Evaluate Weigh the pros and cons of technologies, products and projects you are considering.

E-discovery product specifications

The product snapshots in this chapter highlight key specifications for a cross section of e-discovery tools.

E-discovery tools are designed to search through enterprise data in order to locate e-mail messages and other data that may relate to matters of corporate litigation. Discovery tools must be fast and far-reaching, using numerous search criteria to quickly process data from storage systems, servers, workstations and laptops. And, all of this work must impose little (if any) noticeable impact on network performance. The tools must also produce meaningful results that can be delivered in a form appropriate for litigation. The product snapshots in this chapter highlight key specifications for a cross section of e-discovery tools. The following products were selected based on input from industry analysts and SearchStorage.com editors, and specifications are current as of December 2007.

The following specifications have been provided by vendors and are periodically updated. Vendors are welcome to submit their updates and new product specifications to Matt Perkins.

Go to the first product snapshot, or select the desired product below:

  • AXS-One Inc.; Legal Discovery
  • FAST; Litigation Protection Solution
  • Guidance Software Inc.; EnCase eDiscovery Suite
  • Index Engines Inc.; Enterprise eDiscovery
  • Kazeon Systems Inc.; IS-1200-ECS appliance
  • Lucid8 LLC; DigiScope
  • Messagesolution Inc.; EAA DataDiscovery
  • Mimosa Systems Inc.; NearPoint Legal Email Discovery
  • Sherpa Software; Discovery Attender
  • StoredIQ Inc.; Intelligent eDiscovery appliance
  • Zantaz Inc.; Introspect

    Return to the beginning

    Product Snapshot #1

    Product: AXS-One Inc.; Legal Discovery

    Product details not available at this time.

    Detailed Specs: http://www.axsone.com/products_discovery.shtml
    Vendor URL: www.axsone.com

    Go to beginning

    Product Snapshot #2

    Product: FAST; Litigation Protection Solution

    Product details not available at this time.

    Detailed Specs: http://www.fast.no/thesolution.aspx?m=163
    Vendor URL: www.fast.no

    Go to beginning

    Product Snapshot #3

    Product: Guidance Software Inc.; EnCase eDiscovery Suite

    Discovery Speed: The speed of the search and collection will vary depending on the network connection. Typical search and collection times for standard 60GB drives will range from 45 minutes across the LAN to up to 90 minutes across the WAN, depending on connection speed.
    Discovery Capacity: EnCase eDiscovery Suite is scalable to the largest of environments and there is no limit on the number of files or size of storage the product can search.
    Native File Ingestion: EnCase eDiscovery Suite can search more than 400 different file types, including PSTs, NSFs, MS Office documents, and more.
    File Support: EnCase eDiscovery Suite can collect any file type.
    Search Scope: EnCase eDiscovery Suite can search and collect ESI across the enterprise from a central location from workstations, desktops, laptops, file servers, live messaging servers, user shares, data repositories, and removable storage media.
    Search Features: EnCase eDiscovery Suite can search and collect ESI across the enterprise from a central location from workstations, desktops, laptops, file servers, live messaging servers, user shares, data repositories, and removable storage media. Search and analysis can use any of the following criteria: file type (e.g., .doc, .xls, .ppt), key words (target specific content), metadata (creation, last written and/or last accessed times, etc.), patterns (Any social security or credit card number), hash values (i.e., "digital fingerprints"), and custodians (by user name or SID). Additionally, EnCase eDiscovery Suite offers full foreign language support including Unicode and Code Pages.
    Security Features: EnCase eDiscovery Suite relies on security at many levels. The SAFE (Secure Authentication For EnCase) is a physically and logically secured server that authenticates all users and controls all access to the network devices. The EnCase Examiner provides a comprehensive solution of advanced, network investigative tools. EnCase services running on network workstations and servers provide bit-level access to the machine where they reside. All data transfer between the Examiner client and the SAFE server and between the SAFE server and the network devices use 128-bit Advanced Encryption Standard (AES). The combination of these components provides a powerful and flexible framework that delivers enterprise-wide incident response, forensic analysis, and eDiscovery. In addition to ensuring secure communications between the various components of EnCase software, the system also allows for fine grained access controls including a role based security system that ensures different groups of users are allowed to perform only the activities they have been authorized to do. This is a critical feature of any enterprise class investigative solution because of the extensive access these types of systems require. User IDs are created with the utilization of PKI, and collected data is stored in the EnCase Logical Evidence File.
    Reporting Features: EnCase eDiscovery Suite's Generate Reports module enables reporting on all information about the search, identification, collection, and processing, on a per case basis. Information available includes, but is not limited to, what machines were searched, if the search completed, file path and metadata information about collected files, hash values for collected files, search criteria/terms used, and deduplication reports. The report documents the location of each responsive document; if deduplication is used, a log of the location of duplicate files is created. Reports can be generated documenting the search criteria used, and the information is stored in a database such as MS SQL Server.
    Deduplication: EnCase eDiscovery Suite has extensive processing capabilities which include de-duplication based on the MD5 hash value of the document. The product does not identify or eliminate near-duplicates.
    Production Capabilities: Encase eDiscovery Suite is not a review tool and does not have traditional production capabilities. Collected electronic data can be delivered as an EnCase Logical Evidence File, native files, a LexisNexis Concordance Load File, or a CT/Summation Load File.
    Legal Application Support: EnCase eDiscovery Suite can expose the native files collected to the review application of your choice. Additionally, the Review Platform Exporter module enables pushbutton load file creation for the attorney review platforms of LexisNexis Concordance and CT/Summation. Additionally, EnCase eDiscovery Suite will support the XML-XSD load file format of the EDRM (www.edrm.net), planned for Q1 2008.
    Hardware Requirements: For more information on system requirements, please visit: http://www.guidancesoftware.com/downloads/getpdf.aspx?fl=.pdf
    Vendor Comment: Guidance Software's EnCase eDiscovery Suite is the only eDiscovery search, collection, preservation, and processing software with extensive court vetting, and is accepted by courts worldwide (see the EnCase Legal Journal available at http://www.guidancesoftware.com/support/legalresources.aspx). .
    Availability: Currently available
    Base Cost: Cost is based on the number of nodes in the organization.
    Detailed Specs: http://www.guidancesoftware.com/products/eDiscovery_index.aspx
    Vendor URL: www.guidancesoftware.com

    Go to beginning

    Product Snapshot #4

    Product: Index Engines Inc.; Enterprise eDiscovery

    Discovery Speed: We index data at wire speed and perform sub-second search on this data following indexing.
    Discovery Capacity: Our entry level appliance can index up to 100 million objects (files or email). We deliver custom configurations for larger environments.
    Native File Ingestion: We search all common unstructured files (Office, pdf, text, multimedia, etc.) as well as email (Microsoft Exchange (EBD and PST), MBox (Internet email), and Notes support (NSF) is planned for 2008).
    File Support: All common unstructured file formats as mentioned above. Also CAD files and compressed files (tar, zip, etc.)
    Search Scope: We index files on offline tape, NAS, LAN, SAN and can search these files. One of the unique capabilities is the ability to index offline tapes directly and search this content for email, IM's, files, etc.
    Search Features: Full content search (Boolean search) and metadata search (dates, owner, location, etc.). Additionally we support pattern search such as Social Security number, and credit card numbers.
    Security Features: Discovery results are stored on our appliance and access to these results is controlled by a login to this unit. So only users will knowledge of the username and password can log in and search the contents.
    Reporting Features: We deliver detailed reports on the results of the indexing. For example once a tape is indexed we will report on the number of files, the types of files, and which files are encrypted or corrupt. Additionally we offer a full report on the files by Age Range, File Type/Extension, Location, Server, Owner, Size Range, Duplicate Content, and Patterns.
    Deduplication: We identify duplicate data and perform dynamic deduplication of data when it is queried. We do not eliminate duplicate files as legal teams do not want to have data deleted.
    Production Capabilities: We have an extraction capability that will rip responsive files and email from tape and restore them online keeping all metadata intact. This data can then be passed to the legal team for processing.
    Legal Application Support: We can produce a .csv text file of a query result – this text file can be imported into common eDiscovery document management systems.
    Hardware Requirements: Our solution is delivered as a plug and play appliance that can integrate into a LAN or SAN via network or fibre connection. We also can attach to a tape drive or tape library via a SCSI connection.
    Vendor Comment: Index Engines delivers the only solution that automates offline tape discovery, reducing time and cost 50 to 70%. We perform direct indexing of offline tape content allow this content to be searched and then extracted from tape without the need for the backup software.
    Availability: Currently available
    Base Cost: The base price of the product is $50,000 USD. The price scales depending on the features and the volume of data processed.
    Detailed Specs: http://www.indexengines.com/solutions_compliance_discovery.htm
    Vendor URL: www.indexengines.com

    Go to beginning

    Product Snapshot #5

    Product: Kazeon Systems Inc.; IS-1200-ECS appliance

    Discovery Speed: Speed depends on the search mode and varies on the environment; deep crawl performance of 47 MB/sec when scanning for content (168 GB/hour, 4 TB per day); sub-second response times for searches; sustaining 1,500 files per second for metadata and 700 files per second with search indexing.
    Discovery Capacity: A single Information Server appliance or Information Server software instance can index, classify and search from 6-10 TBs on average. Customers can implement clusters to derive near-linear scalability.
    Native File Ingestion: Microsoft Exchange servers, Symantec Enterprise Vault, Microsoft Exchange and SMTP-based Internet email journals, PST, OST, MSG and EML files. Over 370 document types.
    File Support: Unstructured ESI – Information stored on a "file system." This includes spreadsheets, word processing documents, presentations, text files, PDFs, etc. The folder structure on your home or office computer's hard drive and the files on them comprise an unstructured data collection. Your "H" drive is an unstructured ESI collection. Semi-structured ESI – email is the most common form of semi-structured data. It is semi-structured because a part of the data record, i.e. the email itself, is structured and the attachments, if they exist are unstructured. Structured ESI – The most common form of this data is uniformly fielded information stored in database tables in a tabular format.
    Search Scope: Complete range of unstructured, semi-structured and structured data. Includes email, laptops and desktops and extends support for data centers (CIFS & NFS) and remote offices with federation capabilities. Also has the ability to crawl, index, and search individual emails and attachments inside PST files, as well as take actions on selected (or entire) search results.
    Search Features: Kazeon's advanced search interface allows legal professionals to search for specific phrases, dates, email header information, user groups, locations, comments and more. Advanced search capabilities include keyword, wildcard, fuzzy, proximity, concept and Boolean searches. Metadata and content within documents and emails, including attachments, is searchable. Reviewers are able to search for relevant information and open documents and email directly from the search interface in the native application to conduct a more thorough review of a document or email. Tags such as "relevant," "nonrelevant" or "privileged" can be quickly applied to the document or email.
    Security Features: The Kazeon Information Server discovers sensitive information contained in emails and files regardless of physical or logical location. Kazeon not only classifies email and file metadata (e.g. mailto, mailfrom, owner, creation date, last accessed, size, format) but also provides a comprehensive set of rules that extract common, confidential patterns such as phone numbers, social security numbers and credit card numbers. In addition, key words and phrases contained in a document (e.g. "company confidential", "financial statement") can be accurately identified and automated policies enabled to prevent data loss.
    Reporting Features: Version 3 includes over 35 pre-built report templates. In addition, it is easy to create custom reports. For example: custodian, duplicate file and date range reports can be leveraged by paralegals and litigation support specialists conducting eDiscovery. Access pattern reports help compliance officers understand which documents and emails contain non-public information (NPI).
    Deduplication: Yes [no details provided]
    Production Capabilities: No production capabilities
    Legal Application Support: Able to work with standard legal/litigation support tools
    Hardware Requirements: The Information Server is a complete system that is delivered either as Linux-based software or a pre-packaged appliance.
    Vendor Comment: Kazeon is the first company to use Information Access technology to deliver eDiscovery solutions in response to litigation, information security and privacy, corporate investigations and regulatory compliance, and with this latest version, Kazeon now has the broadest set of email discovery and analysis capabilities in support of customer requirements for eDiscovery. Kazeon version 3 capabilities enable companies in every industry sector to use the Information Server to lower everyday eDiscovery management costs by up to 80 percent.
    Availability: Currently available
    Base Cost: $40,000 list price
    Detailed Specs: http://www.kazeon.com/products2/is1200-ecs.php
    Vendor URL: www.kazeon.com

    Go to beginning

    Product Snapshot #6

    Product: Lucid8 LLC; DigiScope

    Discovery Speed: Depends on query and scope complexity.
    Discovery Capacity: Not provided
    Native File Ingestion: Exchange 2000, 2003 and 2007 raw database formats .edb, .stm, .log files; 2000, 2003 and 2007 PST files; DigiVault data sets; All files can be loaded and searched simultaneously.
    File Support: Search message attachments selectively of type: PDF, DOC(X), XLS(X), PPT(X), XML and any other text file type, ZIP and RAW
    Search Scope: Selectively on server, storage group, ingested native files, then mailbox, then folders (for PST's only).
    Search Features: Search all 50+ Exchange meta data fields, body and attachments; Selectively search attachments types; Build and reuse complex queries; Use powerful expressions to search for things like social security numbers; Use password list to open attachments.
    Security Features: Not provided.
    Reporting Features: Not provided
    Deduplication: De-duplicate search results coming from multiple backup copies of the same store.
    Production Capabilities: Allows to open live Exchange server for search and restore functionality.
    Legal Application Support: Not provided.
    Hardware Requirements: Not provided.
    Availability: DigiScope 1.1 currently available
    Base Cost: 1 store license $595 until 2/29/08 (mailbox number count independent) after that $759
    Detailed Specs: http://www.lucid8.com/product/digiscope.asp
    Vendor URL: www.lucid8.com

    Go to beginning

    Product Snapshot #7

    Product: Messagesolution Inc.; EAA DataDiscovery

    Product details not available at this time.

    Detailed Specs: http://www.messagesolution.com/products_data.htm
    Vendor URL: www.messagesolution.com

    Go to beginning

    Product Snapshot #8

    Product: Mimosa Systems, Inc.; NearPoint Legal Email Discovery

    Discovery Speed: All eDiscovery searches are conducted against the SQL database in seconds.
    Discovery Capacity: The search capability is unlimited in the number of files that can be stored and searched.
    Native File Ingestion: The Mimosa NearPoint Archive captures and indexes all Microsoft Exchange objects, emails, attachments, calendar entries, task lists, contacts, drafts, and all attributes in near real-time.
    File Support: The Mimosa eDiscovery Option accesses the NearPoint Email Archive which captures and stores Exchange data in its native format, therefore the eDiscovery Option works with native Exchange data and produces results exportable in the PST format.
    Search Scope: The Mimosa NearPoint eDiscovery Option can search for all Microsoft Exchange objects including emails, attachments, calendar entries, task lists, contacts, drafts, and all attributes.
    Search Features: The Mimosa NearPoint eDiscovery Option can search all Microsoft Exchange objects based on custodian, date range, context, Boolean logic, advanced Boolean logic, proximity, message attribute, importance, size, tag and litigation hold.
    Security Features: All archive data is stored within the Mimosa NearPoint archive in a secure manner with all accesses tracked and reportable. One the responsive results sets are compiled, they are written to a password protected PST file for transport.
    Reporting Features: Reporting features include a data protection summary, smart extraction summary, mailbox extension summary, journal paging summary, archive .PST summary, restore to .PST summary, and NearPoint Volume Status Report.
    Deduplication: The Mimosa NearPoint email archive creates a single instance or de-duplicates all repeated content within the archive.
    Production Capabilities: Responsive results sets are written out to a .PST formatted file thereby conforming to the new FRCP amendments which requires retaining all original metadata and content in its original format.
    Legal Application Support: The Mimosa NearPoint eDiscovery Option produces an importable .PST file which can be imported into most of the leading case management applications.
    Hardware Requirements: Desktop Requirements: Microsoft Windows XP SP2, Microsoft Outlook 2003 SP1. Server Requirements: Windows Server 2003 R1, R2, SQL Server 2000 and 2005 SP1, Microsoft .NET FrameWork 2.0. Storage Requirements: Dependent of Exchange infrastructure and email traffic.
    Vendor Comment: The Mimosa NearPoint archival architecture based on transaction log shipping, offers significant advantages for legal discovery over journaling based email data collection. Only Mimosa NearPoint captures all discoverable contents of the Exchange mailbox, including email, calendars, contacts, and so on.
    Availability: Currently available
    Base Cost: The Mimosa NearPoint Email Archive and the eDiscovery option are priced per mailbox. The NearPoint Archive platform starts at $40,000 for 2,000+ mailboxes and the eDiscovery Software module starts a $16 per MB.
    Detailed Specs: http://www.mimosasystems.com/html/sol_legal_discovery.htm
    Vendor URL: www.mimosasystems.com

    Go to beginning

    Product Snapshot #9

    Product: Sherpa Software; Discovery Attender (for Exchange)

    Discovery Speed:
    Discovery Capacity: File and storage limits are dependent on results volume, however searches can be structured and licenses can be added to increase volume and offer maximum efficiency.
    Native File Ingestion: Live Exchange Mail Stores, .PST files (old and new formats), Microsoft Office, .PDF, .zip, and many more common file types.
    File Support: Can search any text base item. Discovery Attender offers a binary text (i.e. raw data) search option.
    Search Scope: E-mail and attachments stored in Exchange Stores, PST files, .MSG files, Files on Common File Servers, any network connected shared drive.
    Search Features: Search features include; search files; attachments; messages. Search criteria includes; keywords, dates, addresses, size, file type, msg type etc. Also allows use of wildcards, proximity, boolean logic for Keywords; Native and binary text searching; Multiple locations searched at once.
    Security Features: Projects are stored at customer specified locations under user login permission. Properties of the responsive items are stored in database under the project. Results can be copied to customer specified locations under user login access.
    Reporting Features: Results can be filtered, labeled, annotated and marked for efficient organization. Summary and Detailed HTML reports are available in the product. Fully accessible ODBC compatible back-end database for customized reporting and multiple views available for CSV (Excel) export.
    Deduplication: User chooses properties to identify duplicates. Property comparison processed real-time. Duplicates are marked, not deleted.
    Production Capabilities: Production in PST or MSG for email, Native file for standard file types.
    Legal Application Support: Export neutral: Most industry leading review software (Concordance, Summation etc.) will accept PSTs and other native files.
    Hardware Requirements: Requirements include Windows 2000 or higher, 400 MHz or higher CPU, Outlook 98 or higher, approx. 30 MB HD space for the installation.
    Vendor Comment: Discovery Attender is an e-discovery tool designed to automate investigative tasks in PST files, Exchange mailboxes, public folders and common storage areas. Whether your organization gets subpoenaed to produce electronic evidence, you're addressing the new amendments to the Federal Rules of Civil Procedures, or legal/HR is conducting an internal investigation, Discovery Attender will help you quickly find and produce electronically stored information (ESI).
    Availability: Version 2.24 is available at this time. Version 3.0 (which will include many enhanced features) will be available Q1 2008.
    Base Cost: $1975 for perpetual license with volume discounts available.
    Detailed Specs: http://www.sherpasoftware.com/microsoft-exchange-products/discovery-attender.shtml
    Vendor URL: www.sherpasoftware.com

    Go to beginning

    Product Snapshot #10

    Product: StoredIQ Inc.; Intelligent eDiscovery appliance

    Discovery Speed: StoredIQ can search and index data faster when only system metadata is desired. For full text indexing, more time is required. System metadata indexing: 308GB/hour. Full text indexing: 16GB/hour.
    Discovery Capacity: StoredIQ's Appliance capacity is 200 TB for system metadata indexing; 20TB for full text indexing. Appliances can be custom configured to expand beyond these capacities.
    Native File Ingestion: Over 300 different file types can be recognized by StoredIQ while accessing multiple volumes simultaneously and managing hundreds of millions of objects at great speed. Files include PSTs, NSFs, Adobe, zip files, CAD/CAM, business documents such as Microsoft Office, etc.
    File Support: Supports all files that can be ingested (see previous answer).
    Search Scope: The StoredIQ Product recognizes the following repositories and resources where data may reside, including: File system servers (connect via CIFS, NFS, or NCP), Desktops, Microsoft Exchange email server, E-mail archive formats for Microsoft and Lotus Notes, EMC Celerra, EMC Documentum, Microsoft SharePoint, NetApp.
    Search Features: Able to search on common system metadata attributes and full text search, object-level attributes that reside outside the main content of a file, search on duplicates, and also provides linguistic support to identify natural language concepts within content. Search operators supported include Boolean, multi-term, wildcard, proximity, stop words, and extended ASCII characters. Search results for attributes and full text can be downloaded to CSV format. Users can also search objects within StoredIQ, such as the audit trails. Support for searching UTF-16 and UTF-32 encoded text.
    Security Features: Access to the StoredIQ Appliance requires login/password authentication.
    Reporting Features: The following report types are supported: data object mismatch report (data objects where file extension does not match content type), data topology (PDF report of number of data objects by various attribute types), how often data objects are accessed, how often data objects are modified, identical data objects - by count; identical data objects - by size; storage use - by data object type; storage use - by group; storage use - by owner; summary of data objects
    Deduplication: Yes
    Production Capabilities: Native, plain text, or XML format.
    Legal Application Support: The StoredIQ Appliance can collect, cull, and prepare large amounts of eDiscovery material quickly to be used by litigation review tools. StoredIQ provides an XML load file format that can be mapped to various litigation review tools and environments.
    Hardware Requirements: None; StoredIQ is delivered as a self-contained appliance, including hardware and software, that is pre-tested, configured, and tuned for optimal performance. Customers do not have to purchase additional hardware.
    Vendor Comment: For companies who want to manage electronic discovery in-house, StoredIQ provides an enterprise-class appliance that reduces legal risk while saving collection, preservation, and processing expense. StoredIQ also partners with industry leaders such as EMC, IBM, NetApp, Hitachi, as well as LECG, FTI, and RenewData.
    Availability: Version 4.4.2 of the StoredIQ Product is available now.
    Base Cost: Base model offerings start at $50,000 USD
    Detailed Specs: http://www.storediq.com/downloads/Product_eDiscovery_Final_hr.pdf
    Vendor URL: www.storediq.com

    Go to beginning

    Product Snapshot #11

    Product: Zantaz Inc.; Introspect

    Product details not available at this time.

    Detailed Specs: http://www.zantaz.com/products/introspect6.php
    Vendor URL: www.zantaz.com

    Go to beginning

  • Dig Deeper on Data storage compliance and regulations