Collect tab

Before you begin collecting, you must create a collection job and associate it with a specific matter, custodians, and one or more data sources. Add the custodians, data sources, and other information using the Collect wizard. Once completed, start the collection using the Collect Console. Finally, download a results report that details the items collected and a summary report of the entire collection job. For more information, see Reports.

This page contains the following information:

Creating a collection

Before you begin creating a collection, make sure to create a matter. For more information, see Matters.

Use the following procedure to create a collection:

  1. On the Collect tab, click the Collections sub-tab. Collect displays a list of the collections currently added to this application.
  2. Click New Collection.
  3. Complete the steps in the Collect wizard. See Using the Collect wizard
  4. On the Collection Details page, click Run Collection in the console. See Collection Summary.

For information on running concurrent Microsoft 365 collection jobs, see Accessing Microsoft 365 tenants.

Using the Collect wizard

The Collect wizard takes you through each step to create a collection. After completing the collection setup, run a collection from the Collection console.

When a step is complete, click Next or the hyperlink under the next step shown. Click the Previous button to move to the previous step. Information is auto-saved when moving between steps. If any required information is missing or incorrect, an error message displays and are prevented from moving to the next step.

Collection Details

Complete the Collection Details step by entering information in the following fields:

  • Name - the name of the collection.
  • Collection Matter - the name of the matter associated with this collection. Click Edit to select an existing matter or click Add to define a new one. See Creating a matter.
  • Processing Source Location - the file repository for collected data to be stored for future processing of documents or for storing collected data. See Processing and Collect Store.
  • ZIP Collected Files - toggle on to compress all collected data into ZIP64 formatted containers. For more information, see Storing collected data.
  • Zip Password - enter a password that is required by anyone attempting to decompress the ZIP64 container files.

    Note: If Relativity Processing is installed in the workspace, Collect will automatically populate the Processing Password Bank with the password so it is available at the time the collection is processed.

  • Job Number - enter a number that you want assigned to the job for reporting purposes.
  • Description - enter a description of the collection used for reporting purposes.
  • Receive Progress Notifications - toggle on to send or receive collection job status emails. The statuses include:
    • Completed – includes completed or completed with errors job status.

    • Failed – includes job status and reason for failure.

  • Notification Address - enter the email address of person that wants to receive collection job statuses.
  • Data Source Type - select one or more data sources to use in the collection. For more information, see Data source types and properties.

(Click to expand)

Custodians

Complete the Custodians step by assigning custodians to the project. Follow the steps below to assign a custodian:

  1. From the Unselected custodians table, use the column filters to locate custodians.
  2. Click a check box next to a custodian.
      Notes: If you select multiple Slack custodians in the same collection, the channels they share will only collect once.

  3. Click to add select custodians. Click to add all custodians.
  4. Click Next.

Note: There is a limit of 10,000 custodians with targets in the custodian picker.

Configure Data Source

Configure the data sources chosen in the Collection Details step. If you select multiple data sources in the first step, you'll configure all sources in the step. Switch between each source by clicking the name of the data source in the left navigation menu. Clicking Next and Previous also moves you through the data sources. Select individual data sources by clicking on the checkbox and then using the right arrows to select them. After selecting the data sources to configure, fill out the criteria. Each data source has different criteria to enter.

Data source criteria

Add criteria to collect specific data. To configure the data sources, complete the following fields:

  • Select and unselected tabs - choose the data sources to collect from by moving unselected data sources to the selected list.
  • Field - choose the field to filter on within the data source.
      Notes: This field is only required when a calendar source is selected.
  • Operator - choose an operator such as equals, contains, greater than, or less than.
  • Value - enter a value to find in the selected field.

After selecting field options, you must click Add Criteria. Things to know about criteria:

  • Each criteria is then separated by an AND operator.
  • Leave the data source criteria empty to collect all data from the sources.
Criteria

Filter the data you want to collect by adding criteria. The criteria options change based on the selected data source. The table below lists all supported filter criteria. 

Microsoft 365 OneDrive Microsoft 365 Outlook Mailbox Microsoft 365 Outlook Calendar Microsoft 365 Outlook Contacts Slack X1 Email X1 Files
File Extension Email To Start Date N/A Channel Name Attachment Name Date Created
Creation Date Email From End Date   End Date BCC Date Modified
Modification Date Email CC     Slice Interval inHours CC Document Type
File Path Email BCC     Start Date Email Body Extension
File Name Email Sent Date       Folder Path Free Form Search
Keyword search Email Received Date       Free Form Search Indexing Status
  Keyword Search - Email Body       From Name
  Keyword Search - Email Metadata       Has Attachments Path
  Has Attachments       Indexing Status  
  Parent Folder Path       Received Status  
  Subject       Sent Date  
          Subject  
          To  

Microsoft 365 Outlook contact operators

All Outlook contacts are returned. There is no search criteria for Outlook contacts.

Microsoft 365 Outlook calendar operators

Start and end dates are required when using an Microsoft 365 Outlook Calendar data source. The maximum supported date range is five years. For example, it can be 1/1/2001 to 12/31/2006 but not 1/1/2000 to 12/31/2007.

Criteria Operators
Start Date Equals

End Date

Equals

Microsoft 365 OneDrive operators

When using search criteria to filter for Microsoft 365 OneDrive, different operators can return different results. Knowing the search operators is crucial.

The keyword search criteria uses the Search In operator. When using the Search In operator:

  • Search for a phrase by entering the phrase without any OR operators into the Value text box.
    Example: acme corp contract
  • Search for individual keywords by entering the keywords and separating them with an OR in the Value text box.
    Example: cat OR dog OR mouse
      Notes: Enter the OR operator with all capital letters. Keywords and phrases should be added in lower case only.
  • Keywords hit on matches and if a word is prefixed with a keyword.
    Example: "Work" will return "workday" and "workplace"
Criteria Operators
File Extension Equal, Does Not Equal, Contains
File Path Equal, Does Not Equal, Contains
File Name Equal, Does Not Equal, Contains
Creation Date Equals, Does Not Equal, Greater Than, Greater Than or Equals, Less Than, Less Than or Equals
Modification Date Equals, Does Not Equal, Greater Than, Greater Than or Equals, Less Than, Less Than or Equals
Keyword Search Search In

Note: For email, the date a message was received by a recipient or sent by the sender. For documents, the date a document was last modified.

Microsoft 365 Outlook Mailbox operators

When using search criteria to filter for Outlook Mailbox, different operators can return different results. For example, the search criteria uses Search In; it doesn't use Contains. When using the Search In operator:

  • Search for a phrase by entering the phrase without any OR operators into the Value text box.
    Example: acme corp contract
  • Search for individual keywords by entering the keywords and separating them with an OR in the Value text box.
    Example: cat OR dog OR mouse
      Notes: Enter the OR operator with all capital letters. Keywords and phrases should be added in lower case only.
  • Keywords hit on matches and if a word is prefixed with a keyword.
    Example: "Work" will return "workday" and "workplace"

When using the Parent Folder Name criteria, listing a parent folder includes the child folders in the returned results.

Criteria Operators
Email To Contains
Email From Equals, Contains
Email CC Contains

Email BCC

Contains
Email Sent Date Equals, Does Not Equal, Greater Than, Greater Than or Equals, Less Than, Less Than or Equals
Email Received Date Equals, Does Not Equal, Greater Than, Greater Than or Equals, Less Than, Less Than or Equals
Keyword Search Search In

Has Attachments

Equals, Does Not Equal
Parent Folder Name Equals, Does Not Equal, Contains
Subject Contains

For more information, see Microsoft Security and Compliance Center documentation.

Collecting preserved files

When running a collection with Microsoft data sources, all available files including preserved files are collected. No extra steps need to be taken to collect preserved files as they are automatically included in the collection.For more information on preserving data, see Preservation hold.

When a Microsoft places a data source on a preservation hold, Microsoft creates a preservation hold library, a Recoverable Items folder. The addition of the Recoverable Items folder to Microsoft Exchange is another folder that can be collected. Collect can collect this folder because the Removable Items folder is an additional folder within a Microsoft data source.

When emails and files are on a preservation hold in Microsoft 365, Microsoft preserves original copies of any deleted or modified items. Preserved emails are found in the Recoverable Items folder and preserved files are found in the Preservation Library. Collect automatically collects from these file locations.

Relativity collects all versions of the document available in the preservation library. Collecting all versions of a document means that Relativity collects multiple versions of the same file with the corresponding SHA-256 hashes for each version of the data. If there were changes in the file version, the hash should be unique. For more information on hash identifiers, see Collect tab.

Slack operators

Start and end dates are required when using the  Slack data source. The limit on how far back a collect can retrieve is based on your Slack Enterprise's Retention Policy.

Criteria Field Operators
Channel Name Equals
End Date Less Than Or Equals
Slice Interval in Hours Equals
Start Date Greater Than Or Equals

If a Slack channel with same name exists across multiple Slack workspaces within a collection, Relativity Collect will collect all content in both channels in both workspaces.

The Slice Interval in Hours criteria defaults the slice interval to 24 hours. This means Relativity Collect will create one file for the conversations within that 24-hour interval. If the conversation goes beyond 24 hours, a second Relativity Short Message File (RSMF) will be created. Another example is if you have a slice interval set to one hour and a conversation spans five hours, you will end up with five RSMFs after processing.

When collecting data, deleted messages are included. Deleted messages are displayed in Relativity on the day they were deleted instead of the day they were sent. Also, when a deleted message includes an attachment, only the message is collected. Files sent as attachments without a message and then deleted, the metadata is available for 24 hours, but the file isn't collected. When messages in threads are deleted and then collected, the messages are displayed outside of the thread in the RSMF.

Conversations in public or private channels are collected for each day in the date range regardless if the custodian participated in that channel on a given day.

X1 Email operators

Setting criteria for X1 emails is not required.

Criteria Field Operators
Attachment Name Contains, Does Not Equal, Equals
BCC Contains, Does Not Equal, Equals
CC Contains, Does Not Equal, Equals
Email Body Contains
Folder Path Contains, Does Not Equal, Equals
Free Form Search Equals
From Contains, Does Not Equal, Equals
Has Attachments Equals
Indexing Status Contains, Does Not Equal, Equals
Received Date Equals, Greater Than, Greater Than or Equals, Less Than, Less Than or Equals
Sent Date Equals, Greater Than, Greater Than or Equals, Less Than, Less Than or Equals
Subject Contains, Does Not Equal, Equals
To Contains, Does Not Equal, Equals

X1 File operators

Setting criteria for X1 files is not required.

Criteria Field Operators
Date Created Equals, Greater Than, Greater Than or Equals, Less Than, Less Than or Equals
Date Modified Equals, Greater Than, Greater Than or Equals, Less Than, Less Than or Equals
Document Type Contains, Does Not Equal, Equals
Extension Contains, Does Not Equal, Equals
Free Form Search Equals
Indexing Status Contains, Does Not Equal, Equals
Name Contains, Does Not Equal, Equals
Path Contains, Does Not Equal, Equals

Collection Summary

Complete the creation of the collection by reviewing all steps, custodians, data sources, and targets, before finalizing. If Microsoft 365 Custodian Targets weren't created before started the project, click Generate Targets. Clicking Generate Targets will check to see if targets exist for the custodians you've selected for collection. If the targets do not exist, Collect will automatically create them based on the email address contained in the Entity record for each custodian.

Complete the collection setup by clicking View Collection Details. Once you finish creating the collection, it redirects you to the Collection Details page. From the Collection Details page, you can run the collection from the Collection Summary. For more information, see Collection Console.

Viewing or editing collection details

You can display the collection details by clicking the name of a collection on the Collections tab. Collection also displays these details immediately after you add a new collection. On the Collection Details page, the buttons at the top of the page to edit, delete, or perform other collection tasks. Editing a collection takes you to the first step in the wizard. For more information, see Using the Collect wizard .

Note: Once a collection has started, the collection can't be edited and is locked in read-only mode.

  • Collection Details - lists the information that you entered or selected when you created the collection:
    • Name - the name given to the collection.
    • Collection Matter - the matter used in the collection.
    • Job Number - a number assigned to the job for reporting purposes.
    • Description - a description of the collection used for reporting purposes.
    • Job Status - the status of the collection (New, Not Started, Started, Completed, Error, Completed with Errors)
  • Collection Console - displays buttons that you can use to perform the following tasks. See Collect console.
  • Data Sources - lists all the collection activities associated with this collection.
    • Custodian - the custodian associated with the collection.
    • Data Sources Name - the name of the data source associated with the collection.
    • Data Source Target - the name of the target associated with the collection.
    • Status - displays one of the following statuses:
      • Not Started - the collection has not been started.
      • Started - the collection is in progress.
      • Completed - the collection is done.
      • Completed with Errors - the collection of the target completed and one or more targets had errors. For more information, see the Errors report.
      • Error - the collection failed. For more information, see Graph Error Codes.
    • Collected Items - the number of email files collected from the target.
    • Target - the custodian target associated with the data source.
    • Result Link - a Comma Separated Values file download listing all individual items collected from the target. It contains all of the associated metadata for each collected item as well. If no results, the file is empty. For more information, see Collect tab.
    • Error Link - a Comma Separated Values file download listing any individual items that couldn't be collected because of errors during the collection. The report provides as much metadata as it can along with as much error information as we can get from the source to help identify what caused the error. If no errors, the file is empty. For more information on errors, see Collect tab.

Storing collected data

Selecting Yes on the Collect Files in ZIP field, your collected data will be containerized and put into a password protected compressed folder. The compressed folders separated by the custodian target collected. Each custodian target collect has its own folder. These folders will split when reaching a set size. The compressed folders are then stored in the processing staging area by default. For more information, see RelativityOne Store.

These compressed folders can be secured with a password. You can enter a password that you or another user needs to enter to open the compressed folder. These passwords are stored in the password bank and can be retrieved there at a later time.

To export your collected data, use the RelativityOne Staging Explorer. For information, see RelativityOne Staging Explorer.

Viewing collected data

When Relativity collects the data, Relativity accepts the path names and file names that the source provides. On occasion, the collection source modifies the path name or file name.

Path names

When data is collected there is a 260-character limit on file paths and when it is reached, Relativity truncates the path name. The full path name for exported items includes the item's original location. If a truncated full path name already exists, a version number is added to the end of the file name; for example, statusmessage(2).msg.

File Names

Modifications of file names happens for documents that have been deleted from a Microsoft SharePoint or OneDrive for Business site that's been placed on a preservation hold. After a file on a site hold is deleted, the file document is automatically moved to the Preservation Hold library for the site, which is a folder created when the site was placed on hold.

Files names on a preservation hold

When the deleted document is moved to the Preservation Hold library, a randomly generated and unique ID is appended to the original file name of the document. For example, if the file name for a document is FY2017Budget.xlsx and that document is later deleted and then moved to the Preservation Hold library, the file name of the document that is moved to the Preservation Hold library is modified. For example, the file name is modified to something like FY2017Budget_DEAF727D-0478-4A7F-87DE-5487F033C81A2000-07-05T10-37-55.xlsx.

When a document on a site that's on hold is modified and versioning for the document library in the site has been enabled, a copy of the file is automatically created in the Preservation Hold library. In this case, a randomly generated and unique ID is also appended to the file name of the document that's copied to the Preservation Hold library.

The reason why file names of moved or copied documents to the Preservation Hold library is to prevent conflicting file names. For more information about placing a hold on sites and the Preservation Hold library, see Overview of in-place hold in SharePoint Server 2016.

Collect console

After completing a setup, run the collection with the collection console. Verify connection, start or stop a collection, and view a collection report from the Collection console on the Collection Details page.

Generate Targets

Generate the targets to retrieve all known Collect targets based on the custodians and data sources selected. Click the Generate Targets button to ensure you are using the latest target set. The targets do automatically generate when reaching the Summary Step of the Collect Wizard, but the console button prevents returning to the Collect Wizard.

Start Collection

Click the Start Collection button the initiate the collect project.

Note: Only one collection can be ran at a time.

Stop Collection

Click Stop Collection to end the collection project that is currently running. Once this button is clicked, a warning pop-up message appears to confirm that you want to stop. If the collection is stopped, the collection cannot be restarted.

Retry Collection

The Retry Collection button is only available when a collect job doesn't complete because of errors. Click Retry Connection to start another collect job.

Create Processing Job

Click Create Processing Job to create a processing set from the collected documents from the data sources. Locate these documents in the Processing Source Location set in Collection Details. For more information, see Processing sets.

Clone Collection

Click the Clone Collection button to duplicate the open collect job. Any collect job that has a status other than New can be cloned.

After clicking the Clone Collection button, a pop-up modal displays the progress and completion of the clone.

Once the job is cloned, it is placed in the Not Started status and can be found in the Collections list under the same name with "Cloned - YYYY-MM-DD HH.MM.SS" attached to the end. All collection totals for the cloned job associated targets are reset to zero. The Collection Detail Custodian Target fields are reset to 0. The cloned collect job will also generate the new targets.

Reports

Collect includes comprehensive reporting capabilities that you can use to view information about your collections. You can generate these reports in the collection console within a collection project. Click on the name of a report to download. When generating a report, Relativity downloads different files through your browser. For more information on specific reports, see Collect reports.