the file when copied; copying may alter application metadata.

Export

Data extracted or taken out of one environment or application usually in a prescribed format, and usually for import into another environment or application.

Data Mining

Data mining generally refers to knowledge discovery in databases (structured data); often techniques for extracting summaries and reports from databases and data sets. In the context of electronic discovery, this term often refers to the processes used to cull through a collection of ESI to extract evidence for production or presentation in an investigation or in litigation.

De-Duplication

De-Duplication ("De-Duping") is the process of comparing electronic records based on their characteristics and removing or marking duplicate records within the data set. The definition of "duplicate records" should be agreed upon, i.e., whether an exact copy from a different location (such as a different mailbox, server tapes, etc.) is considered to be a duplicate. De-duplication can be selective, depending on the agreed-upon criteria.

Backup Tape Recycling

Describes the process whereby an organization's backup tapes are overwritten with new data, usually on a fixed schedule determined jointly by records management, legal, and IT sources. For example, the use of nightly backup tapes for each day of the week with the daily backup tape for a particular day being overwritten on the same day the following week; weekly and monthly backups being stored offsite for a specific period of time before being placed back in the rotation.

Discovery

Discovery is the process of identifying, locating, securing and producing information and materials for the purpose of obtaining evidence for utilization in the legal process. The term is also used to describe the process of reviewing all materials that may be potentially relevant to the issues at hand and/or that may need to be disclosed to other parties, and of evaluating evidence to prove or disprove facts, theories or allegations. There are several ways to conduct discovery, the most common of which are interrogatories, requests for production of documents and depositions.

Chain of Custody

Documentation and testimony regarding the possession, movement, handling and location of evidence from the time it is obtained to the time it is presented in court; used to prove that evidence has not been altered or tampered with in any way; necessary both to assure admissibility and probative value.

Digital Certificate

Electronic records that contain keys used to decrypt information, especially information sent over a public network like the Internet.

ESI

Electronically stored information, regardless of the media or whether it is in the original format in which it was created, as opposed to stored in hard copy (i.e. on paper).

Electronic Document Management

For paper documents, involves imaging, indexing/coding and archiving of scanned documents/images, and thereafter electronically managing them during all life cycle phases. Electronic documents are likewise electronically managed from creation to archiving and all stages in between. Often referred to as ILM (information lifecycle management).

Embedded Metadata

Generally hidden, but an integral part of ESI, such as "track changes" or "comments" in a word processing file or "notes" in a presentation file. While some metadata is routinely extracted during processing and conversion for e-discovery, embedded data may not be. Therefore, it may only available in the original, native file.

Electronic File Processing

Generally includes extraction of certain metadata and text from files, identification of duplicates/de-duplication and rendering of data into delimited format.

EML

Generic email format.

COTS (Commercial Off-the-Shelf)

Hardware or software products that are commercially manufactured, ready-made and available for use by the general public without the need for customization.

Audit Log or Audit Trail

In computer security systems, a chronological record of when users logged in, how long they were engaged in various activities, what they were doing, and whether any actual or attempted security violations occurred. An audit trail is an automated or manual set of chronological records of system activities that may enable the reconstruction and examination of a sequence of events and/or changes in an event.

Database

In electronic records, a database is a set of data elements consisting of at least one file, or of a group of integrated files, usually stored in one location and made available to several users. Databases are sometimes classified according to their organizational approach, with the most prevalent approach being the relational database - a tabular database in which data is defined so that it can be reorganized and accessed in a number of different ways. Another popular organizational structure is the distributed database, which can be dispersed or replicated among different points in a network. Computer databases typically contain aggregations of data records or files, such as sales transactions, product catalogs and inventories, and customer profiles. SQL (Structured Query Language) is a standard computer language for making interactive queries from and updates to a database.

Electronic Record

Information recorded in a form that requires a computer or other machine to process it and that otherwise satisfies the definition of a record.

Active Data

Information residing on the direct access storage media (disc drives or servers) that is readily visible to the operating system and/or application software with which it was created. It is immediately accessible to users without restoration or reconstruction.

Archive, Electronic Archive

Long-term repositories for the storage of records. Electronic archives preserve the content, prevent or track alterations, and control access to electronic records.

Backup Tape

Magnetic tape used to store copies of ESI, for use when restoration or recovery is required. ESI on backup tape is generally recorded and stored sequentially, rather than randomly, meaning in order to locate and access a specific file or data set, all ESI on the tape preceding the target must first be read, a timeconsuming and inefficient process. Backup tapes typically use data compression, which increases restoration time and expense, given the lack of uniform standards governing data compression.

Custodian

Person having control of a network, computer or specific electronic files.

Disaster Recovery Tapes

Portable media used to store data for backup purposes.

Document Metadata

Properties about the file stored in the file, as opposed to document content. Often this data is not immediately viewable in the software application used to create/edit the document but often can be accessed via a "Properties" view. Examples include document author and company, and create and revision dates. Contrast with File System Metadata and Email Metadata.

Bibliographical/Objective Coding

Recording objective information from electronic documents such as date created, author/recipient/copies, and associating the information with a specific electronic document.

Active Records

Records related to current, ongoing or in-process activities referred to on a regular basis to respond to day-to-day operational requirements.

Disc/Disk

Round, flat storage media with layers of material that enable the recording of data.

Concept Search

Searching electronic documents to determine relevance by analyzing the words and putting search requests in conceptual groupings so the true meaning of the request is considered. Concept searching considers both the word and the context in which it appears to differentiate between concepts such as diamond (baseball) and diamond (jewelry).

Contextual Search

Searching electronic documents where the surrounding text is analyzed to determine relevancy.

Bates Number

Sequential numbering used to track documents and images in production data sets, where each page is assigned a unique production number. Often used in conjunction with a suffix or prefix to identify the producing party, the litigation, or other relevant information.

Beginning Document Number or BegDoc#

The Bates Number identifying the first page of a document or record.

Data Categorization

The categorization and sorting of ESI - such as foldering by "concept," content, subject, taxonomy, etc. - through the use of technology - such as search and retrieval software or artificial intelligence to facilitate review and analysis.

Annotation

The changes, additions, or editorial comments made or applicable to a document - usually an electronic image file - using electronic sticky notes, highlighter, or other electronic tools. Annotations should be overlaid and not change the original document.

End Document Number or End Doc#

The last single page image of a document.

DPI (Dots Per Inch)

The measurement of the resolution of display in printing systems. A typical CRT screen provides 96 dpi, which provides 9,216 dots per square inch (96x96). When a paper document is scanned, the resolution, or level of detail, at which the scanning was performed is expressed in DPI. Typically, documents are scanned at 200 or 300 DPI.

Data Formats

The organization of information for display, storage or printing. Data is sometimes maintained in certain common formats so that it can be used by various programs, which may only work with data in a particular format, e.g. PDF, html.

Document Date

The original creation date of a document. For an email, the document date is indicated by the date-stamp of the email.

Author or Originator

The person, office or designated position responsible for an item's creation or issuance. In the case of a document in the form of a letter, the author or originator is usually indicated on the letterhead or by signature. In some cases, the software application producing the document may capture the author's identity and associate it with the document. For records management purposes, the author or originator may be designated as a person, official title, office symbol, or code.

CPU (Central Processing Unit)

The primary silicon chip that runs a computer's operating system and application software. It performs a computer's essential mathematical functions and controls essential operations.

Electronic Discovery ("E-Discovery")

The process of collecting, preparing, reviewing, and producing electronically stored information ("ESI") in the context of the legal process.

Data Filtering

The process of identifying for extraction specific data based on specified parameters.

Data Extraction

The process of retrieving data from documents (hard copy or electronic). The process may be manual or electronic.

Artificial Intelligence (AI)

The subfield of computer science concerned with the concepts and methods of symbolic inference by computer and symbolic knowledge representation for use in making inferences - an attempt to model aspects of human thought process with computers. It is also sometimes defined as trying to solve by computer any problem once believed to be solvable only by humans. AI is the capability of a device to perform functions that are normally associated with human intelligence, such as reasoning and optimization through experience. It attempts to approximate the results of human reasoning by organizing and manipulating factual and heuristic knowledge. Areas of AI activity include expert systems, natural language understanding, speech recognition, vision, and robotics.

Caching

The temporary storage of frequently-used data to speed access.

Architecture

The term architecture refers to the hardware, software or combination of hardware and software comprising a computer system or network. The term "open architecture" is used to describe computer and network components that are more readily interconnected and interoperable. Conversely, the term "closed architecture" describes components that are less readily interconnected and interoperable.

CAD (Computer Aided Design)

The use of a wide range of computer-based tools that assist engineers, architects and other design professionals in their design activities.

De-NIST

The use of an automated filter program that screens files against the NIST list of computer file types to separate those generated by a system and those generated by a user.

Download

To copy data from another computer to one's own, usually over a network or the Internet.

Backup

To create a copy of data as a precaution against the loss or damage of the original data. Many users backup their files, and most computer networks utilize automatic backup software to make regular copies of some or all of the data on the network.

Cull (verb)

To remove a document from the collection to be produced or reviewed.