Systems and methods for enhancing electronic discovery searches

摘要

A computer-implemented method for enhancing electronic discovery searches may include (1) receiving a search query for at least one instance of a user being identified within a backup image of a volume of data, the search query being conducted for electronic discovery, (2) identifying metadata associated with the backup image specifying at least one action performed by the user on a computing system while the volume of data was mounted for use on the computing system, (3) performing the search query on the backup image and receiving a result of the search query in response to performing the search query, (4) enhancing the result of the search query with contextual information relating to the search query based on the metadata, the contextual information facilitating further electronic discovery, and (5) providing the enhanced result of the search query. Various other methods, systems, and computer-readable media are also disclosed.

主权项

1. A computer-implemented method for enhancing electronic discovery searches, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
receiving a search query for at least one instance of a user being identified within a backup image of a volume of data, the search query being conducted for electronic discovery; identifying metadata associated with the backup image specifying at least one action performed by the user on a computing system while the volume of data was mounted for use on the computing system; performing the search query on the backup image and receiving a result of the search query in response to performing the search query; enhancing the result of the search query with contextual information relating to the search query based on the metadata in response to determining that the user specified in the search query performed the action, the contextual information facilitating further electronic discovery relating to the user by specifying a context in which the user performed the action on the computing system while the volume of data was mounted for use on the computing system; and providing the enhanced result of the search query.