Abstract: A computer-implemented method for identifying selected electronic files from a set of electronic files that contains at least one mail file includes the steps of: (i) using an operating agent and a mail server gateway, opening the mail file; (ii) for each of the plurality of electronic files in the opened mail file, creating a derivative attribute representative of the file class of that electronic file, the creation of each file class derivative attribute itself comprising the steps of: (a) determining the number of mail message markers in the file locator of that file; and (b) mapping that file to a file class if the file locator includes a predetermined number of mail message markers.

Abstract: A computer-implemented method for identifying electronic files from a set of electronic files that contains at least one compound electronic file itself having a plurality of electronic files, the method includes the steps of: the method including the steps of: (i) using an operating agent and a gateway, opening the compound electronic file; and (ii) from the plurality of electronic files in the opened compound electronic file, identifying a subset of parent electronic files, wherein each parent electronic file includes one or more file pointer native attributes; identifying each child file corresponding to each file pointer native attribute in each parent electronic file; and for each file group comprising a parent file and each child file corresponding thereto, classifying the group into one of the predetermined plurality of recommended actions based upon the highest ordered recommended actions in the group.

Abstract: A computer-implemented method and program for separating one or more selected file constituents from a compound file (such as a mail file) that contains a plurality of file constituents each containing one or more native attributes. The file constituents are stored in a non-individually-manipulable manner in the file. The method comprises the steps of: creating a list identifying one or more selected file constituents; creating a forensic copy of the compound file; and using a functional module, segregating from the copy of the compound file the file constituents on the list, without removing them from the forensic file and without changing any native attribute of a file constituent. The segregation step is performed by deleting from the forensic copy all file constituents not present on the list. If desired, the selected file constituents identified on the list may be grouped into two or more categories.

Abstract: A computer-implemented method for identifying selected electronic files from a set of electronic files that contains at least one mail file includes the steps of: (i) using an operating agent and a mail server gateway, opening the mail file; (ii) for each of the plurality of electronic files in the opened mail file, creating a derivative attribute representative of the file class of that electronic file, the creation of each file class derivative attribute itself comprising the steps of: (a) determining the number of mail message markers in the file locator of that file; and (b) mapping that file to a file class if the file locator includes a predetermined number of mail message markers.

Abstract: A computer-implemented method and program for separating one or more selected file constituents from a compound file (such as a mail file) that contains a plurality of file constituents each containing one or more native attributes. The file constituents are stored in a non-individually-manipulable manner in the file. The method comprises the steps of: creating a list identifying one or more selected file constituents; creating a forensic copy of the compound file; and using a functional module, segregating from the copy of the compound file the file constituents on the list, without removing them from the forensic file and without changing any native attribute of a file constituent. The segregation step is performed by deleting from the forensic copy all file constituents not present on the list. If desired, the selected file constituents identified on the list may be grouped into two or more categories.

Abstract: A computer-implemented method for identifying electronic files from a set of electronic files that contains at least one compound electronic file itself having a plurality of electronic files, the method includes the steps of: the method including the steps of: (i) using an operating agent and a gateway, opening the compound electronic file; and (ii) from the plurality of electronic files in the opened compound electronic file, identifying a subset of parent electronic files, wherein each parent electronic file includes one or more file pointer native attributes; identifying each child file corresponding to each file pointer native attribute in each parent electronic file; and for each file group comprising a parent file and each child file corresponding thereto, classifying the group into one of the predetermined plurality of recommended actions based upon the highest ordered recommended actions in the group.

Abstract: A computer-implemented method and program for identifying electronic files from a set of electronic files uses an operating agent to identify first and second subsets of electronic files. The files in the first subset are those able to be opened by the operating agent, while files in the second subset are the remainder. For each electronic file in the first subset, an index containing every accessible character string used in the electronic file is created. The method and program are characterized by creating, for each file in the first and second subsets, a derivative attribute having a value representative of the readability of the character strings in the file.

Abstract: A data structure for use with a computer-implemented method and program for identifying electronic files from a set of electronic files contains one or more derivative attribute(s) representative of: the relevance to a selected electronic file to a predetermined topic; the amount of electronically readable text for each electronic file; and/or the file class for each electronic file.

Abstract: A computer-implemented method and program for identifying electronic files from a set of electronic files uses an operating agent to identify first and second subsets of electronic files. The files in the first subset are those able to be opened by the operating agent, while files in the second subset are the remainder. For each electronic file in the second subset at least one native attribute contained in the electronic file is identified. The method and program are characterized by creating, for each file in the second subset, a derivative attribute having a value representative of the file's relevance to the predetermined topic. The derivative attribute being based upon the presence or absence of at least one of a target character strings in the identified native attribute for each electronic file in the second subset. Additional derivative attribute(s) representative of the presence of a privilege and/or confidential information may be created.