Source: https://patents.google.com/patent/US8417716B2/en
Timestamp: 2019-03-24 06:00:14
Document Index: 574026724

Matched Legal Cases: ['Application No. 201002124', 'Application No. 10', 'Application No. 10', 'Application No. 10', 'Application No. 10', 'Application No. 10', 'Application No. 201002138', 'Application No. 201002137']

US8417716B2 - Profile scanner - Google Patents
Profile scanner Download PDF
US8417716B2
US8417716B2 US12/730,851 US73085110A US8417716B2 US 8417716 B2 US8417716 B2 US 8417716B2 US 73085110 A US73085110 A US 73085110A US 8417716 B2 US8417716 B2 US 8417716B2
US12/730,851
US20100250484A1 (en
2010-03-24 Priority to US12/730,851 priority patent/US8417716B2/en
2010-03-29 Assigned to BANK OF AMERICA CORPORATION reassignment BANK OF AMERICA CORPORATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: ANDERSEN, DAVID M., MILLER, EMERSON D.
2010-09-30 Publication of US20100250484A1 publication Critical patent/US20100250484A1/en
2013-04-09 Publication of US8417716B2 publication Critical patent/US8417716B2/en
Systems, methods, and computer program products are herein defined for identifying users of personal computers within a network for the purposes associating the personal computers with custodians in an electronic discovery system. Embodiments provide for a tool that accesses the personal computers via the network, locates and queries the profile list on each personal computer for user-identifying data, including network user identification, transmits, for each personal computer, computer-identifying data associated with the personal computer and user-identifying data associated with a user of the personal computer, determines matches between the network user identifications and custodian entries in a custodian directory; and, in response to determining the matches, links the computer-identifying data of the personal computer associated with the matched network user identification to the matched custodian entry in the custodian directory.
In general, embodiments of the invention relate to methods, systems and computer program products for identifying users of personal computers within a network.
Embodiments of the invention relate to systems, methods, and computer program products for identifying users of personal computers within a network, and in particular, for generating a list of personal computers associated with custodians for the purposes of conducting electronic discovery. Some embodiments of the present invention provide a method for identifying users of personal computers within a network for the purposes of electronic discovery, wherein the method comprises: (1) accessing the personal computers via the network, (2) querying the profile list on each personal computer, (3) transmitting for each personal computer computer-identifying data associated with the personal computer and user-identifying data associated with a user of the personal computer, and (4) storing the computer-identifying data in a database.
In some embodiments, storing the computer-identifying data in a database comprises adding the computer-identifying data to an existing entry in a custodian directory associated with the user. According to some embodiments, the method also includes using the user-identifying information to store the computer-identifying data in the database. According to some embodiments, the method also includes using the user-identifying information to link the computer-identifying data stored in the database to an existing entry in a custodian directory associated with the user. In some embodiments, querying the profile list comprises reading the registry key list. In some embodiments, the computer-identifying data comprises a computer name. In some embodiments, the computer-identifying data comprises an IP address. According to some embodiments, querying the profile list comprises reading a registry key list on the personal computer comprising at least one registry key.
In some embodiments, the user-identifying data comprises at least a portion of a registry key. According to some embodiments, the method also includes presenting the computer-identifying data to an electronic discovery manager upon the identification of the user as a subject for electronic discovery. In some embodiments, the method also includes transmitting log-on data associated with the user of the personal computer. In some embodiments, the log-on data is transmitted in conjunction with the transmission of the computer-identifying data. In some embodiments, the log-on data comprises the last date and time that the user logged on to the personal computer. In some embodiments, the log-on data comprises the number of times that the user logged on to the personal computer during a predetermined period of time.
Some embodiments of the present invention provide a method for identifying users of personal computers within a network for the purposes of electronic discovery, wherein the method comprises: (1) installing on the personal computers a tool configured to transmit computer-identifying data and user-identifying to a database server, (2) accessing a preexisting directory comprising data relating to the users, (3) locating in the directory an entry that comprises data matching the user-identifying data, and (4) linking the computer-identifying data to the entry. In some embodiments, the tool is configured to transmit the computer identifying data and the user-identifying data every time a user logs on to a personal computer. In some embodiments, the user-identifying data comprises a network user identification. In some embodiments, the computer-identifying data comprises a computer name. In some embodiments, the computer-identifying data comprises an IP address. According to some embodiments, linking the computer-identifying data to the entry comprises recording the computer-identifying data in the entry. According to some embodiments, the method also includes storing the computer-identifying data in a database configured to be in communication with the directory. In some embodiments, the method also includes presenting the computer-identifying data to an electronic discovery manager upon the identification of the user as a subject for electronic discovery.
Some embodiments of the present invention provide a system for identifying users of personal computers within a network for the purposes of electronic discovery, wherein the system comprises: a profile scanning tool configured to scan the personal computers, query the profile list on each personal computer, and transmit to a database server for each personal computer computer-identifying data associated with the personal computer and user-identifying data associated with a user of the personal computer, a database server configured to receive the computer-identifying data and the user-identifying data from the profile scanning tool and store the computer-identifying data in a database, and an electronic discovery management server in communication with the database server via the network configured to retrieve from the database server the computer-identifying data in response to an electronic discovery request targeting the user. According to some embodiments, the database server is configured to access a preexisting directory comprising data relating to the users and locate in the directory an entry that comprises data matching the user-identifying data. In some embodiments, the database is the directory and the database server is configured to store the computer-identifying data in the entry.
Some embodiments of the present invention provide a computer program product for maintaining a custodian management system in for the purposes of performing electronic discovery in an enterprise environment, the computer program product comprising a computer readable medium having computer readable program instructions stored therein, wherein the computer readable program instructions comprise: first instructions configured for accessing the personal computers via the network, second instructions configured for querying the profile list on each personal computer, third instructions configured for transmitting for each personal computer computer-identifying data associated with the personal computer and user-identifying data associated with a user of the personal computer, and fourth instructions configured for storing the computer-identifying data in a database.
FIG. 2 is a block diagram of an electronic discovery management server, in accordance with embodiment of the present invention;
FIG. 5 is a flow diagram of a method for identifying users of personal computers within a network, according to one embodiment of the invention;
FIG. 6 is block diagram illustrating electronic discovery management structure, in accordance with an embodiment of the invention;
FIG. 7 is a flow diagram of a method for initiating a case or matter including creating search terms, creating and sending preservation notices, sending reminder notices and creating and sending surveys to custodians, in accordance with embodiments of the present invention;
FIG. 8 is a flow diagram of a method for custodian management in an electronic discovery system, in accordance with an embodiment of the present invention; and
FIGS. 9 and 10 are flow diagrams of methods for harvesting different data types in an electronic discovery system; in accordance with an embodiment of the present invention.
Embodiments of the present invention provide a profile scanning tool configured to scan each of the personal computers residing on a communication network and identifying which network users have used each personal computer. In a business environment, it is often the case that employees may log on to and use personal computers within the network that are not assigned to them. Thus, custodians within the business who may be the subject of an electronic discovery effort may have stored data on personal computers that would not ordinarily be targeted during the electronic discovery process. Indeed, in such instances, unless the custodians themselves actually identify each and every computer the custodian has used to store data, there is a high likelihood that the data belonging to the custodian and stored on the unassigned machines would avoid collection completely. The profile scanning tool of the present invention solves this problem by generating a list of personal computers that have been used by each custodian and storing this list for future reference during electronic discovery. In order to explain the systems and processes of the present invention, the greater environment in which such systems and processes shall operate should first be explained.
As shown in the block diagram of FIG. 2, the electronic discovery management server 110 provides user interface management for via user interface 118. In some embodiments, the electronic discovery management server 110 is a web server that can be accessed via a web browser. In one particular embodiment, the electronic discovery management server 110 is an intranet website server that may be accessed utilizing a web browser on a machine within the enterprise. Through the electronic discovery management server 110, the user interface 118 may be presented to a user for the purposes of managing the electronic discovery process and all processes described herein that are inherent thereto. For illustrative purposes, it may be assumed herein that the primary user interacting with the user interface 118 is an employee or contractor of the company who serves an electronic discovery management role, and hereafter is referred to as the “e-discovery manager.” As discussed in greater detail below, the e-discovery manager may utilize the user interface 118 to manage cases, custodians, collections, and collected data. It should be appreciated, however, that any individual could use the user interface 118 to perform the manual functions herein attributed to the e-discovery manager, and, indeed, that an automated process could perform those functions as well.
Referring again to FIG. 1, the electronic discovery management server 110 is in communication with the database server 120 and the collections server 130 via the communication network 102. The database server 120, as shown in the block diagram of FIG. 3, is configured to provide database services for the electronic discovery management server 110, including housing the Unified Directory/custodian database 122, which includes data relating to individual custodians, the case database 124, which includes data relating to particular cases, and ongoing collections database 126, which includes data relating to collections being undertaken by the collections server 130. Each of the foregoing databases within the database server 120 is discussed in detail below. It should be understood that multiple database servers could be employed instead of a single database server, and reference to a single database server is for illustrative and convenience purposes only. For example, the Unified Directory 122 could be stored in one database server and the ongoing collections data 126 could be stored in another database server. Referring to FIG. 4, the collections server 130 is configured to operate a number of tools, including the local collection tool 132, the file server collection tool 134, and the active email collection tool 136 in order to collect different types of data and store such data such that the data may be managed apart from cases.
For example, the electronic discovery management server 110 or the database server 120 may interface with the computer databases of the human resources computer systems of the enterprise to copy the information from the human resources databases into the Unified Directory 122. In some embodiments, the electronic discovery management server 110 may also reach out to a network directory, such as Windows Active Directory, to identify network resources related to particular custodians and integrate this information into the custodian entries including the copied human resources information. Information for the Unified Directory 122 may also be obtained from the managers of the information technology network, i.e., those individuals responsible for setting up email accounts for custodians and managing the various file servers of the enterprise. Furthermore, in addition to retrieving information in the manners described above, in some embodiments, information in the Unified Directory 122 is generated through tools initialized and/or deployed by the electronic discovery management server 110. In particular, in some embodiments, as shown in FIG. 2, a profile scanning tool 112, and a mapping tool 114 are provided.
The profile scanning tool 112 is utilized by the electronic discovery management server 110 in order to identify which of the enterprise personal computers 140 are associated with a particular custodian. While many custodians within an enterprise will be assigned one or more personal computers, and that information may already be stored in the Unified Directory 122 because it was received from human resources or information technology records and directories, custodians may have also used and stored data on personal computers that were not assigned to them. In some instances, however, there may be no personal computer information stored for a custodian within the Unified Directory 122. In such instances, the profile scanning tool 112 may be the only source of information about what local machines a custodian is using to store data. The profile scanning tool 112 provides a complete list of computers used by the custodians and may supplement any other personal computer information received from alternative sources. This advantageously allows the e-discovery manager to be in a position to collect all of the relevant data from the custodian.
With reference now to FIG. 5, an exemplary method of identifying the custodian users of the personal computers 140 within the communication network 102 utilizing one embodiment of the profile scanning tool 112 of the present invention is provided. According to some embodiments, the profile scanning tool 112 is initialized by the electronic discovery management server 110 and scans the enterprise personal computers 140 residing on the communication network 102. The profile scanning tool 112 may be scheduled to automatically run on a periodic basis, such as once a day or once a week, or may be manually run at any time by the e-discovery manager through the user interface 118. According to different embodiments, the profile scanning tool 112 may be run on the electronic discovery management server 110, the collection server 130, or another server in the communication network 102. As shown in Block 601, the profile scanning tool 112 will access each of the personal computers 140 that meet certain criteria that enable such computers to be scanned. Eligible machines are those of the enterprise personal computers 140 that are on the domain, are enabled, and are identified as workstations rather than servers. Next, as shown in Block 602, the profile scanning tool 112 queries the profile list on each of the eligible personal computers located during the scan. In some embodiments, for example, in a Microsoft Windows environment, querying the profile list comprises reading the registry key list in the Documents and Settings directory. The profile list for the computer contains entries for each different network user identification that has been used to log on to the computer, as well as the dates and times of each log-on for each user identification.
As shown in Block 603, the profile scanning tool 112 then transmits to the database server 120 the relevant data retrieved from about each computer, such as computer name and IP address, as well as a list of all profiles, including demographics information, (or network user identification) associated with each computer. In some embodiments, the profile scanning tool 112 is further configured to identify and transmit to the database server 120 the most recent date and time at which a particular profile was logged on to the machine and/or the number of times that a particular profile was logged on to the machine. As shown in Block 604, all of the data transmitted by the profile scanning tool 112 is stored in the database server 120. In some embodiments, the data from the profile scanning tool 112 will be stored in a table in the database server 122 within the Unified Directory, but distinct from the rest of the Unified Directory 122, i.e. the data coming from other sources, such as human resources databases, Active Directory, etc. This advantageously allows the profile data to be updated rather than repeatedly copied each time the profile scanning tool 112 is run. Thus, there is a sub-database within the Unified Directory 122 that houses all of the data transmitted by the profile scanning tool 112 which is updated during each profile scan.
In some embodiments, in accordance with Block 506, the database server 120 or the electronic discovery management server 110 links the profile scanning data to the related custodian entries in the Unified Directory 122 by matching the network user identifications appearing in the profile scanning data to the unique human resources identifiers that are associated with such user identifications. The profile scanning tool 112 transmits for each personal computer, the profile list that was located thereon, which includes user identifications. Therefore, as transmitted by the profile scanning tool 112, the personal computer identifying information, such as computer name and IP address, for each computer is related to one or more network user identifications. In turn, each human resources identifier is related to one or more network user identifications, and this data is already stored in the Unified Directory 122. Thus, the database server 120 or the electronic discovery management server 110 compares the user identifications appearing in the sub-database in relation to the computer identifying information to the user identifications already stored in the Unified Directory 122 in relation to the unique human resources identifiers. When a match is located, a link is made between the computer identifying information and the human resources identifier associated with the matching user identification. The link essentially adds the computer identifying information (such as date, time, number of log-ons, etc.) to the profile/entry in the Unified Directory of the custodian having that human resources identifier. The profile log-on information would be linked into the custodian profiles with the computer identifying information or in the same manner. Thus, the profile scanning tool 112 ultimately generates a list of personal computers used by each custodian in the custodian's profile in the Unified Directory 122, including relevant log-on information. This list may be presented to the e-discovery manager when a collection of a custodian's local machine(s) is initialized, as discussed in detail below, and the e-discovery manager may review the list and the accompanying data to determine which machines to target during the collection process.
In other embodiments, the profile scanning tool 112 itself may be configured to determine the human resources identifier to which the network user identifications appearing in the profile list relate, and transmit the computer identifying information and related data to be directly stored in the appropriate custodian profiles in the Unified Directory 122, without the need for the database server 120 or electronic discovery management server 110 to perform matching processes or linking. In still other embodiments, the data is transmitted by the profile scanning tool 112 to the database server 120, and the database server 120 or electronic discovery management server performs the user identification matching process described above before storing the computer-identifying information and related data directly into the appropriate custodian profiles in the Unified Directory 122. It should be understood that, according to the present invention, there are multiple ways to populate the custodian profiles in the Unified Directory 122 with the information retrieved by the profile scanning tool 112.
Another object of the present invention, and a final step according to some embodiments, is to record in the database server 120 any changes to profile data and/or computer-identifying data that occurs between scans. Referring again to FIG. 5, as shown in Block 606, each time the profile scanning tool 112 is run, the profile scanning data is updated in the database server 120 and any changes in the profile scanning tool since the last execution of the profile scanning tool 112 is recorded. This creates a historical record of when custodians were using particular machines within the network 102. For example, if in a first scan a particular profile was found by the profile scanning tool 112 on a certain machine, but during a later scan, the profile scanning tool 112 does not locate that profile again, the removal of that profile from the machine will be recorded in the custodian entry in the Unified Directory 122 for the custodian matching the network user identification associated with that profile. In some embodiments, the database server 120 maintains a historic record of all profiles that have appeared on a particular computer.
Likewise, with regard to the actual computers rather than the profiles, in some embodiments, the profile scanning tool 112 or the electronic discovery management server 110 is configured to review Active Directory (or an analogous directory if in a non-Windows environment) to determine if a personal computer has been removed from the system. Computers will often not appear to the profile scanning tool 112 because they are simply not online and capable of communicating via the network 102. However, in some instances, computers will be retired or wiped and reimaged. If it is determined that a computer has been removed from the system for retirement or wiping, the database server 120 will store a record of all of the profiles associated with that computer. In the event the computer reappears on Active Directory and during a later scan the profile scanning tool recognizes the identical computer name but missing profile information, the database server 120 will record that the computer was wiped and store the profiles that used the computer prior to its removal. Thus, in the event the profile scanning tool 114 identifies a new personal computer associated with a custodian and one of the personal computers associated with the custodian previously is no longer identified, the database server 120 is configured to store in the Unified Directory 122 the information for each computer, as well as indications as to when the new computer was first identified and when the old computer was no longer identified. In this way, the custodian profile within the Unified Database 122 may include a history of the personal computers used by the custodian and a record is also created for each computer of when it was imaged and who has logged on to it and when. Such information may be relevant at the time of investigation or collection of the custodian.
It should be understood that there may be alternative methods of operating the profile scanning tool in accordance with embodiments of the present invention. Indeed, the profile scanning tool 112 may be a tool that operates within the enterprise personal computers 140 themselves or within the domain controller to push the profile information out to the database server 120 for storage in the Unified Directory 122. In such instances, as soon as a custodian logs on to a machine, and the machine reaches out to the domain controller to verify the log-in information, data regarding the user identification used and the particular machine, including IP address and computer name, would be sent to the Unified Directory 122, either from the machine directly or from the domain controller, to be stored in connection with the human resources identifier to which the user identification relates. This would be an alternative approach that would not require running the profile scanning tool 112 on a periodic basis. Under such approach, the profile data would be made available to the Unified Directory in real-time. The foregoing are only several ways of implementing the systems and methods of the present invention and one skilled in the art will recognize that there are other ways to utilize the profile scanning tool of the present invention in order to meet the intended objectives.
If it is determined that the path includes the designated indicator, for example, a user identification, the mapping tool 114 is configured to positively identify the particular network storage area identified by that path as a HomeSpace and transmit to the database server 120 the particular user identification and the path of the HomeSpace. When that information is received by the database server 120, the database server 120 uses the user identification to link the particular HomeSpace to the custodian in the Unified Directory 122 associated with that user identification. In some embodiments, the mapping tool 114 is also configured to recognize and transmit, and the database server 120 is configured to house, an indication of the last time the HomeSpace was accessed by the particular user, for example, the last time any data was read from and/or written to the HomeSpace. Additionally, in some embodiments, the mapping tool 114 is configured to recognize when multiple paths map to the same network storage area. The collection server 130 compares paths for the same user to determine if duplicative entries exist. This advantageously enables avoidance of multiple collections of the same data. Thus, the mapping tool 114 ultimately generates a list of HomeSpaces used by each custodian, and this list may be presented to the e-discovery manager when a collection of a custodian's HomeSpaces is initialized, as discussed in detail below.
With reference now to FIG. 6, a block diagram is provided that illustrates the electronic discovery management structure of the present invention, according to some embodiments. As illustrated in FIG. 6, certain processes described herein may be categorized within one of case management, as represented by Block 200, custodian management, as represented by Block 220, or data management, as represented by Block 240. As described above, the electronic discovery system 100 is arranged such that cases, custodians and data may be managed independent of one another. However, there is still an element of the categorization of processes within the categories that is conceptual, and it should be understood that certain processes may be correctly assigned to more than one category. Therefore, while the architecture of the system 100 allows separate management of custodians, cases, and data, certain processes of the present invention may affect more than one of the foregoing.
Moving now to custodian management, certain processes falling within the category of custodian management are shown in Block 220. While the processes involving generation of the Unified Directory 122 certainly could be categorized as custodian management, the processes shown in FIG. 6 include those processes involving management of custodians within the scope of a case or matter. In that regard, the first process of custodian management included in FIG. 6 is the addition of custodians to a case or matter, as shown in Block 222. As described above, the e-discovery manager may use the user interface 118 to link a custodian's profile from the Unified Directory 122 to the particular case profile in the case database 124. Thus, the custodian profile and case profile are correlated. The next processes within custodian management is the transmission of preservation notices and surveys to custodians, as shown in Block 224, and the presentation of the surveys to custodians, as shown in Block 226. The electronic discovery management server 110 uses the contact information in the custodian's profile in the Unified Directory 122 to transmit the preservation notice(s) and survey(s) stored in the case profile to the custodian. In some embodiments, a standard email function is used, so that the only information needed from the Unified Directory 122 is the custodian's email address. When the custodian checks her email, the survey will appear as a message therein, and when she opens that message, the survey will be presented to her. The survey may be configured such that when she fills it out, the survey is automatically transmitted back to the database server 120 for storage in the case profile and the custodian's profile.
With reference to FIG. 7, an exemplary process for managing a case is provided, in accordance with one embodiment of the present invention. As represented by Block 302, a case or matter is created by the e-discovery manager and stored in the case database 124. Next, custodians are added to the case, as shown in Block 304, by linking the custodian profiles of the Unified Directory 122 to the case profile. Next, as represented by Block 306, the e-discovery manager and/or the case contact or manager adds search terms to be applied to data harvested for the case, including instructions as to applying the search terms to particular data types or custodians. Block 310 represents the determination that must be made as to whether there is a matter or just a case. If there is no matter because preservation notices are not required, for example, for an audit, then the process will move straight to the initialization of data collection. On the other hand, if there is matter, rather than just a case, then the creation of preservation notices is required, as shown in Block 312.
With reference to FIG. 8, an exemplary process for managing a custodian is provided, in accordance with one embodiment of the present invention. First, as represented by Block 402, a custodian is added to a matter or case. In this regard, the custodian's profile in the Unified Directory 122 is linked to the relevant case or matter profile. In order to locate the custodian's profile, a custodian search module may be employed, as shown in Block 404. Therefore, the e-discovery manager may enter any identifying information about the custodian, whether it is the custodian's name, network user identification, email address, etc. The custodian search module will take the input information and search the Unified Directory 122 for a match. If more than one match is obtained, the user interface 118 will present all matches and allow the e-discovery manager to browse the associated profiles to determine the intended custodian. In this way, the correct custodian is identified and the profile of that custodian is linked to the appropriate case or matter.
Referring to FIGS. 9 and 10, flow diagrams are presented of a method 500 for harvest data from various data sources, in accordance with embodiments of the present invention. At Event 502, the collection of data ensues and, at Event 504, the type of data is identified. Data Block 506 signifies active email that is collected from an exchange system or the like. At Event 508 the automated active email collection tool is implemented to collect email from identified email address. As previously noted, and in accordance with present embodiments of the invention, if a custodian profile (for a custodian released for collection) includes an email address for an email account on the enterprise email server (160), then the electronic discovery management server (110) may undertake to collect the files from the enterprise email server (160) by initializing the active email collection tool (136) running on collections server (130). In some embodiments, the active email collection tool (136) is configured to access the particular Microsoft Exchange server within the enterprise email server 160 on which the custodian's account resides (which is known based on the information included in the Unified Directory 122), copy all email located there, including emails deleted up to a designated prior period, for example, seven days prior to the collection, and transmit the copied emails to the collections server (130). The email collection tool is also capable of implementing bulk requests and for collecting email on a scheduled basis, such as daily. The email collection tool is additionally capable of being implementing enterprise wide and requires no server identifiers or the like to collect the active email. In this regard, the email collection tool (136) serves to reduce security risk.
Referring to FIG. 10, data block 548 signifies data from a local Personal Computer (PC), such as enterprise PC (140). At Event 550, the local collection tool (132) is implemented to collect data from designated PCs by taking a “snapshot” of the device's hard drive. According to one embodiment of the invention, the local collection tool may be autodeployed thus, obviating the need for any manual entry by the e-discovery manager or the like. In other embodiments of the invention, the local collection tool (132) may be employed to collect data from network storage.
Data block 580 signifies electronic data for forensics. At Event 582, a forensic collector tool, such as EnCase® may be executed on the devices of interest to collect data. According to one embodiment of the invention, the forensic collector tool may be automatically deployed on the device of interest without the knowledge of the device user. In accordance with another embodiment of the invention, a computer watcher tool may be implemented (not shown in FIG. 10) that watches the network to determine the addition or subtraction of computers to the network based on ID's/IP addresses returned from the network.
1. A method for identifying users of personal computers within a network for the purposes of associating the personal computers with custodians in an electronic discovery, comprising:
accessing, by a computing device processor, the personal computers via the network;
querying, by a computing device processor, a profile list stored on each personal computer for user-identifying data, wherein the user-identifying data includes (1) one or more network user identifications, each network user identification associated with a user of the personal computer, and (2) log-on data associated with each personal computer including a last date and time each user logged on to the personal computer and a number of log on occurrences for each user over a predetermined period of time;
transmitting, via the network, for each personal computer, computer-identifying data associated with the personal computer and the user-identifying data associated with one or more users of the personal computer;
determining, by a computing device processor, one or more matches between the network user identifications and custodian entries in a custodian directory; and
in response to determining the one or more matches, linking, by a computing device processor, (1) the computer-identifying data of the personal computer associated with the matched network user identification and (2) the log-on data associated with the matched network user identification to the matched custodian entry in the custodian directory.
2. The method of claim 1, wherein linking the computer-identifying data further comprises adding the computer-identifying data to the matched custodian entry in the custodian directory.
3. The method of claim 1, wherein querying the profile list comprises reading, by a computing device processor, a registry key list.
4. The method of claim 1, wherein the computer-identifying data comprises a computer name.
5. The method of claim 1, wherein the computer-identifying data comprises an IP address.
6. The method of claim 1, wherein querying the profile list further comprises reading, by a computing device processor, a registry key list stored on the personal computer, wherein the registry key list comprises at least one registry key.
7. The method of claim 6, wherein the user-identifying data comprises at least a portion of one of the registry keys in the registry key list.
presenting, by a computing device processor, the computer-identifying data to an electronic discovery manager upon an identification of at least one of the one or more users as a subject for electronic discovery.
9. The method of claim 1, wherein the user-identifying data is transmitted in conjunction with the transmission of the computer-identifying data.
10. A method for identifying users of personal computers within a network for the purposes of associating the personal computers with custodians in an electronic discovery system, comprising:
installing, by a computing device processor, on the personal computers, a tool configured to identify and transmit, to a database server, computer-identifying data and user-identifying data associated with one or more users of a personal computer, wherein the user-identifying data includes (1) one or more network user identifications, each network user identification associated with a user of the personal computer, and (2) log-on data associated with each personal computer including a last date and time each user logged on to the personal computer and a number of log on occurrences for each user over a predetermined period of time;
accessing, by a computing device processor, a preexisting custodian directory comprising data relating to the custodians;
locating, by a computing device processor, in the directory a custodian entry that comprises data matching the user-identifying data of one of the users; and
based on location of the custodian entry, automatically linking, by a computing device processor, (1) the computer-identifying data (1) the log-on data associated with the custodian to the custodian entry.
11. The method of claim 10, wherein the tool is configured to transmit the computer-identifying data and the user-identifying data every time a user logs on to a personal computer.
12. The method of claim 10, wherein the user-identifying data comprises a network user identification.
13. The method of claim 10, wherein the computer-identifying data comprises a computer name.
14. The method of claim 10, wherein the computer-identifying data comprises an IP address.
15. The method of claim 10, wherein linking the computer-identifying data to the custodian entry further comprises recording, by a computing device processor, the computer-identifying data in the custodian entry.
storing, in computing device memory, the computer-identifying data in a database configured to be in communication with the directory.
presenting, by a computing device processor, the computer-identifying data to an electronic discovery manager upon an identification of the user as a subject for electronic discovery.
18. A system for identifying users of personal computers within a network for the purposes of associating the personal computers with custodians in an electronic discovery system, comprising:
an electronic discovery management server including a memory and a processor in communication with the memory;
a profile scanning tool stored in the memory, executable by the processor and configured to:
scan the personal computers,
query a profile list stored on the personal computer for user-identifying data,
wherein the user-identifying data includes (1) network user identification associated with a user and (2) log-on data associated with each personal computer including a last date and time each user logged on to the personal computer and a number of log on occurrences for each user over a predetermined period of time, and
initiate transmission of computer-identifying data associated with the personal computer and the user-identifying data associated with one or more users of the personal computer; and
a database server in network communication with the plurality of personal computers and configured to receive the computer-identifying data and the user-identifying data from the plurality of personal computers and store the computer-identifying data in a database,
wherein one of the electronic discovery management server or the database server is further configured to determine one or more matches between the network user identifications and custodian entries in a custodian directory and, in response to determining the one or more matches, linking (1) the computer-identifying data of the personal computer associated with the matched network user identification and (2) the log-on data associated with the matched network user identification to the matched custodian entry in the custodian directory.
19. A computer program product for maintaining a custodian management system in for the purposes of performing electronic discovery in an enterprise environment, the computer program product comprising a non-transitory computer readable medium having computer readable program instructions stored therein, wherein said computer readable program instructions comprise:
first instructions configured for accessing the personal computers via a network;
second instructions configured for querying a profile list stored on each personal computer for user-identifying data, wherein the user-identifying data includes (1) one or more network user identifications, each network user identification associated with a user of the personal computer, and (2) log-on data associated with each personal computer including a last date and time each user logged on to the personal computer and a number of log on occurrences for each user over a predetermined period of time;
third instructions configured for transmitting, for each personal computer, computer-identifying data associated with the personal computer and the user-identifying data associated with one or more users of the personal computer;
fourth instructions configured for determining one or more matches between the network user identifications and custodian entries in a custodian directory; and
fifth instructions configured for, in response to determining the one or more matches, linking (1) the computer-identifying data of the personal computer associated with the matched network user identification and (2) the log-on data associated with the matched network user identification to the matched custodian entry in the custodian directory.
US12/730,851 2009-03-27 2010-03-24 Profile scanner Active 2030-08-19 US8417716B2 (en)
US12/730,851 US8417716B2 (en) 2009-03-27 2010-03-24 Profile scanner
EP10250586A EP2237205A3 (en) 2009-03-27 2010-03-26 Profile scanner
SG201002141-8A SG165284A1 (en) 2009-03-27 2010-03-26 Profile scanner
US20100250484A1 US20100250484A1 (en) 2010-09-30
US8417716B2 true US8417716B2 (en) 2013-04-09
ID=42635187
US12/730,851 Active 2030-08-19 US8417716B2 (en) 2009-03-27 2010-03-24 Profile scanner
US (1) US8417716B2 (en)
EP (1) EP2237205A3 (en)
SG (1) SG165284A1 (en)
2010-03-24 US US12/730,851 patent/US8417716B2/en active Active
2010-03-26 EP EP10250586A patent/EP2237205A3/en not_active Ceased
2010-03-26 SG SG201002141-8A patent/SG165284A1/en unknown
Danish Patent and Trademark Office. Singapore Examination Report mailed Mar. 15, 2012. Applicant: Bank of America Corporation. Singapore Patent Application No. 201002124-4. DKPTO SE No. SE 2012 00392y. English anguage. 10 pages. Date of Examination Report: Mar. 12, 2012.
European Patent Office. European Office Action dated Apr. 25, 2012. European Application No. 10 250 577.3. Name of Applicant: Bank of America Corporation. English Language 10 pages.
European Patent Office. European Office Action dated Apr. 25, 2012. European Application No. 10 250 578.1. Name of Applicant: Bank of America Corporation. English Language. 10 pages
European Patent Office. European Office Action dated Apr. 25, 2012. European Application No. 10 250 590.6. Name of Applicant: Bank of America Corporation. English Language. 10 pages
European Patent Office. European office Action dated Apr. 25, 2012. European Application No. 10 250 591.4 Name of Applicant: Bank of America Corporation. English Language. 10 pages.
European Patent Office. European Office Action dated Apr. 26,2012. European Application No. 10 250 582.3. Name of Applicant: Bank of America Corporation. English Language. 10 pages.
Extended European Search Report dated Sep. 23, 2010 for European Application No. EP 10 25 0586.
Hungarian Intellectual Property Office. Hungary Written Opinion mailed Apr. 5, 2012. Singapore Application No. 201002138-4. Filing Date: Mar. 26, 2010. Name of Applicant: Bank of America Corporation. English Language. 8 pages. Date of Written Opinion: Mar. 29, 2012.
Hungarian Intellectural Property Office. Hungary Written Opinion mailed Apr. 5, 2012. Singapore Application No. 201002137-6. Filing Date: Mar. 26, 2010. Name of Applicant: Bank of America Corporation. English Language. 8 pages. Date of Written Opinion: Mar. 21, 2012.
J. Barlow, L. Bean and D.D. Hott: "Employee 'Spy' Software: Should You Use It?" The Journal of Corporate Accounting & Finance, Document No. XP-002601405, pp. 7-12; Retrieved from the Internet: URL: http://onlinelibrary.wiley.com/10.1002/icaf.10162/abstract [retrieved on Sep. 17, 2010].
J. Barlow, L. Bean and D.D. Hott: "Employee ‘Spy’ Software: Should You Use It?" The Journal of Corporate Accounting & Finance, Document No. XP-002601405, pp. 7-12; Retrieved from the Internet: URL: http://onlinelibrary.wiley.com/10.1002/icaf.10162/abstract [retrieved on Sep. 17, 2010].
Manson et al.: "Is the Open Way a Better Way? Digital Forensics using Open Source Tools". System Sciences, 2007. HICSS 2007. 40th Annual Hawaii International Conference On, IEEE PI, Jan. 1, 2007. ISBN:978-0-7695-2755-0.
Utility U.S. Appl. No. 12/731,657, filed Mar. 25, 2010.
US20100250484A1 (en) 2010-09-30
SG165284A1 (en) 2010-10-28
EP2237205A2 (en) 2010-10-06
EP2237205A3 (en) 2010-11-24
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:ANDERSEN, DAVID M.;MILLER, EMERSON D.;REEL/FRAME:024153/0790