Abstract: A collection of data is processed and information arising from the processing can be distributed in a variety of ways to support a decision-making process. A query-analyze-distribute approach can be used, and queries, analysis directives, and distribution directives can be associated into a sequence and shared. Access to interim processing is provided, allowing recipients of information to more easily understand and refine the processing. Unbound queries, unbound analysis directives, and unbound distribution directives can be used and shared so that the queries, analysis directives, and distribution directives can be tailored to a particular situation via binding. The query, analysis, and distribution processing can be loosely-coupled to allow easy interchange and combination of sequence elements. A sequence can be scheduled for periodic execution, and distribution of data can be limited to instances when data falls outside of certain expected values.

Abstract: Systems and methods are provided for electronic evidence management for autonomic metadata scaling. The exemplary systems and methods comprise capturing electronic evidence from at least one source, and storing the captured electronic evidence in a repository. Classification metadata is dynamically created to identify one or more classes. The stored electronic evidence is dynamically classified into the one or more classes with the dynamically created classification metadata.

Abstract: Systems and methods are presented for using proxies in social network analysis in electronic evidence management. The systems and methods comprise capturing electronic evidence from at least one source. One or more metadata are dynamically associated with the captured electronic evidence. The captured electronic evidence is analyzed, and at least one of the one or more metadata is associated with one or more proxies.

Abstract: Systems and methods are provided for policy enforcement on electronic evidence captured from at least one source. The contents of the captured electronic evidence are indexed, and the captured electronic evidence is classified based on the indexed contents by associating the electronic evidence with one or more classes. It is determined whether one or more policies apply to the classified captured electronic evidence. When two or more policies apply to the classified captured electronic evidence, a conflict between the two or more policies is resolved to select the one or more policies to enforce. The systems and methods also enforce the selected one or more policies on the classified captured evidence.

Abstract: Systems and methods for placing a hold on captured electronic evidence are provided, the captured electronic evidence having one or more associated policies that are applied to the captured electronic evidence. The captured electronic evidence is stored in a repository. The exemplary systems and methods determine whether to place a hold on the captured electronic evidence, and indicate the captured electronic evidence as being on hold. The exemplary systems and methods place the one or more policies of electronic evidence management associated with the captured electronic evidence indicated as being on hold in a pending state.

Abstract: Systems and methods are provided for electronic evidence management for creating and maintaining a chain of custody. The exemplary systems and methods comprise storing captured electronic evidence in a repository, and recording one or more interactions with the stored electronic evidence in one or more chain of custody logs, wherein at least one chain of custody logs is encrypted and at least one chain of custody logs is unencrypted. The exemplary systems and methods further comprise monitoring the one or more chain of custody logs for unauthorized alterations to the recorded interactions with the stored electronic evidence.

Abstract: Systems and methods are provided for capturing electronic evidence using one or more agents and at least one service control point. The systems and methods comprise deploying the one or more agents to one or more sources of electronic evidence. One or more events are transmitted from the at least one service control point to the one or more agents, wherein the one or more agents do not perform any tasks unless events are received. Upon receipt of the one or more events by the one or more agents, at least one task is performed on the one or more sources of electronic evidence.

Abstract: Systems and methods for creating metadata are provided in which electronic evidence is captured, the electronic evidence comprising a binary large object, extrinsic metadata, and intrinsic metadata. The extrinsic metadata and the intrinsic metadata are extracted from the captured electronic evidence. The extrinsic metadata, intrinsic metadata, or user-defined metadata, or any combination thereof are dynamically associated with the binary large object. At least one operation is performed on the binary large object, wherein the operation is determined by the associated extrinsic metadata, associated intrinsic metadata, or associated user-defined metadata.

Abstract: Systems and methods are provided for managing the destruction of documents in an organization that includes a cascaded destruction of the documents in distributed systems. The systems and methods include capturing electronic evidence in a central evidence management system as objects from sources in the distributed systems. The objects are stored in a repository. When documents are eligible to be deleted, the central evidence management system destroys the objects representing the documents in the repository. A delete command is sent to agents at the sources in the distributed system that causes the agents to delete and destroy the documents from the file systems in the distributed systems.

Abstract: Systems and methods are provided for managing sequestration of electronic evidentiary objects in an organization with distributed systems. The systems and methods include capturing in a central evidence management system objects from sources in the distributed systems. The objects are stored in a repository. Selected objects are selectively sequestered, which includes sequestering the selected objects at the sources. In certain embodiments, the sequestering of the selected objects at the sources is achieved by agents provided at the sources by the central evidence management system.

Abstract: Systems and methods are provided for capturing electronic evidence. One or more agents are deployed to one or more sources of electronic evidence over a communications network, wherein the one or more deployed agents are undetectable by the one or more sources. One or more instructions are transmitted to the one or more deployed agents to capture electronic evidence from at least one service control point, wherein the one or more deployed agents are inactive unless the one or more instructions are received. Upon receipt of the one or more instructions by the one or more deployed agents from the at least of service control point, electronic evidence is captured from the one or more sources of electronic evidence. The use of resources of the one or more sources by the one or more deployed agents is monitored.

Abstract: Information can be collected, processed, and distributed in a variety of ways to support a decision-making process. A query-analyze-distribute approach can be used, and queries, analysis directives, and distribution directives can be associated into a sequence and shared. Access to interim processing is provided. Query, analysis, and distribution directives can be stored in unbound format and tailored to a particular situation via binding. The query, analysis, and distribution processing can be loosely-coupled to allow easy interchange and combination of sequence elements. A sequence can be scheduled for periodic execution, and distribution can be tailored based on filters and exceptions. A decision-making process can be automated by creating an executable workflow. The environment in which the workflow is executed can support a rich set of features, including gating, branching, drill down, and execution tracking.

Abstract: A collection of data is processed and information arising from the processing can be distributed in a variety of ways to support a decision-making process. A query-analyze-distribute approach can be used, and queries, analysis directives, and distribution directives can be associated into a sequence and shared. Access to interim processing is provided, allowing recipients of information to more easily understand and refine the processing. Unbound queries, unbound analysis directives, and unbound distribution directives can be used and shared so that the queries, analysis directives, and distribution directives can be tailored to a particular situation via binding. The query, analysis, and distribution processing can be loosely-coupled to allow easy interchange and combination of sequence elements. A sequence can be scheduled for periodic execution, and distribution of data can be limited to instances when data falls outside of certain expected values.