eDiscovery Platform – VSE+ Training

Technical knowledge of features, architecture,

administration and configuration
 Hardware Requirements

2
Appliance
Item Technical Specifications
CPU 2 x Intel Xeon Gold 5118 2.30GHz/3.20Ghz Turbo,
12C/24T, 16.5MB L3 Cache, 10.4 GT/s, HT (105W)

Memory 196GB Memory (6 x 32 GB) RDIMM, DDR4

Synchronous Registered (Buffered), 2666 MT/s

Hard drive 2 x 480GB SSD SATA, 6Gbps, 512 2.5" Hot Plug Drives
(RAID 1), 3 DWPD, 2628 TBW
3 x 800GB SSD SAS Write intensive 12Gbps, 512n 2.5"
Hot Plug Drives (RAID5), 10 DWPD,14600 TBW

Communications Broadcom 5720 Network Daughter card (Quad Port,

1GB)

DVD DVD ROM Internal

3
Deployment Options

4
 eDiscovery Platform Workflow

5
Workflow overview
Pre-
Processing

Legal Hold
Post-
Processing Processing Export

Collection Discover, Extract, Index Data

Export and
Produce Data
Review

Preserve
Data
Search and Analyze data

6
 eDiscovery Platform Architecture

7
AD Discovery
Start
Discovery

GC List

ADSCrawler

Dom A Dom B

Search all accessible Global

Dom C objects Participants

CMADCrawler

Employee
Custodian Manager List
AD Synchronization

8
Legal Hold Process Flow
eDiscovery Platform
Custodian
Admin Server
Notice

Notices
Confirmations

Admin Server
System Admin
refresh every 10 Notice
minutes

eDiscovery Platform
Confirmation Server

Global
Recipients
Confirmations

Confirmations Notices

Employee
List
9
Collections Process Flow
Step 1 Sourc
e
Acct.

Source
Step 2

Step 3

Destination Processing

Get items

Step 4
Create Collection
Set

10
Exchange Collections Process Flow

Date
Keyword Exchange
Mailboxes Collection.exe
Mailbox
Server Filters Exchange_Template_Do_No
… t_Delete

eDiscovery Template
Profile
Platform
Temp. Template
Location Copy
Connects as Source
Creates Account
MAPI
Collection Search
.MSG Folder
Destination converte
d to
.PST
Sends MSGs to eDiscovery Platform

11
Enterprise Vault Collections Process Flow

EVSearcher.exe EV Indexing
Service Enterprise
Date Vault
Archive
Vault
Store Filters
Keyword Search results in .csv format
…
eDiscovery Temporary
Platform Location Data returned as native files
StorageOnlineO
PNS.exe

EVContent EV Storage
Collection .MSG Retriever.exe Service
Destination converted
to
.PST EV Storage

12
Enterprise Vault.cloud Collections Process Flow

Date
Archive Search/Export request
Vault
Store Filters
Keyword
…
eDiscovery Temporary
Platform Location

Data exported to PST

Collection
Destination

13
SharePoint Collections Process Flow

Date Search/Export request

Keyword
Site URL Filters
…
eDiscovery
Platform Data downloaded

Collection
Destination

14
Office 365 Collections Process Flow

Date Search/Export request

Keyword
… Filters

eDiscovery
Platform
Data exported

Collection
Destination

15
File Share and PC Collections Process Flow

Date
File type
Keyword
… Filters
Job Manager
eDiscovery
Platform

Scandir

Temp. Fileid
Location

Collection
Destination

16
Pre-Processing workflow
ScanDir branch:
Job Manager launches
ScanDir. ScanDir
ScanDir FileID enumerates and verifies
existing files in target folder.
FileID uses strong file typing
to identify file types, minus
PSTs and NSFs.

Job
Manager PSTFileScan branch:
Job Manager launches
PSTFileScan. PSTFileScan
PSTFileSca checks integrity of PSTs
n only. Creates PST
histograms. If unable to do
PSTs only so, user must manually run
Histograms ScanPST to resolve.

NSFFileScan branch:
Job Manager launches
NSFFileScan. NSFFileScan
checks integrity of NSFs
NSFFileScan only. If unable to prove NSF
integrity, user must
manually run Nfixup to
NSFs only resolve.

17
Processing workflow
Indexer Extract data
• Source data location is crawled by
different crawlers/adapters Build document
relationships
• Crawlers locate specific content types, Case-wide
and perform crawler-specific Job Mgr deduplication
deduplication
• Data is fed into Indexer through Data Admin pipe Data pipe
pipe
• Job Manager (JM) monitors Crawler Layer
connection to crawler layer through PST NSF
Admin Pipe
• JM also maintains checkpoints of work
Crawler-specific
completed deduplication
Crawler-specific
• Indexer also performs the following deduplication
tasks:
– Extracts data PSTs NSFs

– Builds document relationships

– De-duplicates content on the case level Source Data
18
Post Processing workflow

Validator Threader Search

From Processing Analytics

Validate DBIDs and FTIDs Set up stemming, build

across MySQL and Lucene Evaluate document
index
relationships, build discussion
threads

Imaging Index
Merge
Analysis Statistics

Perform index merge, Image tagging occurs here Enable customer billing
centralized or distributed statistics
19
Review Process Flow

FTID

DBID

Brava
Lucene Viewer

Document List EsaImageHelper

screen

20
Basic Exports Process Flow

eDiscovery
Email
Users Platform Locator Retrievers

NSF PST

Adapter Layer
Job Temp. Source Data
Manager Storage

Export
Destination

21
Native Only Export Process Flow

eDiscovery
Users
Platform Email Retrievers
Locator

NSF PST

MSGs, Adapter Layer

Job Temp. NSFs,
Source Data
Manager Storage Loose
Files

MSGs
converted
To PSTs

Export
Destination

22
Print to PDF Process Flow
Retrievers

NSF PST
PDF
Users Meld
Combines
single page
PDFs
Email
Job Locator
Manager

eDiscovery Source
Platform Data Pickup
Window
Adds Print to PDF
metadata, such as
header, footer, tag
comments
PDF Stamp
Stellent
File conversion
to single-page
PDFs

23
Metadata Export / Production Process Flow
Retrievers

NSF PST XML

Users Transform
Converts
Job Mgr. edrm.xml to
Email output formats
Locator

eDiscovery XML Write

Source
Platform Data Create the
edrm.xml file
Temp.
DB
Init.
Storage
Export
Destination

Muhimbi IGC
Image
Handling

24
 eDiscovery Platform Sizing

25
Sizing
• Stand alone 10 million item limit /case or /appliance
• Distributed architecture sizing
– Concurrency
– Scale out
– Higher performance
– Rule of thumb 2TB /appliance
– Use the sizing questionnaire which is then sent to engineering for sizing

26
Distributed Architecture Hardware Requirements

Appliance Type Function CPU’s Ram Min. Disk

Utility Caching, Retrieval, 4-Core CPU 4GB 500GB D: Drive
Export
Case Home Appliance or node 16-Core CPU 32GB 1TB (1500 IOPS)
where case was first
created
Review Review 16-Core CPU 32GB 1TB (1500 IOPS)
Processing Processing 16-Core CPU 32GB 1TB (1500 IOPS)
Stand-Alone Master Cluster Master 16-Core CPU 32GB 1TB (1500 IOPS)
(Minimum
Configuration)
Shared Database Database Server 16-Core CPU 32GB 1TB (1500 IOPS)
MySQL

27
 Configuration

28 Copyright © 2019 Veritas Technologies, LLC

Configuring SMTP and Confirmation Server

29
 Thank you!

Copyright © 2019 Veritas Technologies, LLC. All rights reserved. Veritas and the Veritas Logo are trademarks or registered trademarks of Veritas Technologies or its affiliates
in the U.S. and other countries. Other names may be trademarks of their respective owners.
This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or
implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice.