Network-based filtering for large email collections in E-Discovery

Abstract

The information overload in E-Discovery proceedings makes reviewing expensive and it increases the risk of failure to produce results on time and consistently. New interactive techniques have been introduced to increase reviewer productivity. In contrast, the techniques presented in this article propose an alternative method that tries to reduce information during culling so that less information needs to be reviewed. The proposed method first focuses on mapping the email collection universe using straightforward statistical methods based on keyword filtering combined with date time and custodian identities. Subsequently, a social network is constructed from the email collection that is analyzed by filtering on date time and keywords. By using the network context we expect to provide a better understanding of the keyword hits and the ability to discard certain parts of the collection.

Forensic triage of email network narratives through visualisation

“…use the Enron email corpus as a case study to propose a method for the triage and analysis of actors within an email network. Henseler (2010), who also uses the Enron data set, suggests an approach for filtering large email collections during an investigation based on statistical and visualisation techniques. Wiil et al (2010) provide an analysis of the 9/11 hijackers' network and focus on the relationships between these actors.…”

“…From this event, we may infer that Alice and Bob have some form of relationship in that there are communications between them. With the multiple events that occur in the network over time, a forensics examiner may infer relational information between actors, for example, using statistical techniques discussed by or Henseler (2010). This information may be retrieved from the email header.…”

Digital-Forensics Based Pattern Recognition for Discovering Identities in Electronic Evidence

“…Henseler [4] proposes the use of social network analysis for network-based filtering in large email collections in E-Discovery. This research formalizes the use of networks in E-Discovery using of identities that were extracted from email headers in the Enron email data set [5].…”

E-Discovery revisited: the need for artificial intelligence beyond information retrieval

“…Jason Baron has documented the magnitude of the problem in the context of National Archives' responsibilities (Losey 2009). Henseler has subsequently shown through a series of experiments that it is possible to identify the most relevant portions of e-mail chains through the use of statistical techniques (Henseler 2010). In so doing, technologists have a potent tool for culling entire sets of e-mail documents determined to be nonresponsive.…”

“…In addition to Ashley and Bridewell's work describing the nascent contributions that Social Network Analysis (SNA) can make to theories of relevance, Henseler has also extended his e-mail analysis into the field of Social Networks (Scott 2000), showing that e-mail investigations can reveal and effectively probe Social Networks as well (Henseler 2010). The author argues that a number of new techniques in E-Discovery address critical problems in the field, in particular, technologies such as concept search, visualization and fuzzy duplicate detection, and enhanced culling strategies using keyword-based filtering.…”