Relativity Collect Flashcards
Collect Overview
Application for collecting custodian’s Google Workspace data, Microsoft 365 emails and documents, Slack messages, and X1 emails
Creating a collection
- Click “Collections” sub-tab
- Click “New Collection”
- Complete the steps in the Collect Wizard
- click Run Collection in console
Using the Collect Wizard
- Collection Details
- Custodians
- Configure Data Source
- Collection Summary
Collection Details
Name Collection matter - Edit or Add Processing Source Location ZIP Collected Files - toggle to compress all collected data into Zip64 containers Zip Password Job Number Description Receive Progress Notifications Notification Address Data Source Type
Custodians
- Use column filters to locate custodians
- Click a check box next to a custodian
- Add select custodians or bulk add all custodians
- Click “NEXT”
Configure Data Source
Data Source Criteria - add criteria to collect specific data
Collecting Preserved Files - no extra steps need to be taken to collect preserved files as they are automatically included in the collection
Data Source Criteria
Select and unselected tabs - choose data sources to collect from
Field - choose the field to filter on (only required when a calendar source is selected)
Operator - equals, contains, greater than, less than
Value - enter value in selected field
e.g. “Email To” Contains “Barry”
Click “Add Criteria” - each separated by an “AND” operator
Leave data source criteria empty to collect all data from the sources
Collection Summary
If targets weren’t created, click “Generate Targets” - will check to see if they exist and automatically create targets base don email address
View Collection Details
Collect Console
Start Collection Generate Targets Stop Collection Retry Collection Create Processing Job Clone Collection
Storing Collected Data
If selected “Yes” to Collect Files in ZIP - compressed folders separated by the custodian target
Folders will split when reaching set size
Can be secured with a password
Data can be exported with the RelativityOne Staging Explorer
Viewing Collected Data - Modified Path or File Name
Path names - 260 character limit, if truncated path name already exists, will add a version number
File names - modified if documents have been deleted form a SharePoint or OneDrive for Business site that’s been placed on a preservation hold
Generate Targets
Retrieve all known Collect targets based on the custodians and data sources selected (Google Workspace, Microsoft 365, X1)
Start/Stop Collection
Click to initiate the collect project, or to end the collection project that is currently running (will prompt a pop-up message)
Retry Collection
Available when a collect job doesn’t complete because of errors
Create Processing Job
Create a processing set from the collected documents from the data sources. These are in the Processing Source Location set in Collection details
Select a Processing Profile, with the option to “Clone Profile”, then click “Submit Collection”
Clone Collection
Duplicates the open collect job. Any collect job that has a status other than “new” can be cloned
Once a job is cloned, it is placed in the “Not Started” status and can be found in the Collections list under the same name with “Cloned - YYYY-MM-DD HH.MM.SS” attached to the end
Cloned collect job will also generate new targets
Reports from Console
Generate reports in collection console, which will trigger download of files
Creating a Collect Data Source
- Click “New Collection Source Instance” button
- Enter a unique name for the source
- Select the type of data source (Google Workspace Chat, Drive, etc, Microsoft 365 Mailbox, OneDrive, etc, Slack, X1 Emails/Files)
- Enter Information in Settings appropriate to source type
i. Google Workspace - Client Id, Client Secret, refresh Token, Temporary Code
ii. Microsoft - Domain, Application ID, Application secret
iii. Slack - Temporary Code, Access Token
iv. X1 - see documentation - Click Save - if connection fails, message will appear indicating that the collection failed
Slack Filter Criteria
NB - Slack has a 200 MB processing limit
Archived Slack channels can be collected but deleted Slack channels cannot be
- Channel Name - all messages within the channel that equal the search word or phrase
- End date - all messages the day of and before
- Message Type - returns all direct or group messages
- Slice Interval in hours - all messages within a specific time range - default slice interval is 24 hours
- Start Date
Setting up a Slack Data Source
- Enable an org for API access - Slack org must be on the Enterprise plan, and owner needs to email exports@slack.com to gain API access
Relativity Process
- Navigate to the Collection Admin tab
- Click New Collection Source Instance
- Enter in a unique name for the data source
- Select the “Slack” data source
- Click “Install Application”, log in as org owner if necessary
- click “Allow”
- Go to page where you can copy temporary code
- Paste code in “temporary code” field
- Generate Access Token
- Click Save
Collect Reports - Collection Summary Report
Target, target status, number of items collected, collection size
Grouped by custodians with subtotals for each
Report downloads as a PDF file
Collection Details Report
- Successfully collected results of all items and their metadata
- Errored collection data
Report downloads as a CSV file; report is also stored in the assigned Azure AD file share and included in the collection output
Results Report
CSV file download of the results collected from the target (empty if no results)
Results report link for each target downloads as a CSV file that contains a list of all individual items collected
Includes emails, files, etc, and all associated metadata for each item
Hash identifier - SHA-256
In the spreadsheet there is an electronic fingerprint named SHA-256; when collecting documents Microsoft adds the SHA-256 hash identifiers then stores the hashes. A user can verify the original file by matching the SHA-256 identifiers
This is included in the Results report file and the Collection details report file
Errors Report
CSV download of errors that occurred during the collection from the target (if no errors, file is empty)
If application is reporting errors with requests, creating objects, or parsing, check for correct permissions, healthy connections, and check if the fileshare is working.
Report file lists one error per line, with error ID alongside message of the error that cause the item failure.
Per-item errors only occur in download phase; if an error occurs before (if data is unavailable) or after (worker can’t write results.csv file to fileshare) then there will be no record in the errors. csv report
Graph Error Codes
An issue with Graph when downloading an item - see Microsoft’s Graph Errors documentation
- Transient - Microsoft Graph API has received too many requests
- Authentication - error with authentication of Collect application, check Azure application associated with collection source
- Modification - error occurs when data changes between discovery and download
- File - Graph API prevents Relativity from collecting items marked as malware
- HTTP - 400 (bad request), 401 (unauthorized), 403 (forbidden), 404 (Not Found), 429 (too many requests), 504 (gateway timeout), 509 (bandwidth limit exceeded)
- Other Errors - InvalidOperationException (downloaded item has identifier doesn’t match Microsoft’s hash identifier); ArgumentExceptions - something other than a file is a attached to an event or message
Collect Store
Large volumes of raw collected evidence can be stored in the RelativityOne Store instead of being processed right away.
Migrating data to storage before processing or review reduced consumption of physical space and reduces RelativityOne resources during an upgrade
Moving collected data into storage
When creating a collection job, you have to select a Processing Source Location. The Store option is available in the Processing Source Location drop-down menu in the first step of the Collect Wizard
Exporting Collected Data
Use RelativityOne Staging Explorer to export the collected data located in the store
