Relativity Collection provides you with a user-friendly application for obtaining electronically stored information (ESI) from a custodian's computer. It includes functionality for performing targeted collections of select files. In addition, the scout utility can remotely examine a custodian's file system retrieving file names and system metadata so that you can make informed decisions about data collection.
Collection supports these processes for the following data sources on both Windows and OS X operating systems:
- File systems - You can inspect file names and other metadata, as well as collect files for this data source. When inspecting or scouting the file system, you have the option to exclude mapped network drives on the custodian’s machine, but you are provided with the UNC paths of these drives for future reference. Collection supports these processes for file system discovery on both Windows and OS X operating systems.
- Network shares - You can discover network shares by specifying their UNC paths when you configure collection parameters. Collection can inspect and collect files on network shares for custodian machines running Windows operating systems with .NET 4.5.
- Email messages - You can use Collection to inspect or collect email messages from Microsoft Exchange servers, Office 365, or Gmail. When you configure collection parameters, you can specify a date range for email messages that you want to discover. Custodian machines running Windows operating systems must be on.NET 4.5.
- SharePoint - You can collect from SharePoint on-premises and online in Office 365, including full libraries and subsites.
Note: As of Collection 3.0, collaborative third parties can now author their own data source plugins to increase the types of data that can be collected with Relativity Collection. For more information, see Relativity Collection API on the Developer Documentation site.
This page contains the following information:
See these related pages:
- Installing Relativity Collection
- Matters and custodians
- Custodian Portal
- Collection Builder tab
- Running reports
- Troubleshooting Relativity Collection
- Relativity Collection checklists
The following matrix lists Collection releases compatible with different Relativity versions:
|Collection 4.0||Collection 3.5||Collection 3.4||Collection 3.2/3.3||Collection 3.0/3.1||Collection 2.1|
|Relativity 188.8.131.52 - 9.4.315.5||X||X||X|
*Collection 3.2, 3.3, 3.4, and 3.5 are only compatible with Relativity 9.3.276.26 and above.
Access the appropriate application version documentation using the following links:
- Relativity Collection 3.5
- Relativity Collection 3.4
- Relativity Collection 3.2/3.3
- Relativity Collection 3.0/3.1
- Relativity Collection 2.1
Note: You can locate an application's version number by navigating to Applications & Scripts > Application Library tab. You must be a system admin to access this tab.
Collection provides you with more control over the process of ESI acquisition by offering you multiple workflow options that can be tailored to your specific data collection needs even as they vary by case. You can use Collection to create targeted collections that include only selected files and folders. The following sections describe the basic concepts that underlie key features of Collection.
Scouting is the process used to inspect and inventory the file system on a custodian's machine, as well as external devices and optionally mapped drives. You can also scout email messages on a Microsoft Exchange server, Office 365, or Gmail. Scouting retrieves system and file related metadata. You can use scouting to determine which documents are potentially relevant to a case before the actual collection process begins. You can save time by scouting because you aren't collecting the actual files, but only their metadata, which you can use to evaluate their potential relevance to a case. Scouting is required before running a targeted collection.
You can review and search scouted data on the Collection Builder tab to determine which files that you want to collect. Scouting requires Internet access. See Sending a scouting email or Scouting a local machine.
The targeted collection process involves retrieving selected files from a file system, external hard drives, and network shares connected to the custodian's machine. In addition, you can perform targeted collections for email messages on a Microsoft Exchange server, Office 365, or Gmail. Depending on the type of collection, it includes the actual files stored on the targeted media as and their metadata, or the actual email messages and their metadata.
In addition, Collection provides you with the ability to create collection lists, which represent custom groups of files stored on a custodian’s machine or email messages on an Exchange server. You can then use these collection lists as the basis for a targeted collection of files or email messages. You define a collection list by browsing or searching through the file names and metadata returned from scouting data assets of a custodian. You can select these data assets on the Collection Builder tab. Targeted collection requires Internet access. See Collection Builder tab.
Collection stores targeted collections in RCC files referred to as transport files that contain native files and the original metadata as discovered on a custodian’s machine. It stores email messages in Personal Storage Table (.pst) files that are added to a transport file. After extracting collection data from the transport file with the supplied extraction utility, you can view files or email messages with their original metadata in the extraction directory. However, if you move the files from this directory, you may alter their original metadata.
As a best practice, extract the files to their final location, such as the location used for processing. You can extract the native files any number of times to create multiple working copies, while preserving the original files in the transport file. This ability reduces the need to return to the source or custodian if any spoliation accidentally occurs to the files. See Extraction directory.
Locked or in use files
Collection copies any locked files or files currently in use, which minimizes disruption to businesses because custodians can continue working during the collection process. Collection initially attempts to collect any requested file whether or not it’s currently in use. When it encounters a file in use, Collection uses a copylocked routine, which creates a second temporary file, and then copies the contents of the original file to it. If the size of the original file changes during this process, Collection clears the contents from the temporary file and restarts the copying process. Collection performs this retry process up to three times.
This process doesn’t restart when a file becomes corrupt but its size doesn't change, which may result in a mismatch between the beginning and end of a file. This scenario may occur with Outlook Data Files (.ost) because they allocate additional slack space to reduce latency, but repeated testing hasn’t uncovered any corruption issues in these files when their size approximates 2 GB. Consequently, this workflow ensures that Collection generally collects the required files without corruption. You can later extract these locked files and view them just like any others that you have collected.
Collection offers flexible options for collecting ESI so that you can tailor a workflow to your current organizational needs and practices. The following scenarios utilize multiple features of Collection for collecting ESI, including the use of email requests and local machine collection.
Scenario One: Scouting and collecting by email
You're a member of a corporate legal team that issued a legal hold notice to Jane, a custodian in a pending case. You want to learn more about her involvement in the pending case, as well as to identify important sources of ESI. You begin this process by creating a collection in the Collection application to identify the documents that you can collect for this specific custodian, matter, and source combination. You also wish to configure the Relativity Collection Container (RCC) files for auto upload to Processing.
To learn more about Jane’s ESI, you decide to send her a scout request via email. You chose this approach because scouting lets you retrieve an inventory of file names and metadata from Jane’s data sources. Using this process, you can examine the metadata of the files on the data sources and determine which ones might be relevant to your case, saving time and money during processing because you collect fewer extraneous documents, such as operating system or application files.
When Jane receives your scout request email, she clicks the link to launch a web page that displays information about running the scouting utility. The scouting utility rapidly inspects Jane’s data sources and sends back file names and metadata to the Relativity server so that you can review this information.
Collection notifies you via email when it has finished processing all information that it received from scouting Jane’s data source. You can now view this information on the Collection Builder tab in Collection. This tab displays the folders and files that were stored on Jane’s data source so you can browse through the available content. After looking over this data, you decide that you need to search for file names containing the words energy and conservation to narrow down the files of interest. You create a collection list based on this search, which only includes files with these words in their names. Your collection list serves as the basis for a targeted collection.
Next, you decide to send a targeted collection request email to Jane in order to retrieve the files that you identified in your collection list. Jane receives the message, which lets her launch the collection utility. This utility collects the contents of the files included in the collection list. Your email provides instructions for storing the data on a network share.
Collection notifies you when this process is complete and generates a report that includes a SHA1 hash for each file that was collected. The collection utility adds the collected data to a secure transport file, which preserves all the original metadata in addition to the original file contents.
Click to expand
When you want to view the data contained in the transport file, you launch the extractor utility that is packaged with it. This utility asks you for the password that Collection generated when you created the collection if you chose to encrypt the data when the collection was created. You obtain this password from the collection detail view in Collection. The extraction process restores the native files with their original file paths and metadata and re-hashes them using the SHA-1 algorithm. It also creates a report that compares the original hash value from the target machine to the newly extracted native files, demonstrating that a forensically sound collection occurred. This comparison provides a way of authenticating the validity of the files making them admissible in court.
Scenario Two: Scouting a local machine
As part of an internal investigation, you need to collect ESI from a variety of sources used by employees of a corporation. You decide to use the scouting feature in Collection that lets you inspect the file system of a target data source.
You begin this process by logging in to Relativity on a targeted machine storing information that you want to scout and possibly collect. You create a collection for this ESI, and use the scouting option to inspect the file system on this machine. While Collection continues to run this process locally, you log out of Relativity on this machine, and begin this same procedure on another machine.