Work In Live EDA Case

A Live EDA (Early Data Assessment) case created in Enterprise will open the Live EDA Search interface, where you can search live content across multiple repositories. The Live EDA Search results can be promoted to the Enterprise Review case.

Note: Configuration of Enterprise Live EDA and NetGovern services is required, as well as configuration of NetGovern Indexes and Archives. For more information, see Configure Live EDA.

In Live EDA Search, Enterprise users search and preview the items/documents that belong to the selected custodians and live data locations. Performing a search is a multi-step and iterative process. The search actions and order in which they are completed can vary, depending on the user's requirements. The steps outlined in this topic explain some of the main actions that can be performed in Live EDA Search, and offer a possible workflow for completing these tasks. This topic also includes links to NetGovern user guides that further describe the action(s) or function(s) mentioned.

Get Started in Live EDA Case

  1. Navigate to the Enterprise Home page and select Live EDA.

  2. From the EDA Cases overview, search for and select the Live EDA case you would like to open. Click Enter Case.

  3. In the Live EDA Search interface, navigate to the left panel. From the Location View, select the connectors and custodians previously included in the Live EDA case.

  4. To include live location(s) in your search, select the corresponding check box(es).

  5. To include the custodian(s), select the corresponding check box(es). By default, all custodians are included when the location is selected.

  6. Optional: To exclude a custodian, clear the corresponding check box.

  7. Optional: To search for a specific custodian, navigate to the top left corner of the Location View and open Search User. In the left panel, you can select the specific locations to search. In the Filter field, you can enter the name of the custodian in question and select the custodian from the search results. You can search for and select multiple custodians. Click Apply new selection when finished.


  8. When connectors and custodians have been selected, their data is displayed in the Document View.

Customize Live EDA Search Interface

You can manipulate the Document View of the Live EDA Search interface to suit your viewing preferences.

The column fields that are displayed by default, indicate the type, Name, Owner, Date, Size, and Document ID of each item/document. If the item(s)/document(s) are promoted to a Live EDA Review case, this metadata will be included.

The definitions of the default column fields are listed in the following table.

column field

Description

Icons

Displayed on the left-hand side of the Document View, icons indicate whether the item/document is an attachment, calendar invite, opened email, unopened email, or if it is a Teams Message, SharePoint Fileshare, and so on.

Name

The attachment file name, email subject, or title that is automatically generated for an Instant Message when pulled from the contents of the message or the ID of any included attachments. Where applicable, emojis are included.

Owner

Identifies the sender of the item/document in question.

If the item/document is collected for Processing, a custodian will be automatically created and mapped to this field.

Date

The local day and time the item/document was sent.

Size

The item/document size, in KB.

Document ID

The ID value unique to the item/document in question.

Tip: The value of the Document ID displayed in Live EDA Search matches the EDADOCID that is displayed in the Live EDA Review Case. This allows you to quickly find the item/document in both the Live EDA and the Review case. For more information, see Review Live EDA Case.

  1. To adjust the Document View layout, navigate to the top right corner and click the Preferences menu icon . Make the desired changes from the Prefences drop-down menu. For more information about each available setting, see Setting Preferences.

  2. To adjust the column width, place the mouse pointer on the column boundary and drag the column boundary to the left or right.

  3. To add columns, hover on any of the column field headings and click the inverted triangle icon that appears. Add a column by selecting the relevant checkbox in the Columns menu.

  4. To change the sort order of a column, hover on any of the column field headings and click the inverted triangle icon that appears. Sort by Ascending is the sort order enabled by default, but you can opt to Sort by Descending.

  5. To change the organization of the items/documents displayed in the Document View, click the column field heading of the content you would like to display first. By default, all items/documents displayed in Document View are ordered by Date.

    Note: When the column field heading is clicked for the first time, it sorts in Ascending order. When the same column field heading is clicked a second time, it sorts in Descending order.

Perform Live EDA Search

Create and perform searches on the live data made available in the Live EDA Search interface. By searching the live locations first, you can select items/documents for collection and promote only the relevant data. Live EDA Search allows you to perform multiple searches in the same Live EDA case.

The following steps describe the criteria you can add to modify the scope of the initiated search.

Note: The following steps are optional methods for modifying the scope of your search. You can complete one step or all, depending on how focused you would like the search to be. The steps are listed in the order of the common workflow scenario. They can, however, be completed in a different order.

  1. Define an appropriate name for your Search. Right-click the Search tab to rename accordingly.

  1. Search Automatically is enabled by default. To prevent Live EDA Search from initiating a search every time you add a criteria to the search, clear the checkbox.

  1. To search for a specific term or phrase, navigate to the top right corner of the interface, type the expression into the Quick Search bar, and press Enter. The expression will then be added as a search criterion. A search will return a list of all items/documents matching the search criteria. For more information, see Quick Searches.

  2. To perform more complex searches, navigate to the Search menu in the top right corner of the Live EDA Search interface and select the appropriate option from the drop-down menu. To learn more about each available search option, see About Searching, Message Searches, IM Search, File Searches, and Federated Searches.

  3. For more information about how to perform an Advanced Search, review the following topics in the relevant NetGovern user guides. Start with Advanced Search, then consult About Groups, About Collections, and About Rules. To learn more about the two key Boolean operators, review About All Of, Any Of.

  4. To quickly refine your search results, filter by item/document type or by live location. Navigate to the bottom-left corner of the Document View and select the relevant icon.

  5. To refine your search results in more detail, apply a filter. Navigate back to the Location View and scroll to the bottom of the view. Expand the Filter View to apply a wide variety of parameters that make it easy to locate specific data. For more information, see Filter View and Using Search Filters.


  6. To monitor the total number of search results, (1) go to the next page of search results, or (2) refresh search results, navigate to the bottom-right corner of the Document View and click the corresponding icon(s).

  7. To erase a search and start a new search in the same Search tab, navigate to the Search menu and select (clear search) from the drop-down menu.

  8. To launch a new search in the same Live EDA case, create a new Search tab, select the appropriate live locations and custodians from the Location View, and repeat the steps previously listed in this procedure.

    Note: The Live EDA Search interface is stateless. All open Search tabs are saved automatically.

Preview Live EDA Search Results

When you have created a Search tab and performed the search, you can preview the search results. All Live EDA case users can view and work on all Search tabs and search results.

The actions outlined in the following steps can also be performed on multiple search results. You can select more than one from the list in Document View, or navigate to the Selections menu in the top left corner of the Document View and opt to Select All.

Note: The following steps are optional methods for modifying the scope of your search. You can complete one step or all, depending on how focused you would like the search to be. The steps are listed in the order of the common workflow scenario. They can, however, be completed in a different order.

  1. Double-click any item/document to open the Preview. For more information about how to preview individual search results, see Previewing Documents.

  2. By default, the Properties tab displays first. Here, you can view the metadata of the item/document previewed. For more information, see Properties Tab.

  1. Open the Preview tab to view the body or content of the item/document previewed. The content immediately displayed in the Preview tab differs according to item/document type. For attachments, the first two pages are displayed. You can click the link to view all. For emails, the message directly corresponding to the search criteria is displayed first. You can scroll down to read the thread. For Instant Messages, the message directly corresponding to the search criteria is displayed.

  2. If you are previewing an Instant Message and would like to view it in context of the full conversation, open the Conversation tab. This tab displays the complete chat history accompanying the search result.

  3. If you are previewing an Archived item/document and would like to view all audit actions performed on the item/document in question, open the Audit tab. This tab displays when the Archived item/document was first Created by the Archive agent, if it has been Exported by an ILM/Export job, and/or if it has been Viewed or Printed by an Enterprise user.


  4. To see whether any tags or comments have already been applied to the item/document, open the Tags tab.

Tag Live EDA Search Results

In Live EDA Search, tags can be used to quickly identify items/documents deemed pertinent to the case. All applied tags are searchable. Live EDA cases include predefined tags, but you can add custom tags. Tags are case specific; they exist only in the case in which they were created. For more information, see Tagging and Commenting Documents.

The actions outlined in the following steps can also be performed on multiple search results. You can select more than one from the list in Document View, or navigate to the Selections menu in the top left corner of the Document View and opt to Select All.

Note: The following steps are optional methods for managing tags in Live EDA cases. You can complete one or all. The steps are listed in the order of the common workflow scenario. They can, however, be completed in a different order.

  1. The tags Promote Candidate and Privileged are available by default. To add a custom tag to the Live EDA case, complete the following steps:

    1. Navigate to Manage Tags in the Case Overview toolbar.

    1. In Manage Tags, select Add New Tag. Enter the new tag name and click Save. The tag can then be applied to a selected item/document.

  2. To remove a custom tag from the Live EDA case, complete the following steps:

    1. Navigate to Manage Tags in the Case Overview toolbar.

    2. Select the tag from the list of available tags and click Remove selected Tag(s).

  3. To apply an existing tag to an item/document, complete the following steps:

    1. If still in Preview mode, close the Preview. In Document View, select the check box of the item/document to which you would like to apply a tag.

    1. Navigate to the bottom-right panel of the Documentation View. Click an available tag to apply it to the selected item/document.

  4. To remove a tag previously applied to an item/document, complete the following steps:

    1. If still in Preview mode, close the Preview. In Document View, select the check box of the item/document from which you would like to delete the applied tag.

    1. Navigate to the bottom-right panel of the Documentation View. Click Remove Tag.

  5. To see which tags have been applied to an item/document, double-click the item/document in question to Preview, and navigate to the Tags tab.

  6. To run a report on all items/documents tagged in the Live EDA case, click Tag Report in the Case Overview toolbar. Select your date range, and click OK to run the report. You can also Download the report.

Comment on Live EDA Search Results

In Live EDA Search, you can add comments to all items/documents. All added comments are searchable. Comments can be used to share notes, leave instructions for further investigations, or pose questions to fellow reviewers. Comments are case specific; they exist only in the case in which they were created. For more information, see Tagging and Commenting Documents.

Warning: Once they have been added, comments cannot be removed.

The actions outlined in the following steps can also be performed on multiple search results. You can select more than one from the list in Document View, or navigate to the Selections menu in the top left corner of the Document View and opt to Select All.

To add a comment to an item/document, complete the following steps:

  1. Select the item/document from the Document View.

  2. Navigate to the Comment field in the bottom-left corner of the Document View.

  3. Type in the comment and press Enter or click on the Add Comment icon to commit.

  4. The applied comment will remain available in the Comment field. If you want to add this same comment to another item/document, simply select the relevant item/document and click the Add Comment icon to commit.

  5. Comments cannot be deleted, but you can apply multiple comments to the same item/document by repeating the steps outlined.

  6. To see what comments have been applied to an item/document, double-click the item/document in question to Preview and navigate to the Tags tab.

 

When satisfied with your search, you can promote your search results and relevant data set to the Enterprise Live EDA Review case. For more information about how to promote data from Live EDA Search, see Promote Live EDA Case.

 

Related Topics

Overview: Live EDA

Configure Live EDA

Create Live EDA Case

Edit Live EDA Case Settings