Write Protect

Restrict a diskette from having information recorded to it. Used to prevent the erasure of valuable information.

Source: Legal Electronic Document Institute, Basic Principles of Automated Litigation Support (2005).

WORM (Write Once, Read Many)

An optical disc storage device that uses laser technology similar to the CD-ROM. Information written to the WORM disc, cannot be altered. The advantages of WORM are increased disc density and life expectancy.

Source: Legal Electronic Document Institute, Basic Principles of Automated Litigation Support (2005).

A self-replicating, self-propagating, self-contained program that uses networking mechanisms to spread itself.

An estimate of the effort or time needed by a potential adversary, with specified expertise and resources, to overcome a protective measure.

A copy or duplicate of a recording or data that can be used for subsequent processing and/or analysis.

SOURCE: https://www.swgit.org/

The wildcard symbol, typically "*", can be used with any other search to retrieve different variations of the same word, e.g., “insur*” for insurance, or insured.

Source: Legal Electronic Document Institute, Basic Principles of Automated Litigation Support (2005).

A list of entities that are considered trustworthy and are granted access or privileges.

A group responsible for refereeing an engagement between a Red Team of mock attackers and a Blue Team of actual defenders of information systems.

A type of search that will allow the user to sort and retrieve documents according to a statistical “weight” given by the use of a mathematical relevancy evaluation program.

Source: Legal Electronic Document Institute, Basic Principles of Automated Litigation Support (2005).

A shortcoming or imperfection in software code, design, architecture, or deployment that, under proper conditions, could become a vulnerability or contribute to the introduction of vulnerabilities.

In the NICE Workforce Framework, cybersecurity work where a person: Conducts assessments of threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations.

A characteristic or specific weakness that renders an organization or asset (such as information or an information system) open to exploitation by a given threat or susceptible to a given hazard.

A computer program that can replicate itself, infect a computer without permission or knowledge of the user, and then spread or propagate to another computer.

A subdiscipline of Digital & Multimedia Evidence, which involves the scientific examination, comparison, and/or evaluation of video in legal matters.

SOURCE: https://www.swgit.org/

Deduplication within a custodian; identical copies of a Document held by different custodians are not Deduplicated. ( Cf . Horizontal Deduplication.)

Source: Maura R. Grossman and Gordon V. Cormack, EDRM page & The Grossman- Cormack Glossary of Technology-Assisted Review, with Foreword by John M. Facciola, U.S. Magistrate Judge, 2013 Fed. Cts. L. Rev. 7 (January 2013).

The maximum amount by which a Point Estimate might likely deviate from the true value, typically expressed as “plus or minus” a percentage, with a particular Confidence Level.

A file that was created because of the actions of the user, with or without intent or awareness. Excludes system generated log files.

Source: David Greetham,[email protected](2008).

Data created by a person or a person's interaction with a computer.

Source: John Martin,[email protected](2008).

To transfer data from a user’s computer to a remote computer system.

Source: Legal Electronic Document Institute, Basic Principles of Automated Litigation Support (2005).

Data that is not in tabular or delimited format. File types include word processing files, html files (web pages), project plans, presentation files, spreadsheets, graphics, audio files, video files and emails.

Source: RenewData, Glossary (10/5/2005).

Any access that violates the stated security policy.

Space on a hard drive that potentially contains intact files, remnants of files, subdirectories, or temporary files that were created and then deleted by either a computer application, the operating system or the operator.

Source: RenewData, Glossary (10/5/2005).

Source: Vinson & Elkins LLP Practice Support, EDD Glossary.

A Search Specification that indicates that matching documents must contain words that begin with the letters entered, but that the matching words can end with any combination of letters.

Source: EDRM Search Guide Glossary. Source: EDRM Search Glossary.

A computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes the program.

The process of reviewing a document set (discovery set) for responsiveness and/or privilege. Triage refers to the practice of quickly identifying which documents require additional attention and which can be easily classified as either responsive or nonresponsive.

A set of designations employing four colors (RED, AMBER, GREEN, and WHITE) used to ensure that sensitive information is shared with the correct audience.

A location automatically created and stored by a GPS device without user interaction as a record of where it has been.

SOURCE: https://www.swgit.org/

A complete list of trackpoints that a GPS device has created.

SOURCE: https://www.swgit.org/

A vertical search engine as distinct from a general web search engine, focuses on a specific segment of online content. They are also called specialty or topical search engines. The vertical content area may be based on topicality, media type, or genre of content. Common verticals include shopping, the automotive industry, legal information, medical information, scholarly literature, and travel. Examples of vertical search engines include; Mocavo, Nuroa, Trulia and Yelp. In contrast to general web search engines, which attempt to index large portions of the World Wide Web using a web crawler, vertical search engines typically use a focused crawler which attempts to index only relevant web pages to a pre-defined topic or set of topics.

Source: Wikipedia, Vertical search, https://en.wikipedia.xyz

The process of relating images, audio, or other data to one another in a chronologically ordered succession.

SOURCE: https://www.swgit.org/

The process of opening files in their native applications, extracting text and printing them as TIFF images.

Source: Ibis Consulting, Glossary.

In access control, data that authenticates the identity of a client or a service and, together with a temporary encryption key (a session key), forms a credential.

The product or process of identifying or evaluating entities, actions, or occurrences, whether natural or man-made, that have or indicate the potential to harm life, information, operations, and/or property.

The detailed evaluation of the characteristics of individual threats.

An individual, group, organization, or government that conducts or has the intent to conduct detrimental activities.

Threat agent.

A circumstance or event that has or indicates the potential to exploit vulnerabilities and to adversely impact (create adverse consequences for) organizational operations, organizational assets (including information and information systems), individuals, other organizations, or society.

Organizing emails into conversational groups. For example, if John sends an email to Mary and she replies, both emails are part of the same conversational thread.

Source: Herb Roitblat, Search 2020: The Glossary.

Thumb Drive     

In Keyword or Boolean Search, replacing a single Search Term by a list of its synonyms, as listed in a thesaurus.

Source: Maura R. Grossman and Gordon V. Cormack, EDRM page & The Grossman- Cormack Glossary of Technology-Assisted Review, with Foreword by John M. Facciola, U.S. Magistrate Judge, 2013 Fed. Cts. L. Rev. 7 (January 2013).

The Principles reflect standards and guidelines related to records management, developed by ARMA International, a not-for-profit professional association and a widely-recognized authority on managing records and information. The Principles include: (1) Principle of Accountability, (2) Principle of Integrity, (3) Principle of Protection, (4) Principle of Compliance, (5) Principle of Availability, (6) Principle of Retention, (7) Principle of Disposition, and (8) Principle of Transparency.

Source: IGRM White Paper

The process of pulling the text and data from electronic documents for the purposes of loading the data into a database. The process removes formatting, and graphics from a document leaving only the text.

Text clustering is a technology that analyzes a document collection and organizes the documents into groups based on finding documents that are similar to each other based on words contained within it (such as noun phrases). Text clustering establishes a notion of “distance between documents” and attempts to select enough documents into the cluster so as to minimize the overall pair-wise distance among all pairs of documents.

Source: EDRM Search Glossary.

In the NICE Workforce Framework, cybersecurity work where a person: Develops and conducts tests of systems to evaluate compliance with specifications and requirements by applying principles and methods for cost-effective planning, evaluating, verifying, and validating of technical, functional, and performance characteristics (including interoperability) of systems or elements of systems incorporating information technology.

A device with input and output devices (keyboard and monitor) connected to a computer system.

Source: Legal Electronic Document Institute, Basic Principles of Automated Litigation Support (2005).

A variant of keyword search, with the emphasis on searching for combinations of words such as phrases.

In the NICE Workforce Framework, cybersecurity work where a person: Conducts technology assessment and integration processes; provides and supports a prototype capability and/or evaluates its utility.

A collection of protocols that define the basic workings of the features of the Internet.

Source: Kroll Ontrack, Glossary of Terms,http://www.krollontrack.com/glossaryterms

A trillion bytes, or a million megabytes. The entire collection of the Library of Congress would equal approximately 20 terabytes if digitized.

Source: Legal Electronic Document Institute, Basic Principles of Automated Litigation Support (2005).

A hierarchical organizational scheme that arranges the meanings of words into classes and subclasses. For example, vehicles, aircraft, and ships are modes of transportation; cars, trucks, and bicycles are vehicles, and Fords and Chryslers are cars.

Source: Maura R. Grossman and Gordon V. Cormack, EDRM page & The Grossman- Cormack Glossary of Technology-Assisted Review, with Foreword by John M. Facciola, U.S. Magistrate Judge, 2013 Fed. Cts. L. Rev. 7 (January 2013).

In the NICE Workforce Framework, cybersecurity work where a person: Applies current knowledge of one or more regions, countries, non-state entities, and/or technologies.

A targeted collection strategy is one that is specifically designed to avoid over collection of data that is known to be irrelevant or potentially irrelevant. A non-targeted strategy is designed to collect all the data from a particular storage device or repository in a comprehensive manner. Culling and filtering protocols are subsequently applied to the data corpus to either eliminate non-responsive data or isolate responsive data. A targeted strategy takes into consideration culling and filtering protocols at the point of collection (e.g. only collecting a custodian’s email inbox as opposed to imaging their entire hard drive).

Source: EDRM Metrics Glossary