Help

 

 

1)   Creating a New Project

 

The vision behind Shift is  to provide an uncomplicated interface to lead the client down the path of success without overly restricting processing options.

 

Upon logging into Shift for the first time, the user is presented with a simple prompt:

 

To create a new project, simply type the name of your project in the "Project Name" text box, and press "Add" to open the Project Workspace and get started.

 

The project list (as many other lists in Shift) can be sorted by name ("Name"), most recently used ("Recent"), or by created date ("Created"), in ascending or descending order. Clicking on any one of the sort order buttons will sort the list by the appropriate condition. Click a sort order button a second time to reverse the list by the appropriate condition (by name, most recently used, or created date).

a)      Irrevocably Delete a Project

To delete a project, click the "delete" button next to the project name in the projects list. A confirmation dialog will appear prompting you with further information about the deletion process; after reviewing the prompt, press "delete" again to confirm the deletion, or press "cancel" to abort.

NOTE: deleting a project will DELETE ALL FILES associated with the project, including uploaded source data, extracted native files, indexes, export volumes, etc. Shift does NOT provide any facility for restoring deleted projects!!!

2)   Custodians

a)      Creating a New Custodian (in order to upload data)

To upload data to the Shift service for the first time, it is necessary to enter the name of the custodian for which you wish to upload data for into the "Custodian Name" field and then click “Add.” If you wish to upload additional data for an existing custodian, simply click on the custodian name in the list to get to the upload screen for that custodian. 

 

The custodian name should reflect the person or entity from whose files or control the data was collected. 

It is your responsibility to document the chain of custody for evidentiary purposes up to the point of upload into Shift.

 

The custodian name you select at this step will be the name shown in the custodian field after processing.

 

To delete a custodian, click the "delete" button next to the export name in the custodians list. A confirmation dialog will appear prompting you with further information about the deletion process; after reviewing the prompt, press "delete" again to confirm the deletion, or press "cancel" to abort.

NOTE: deleting a custodian will DELETE ALL FILES associated with the custodian. Shift does NOT provide any facility for restoring deleted exports!!!

b)     Uploading Data

Upon typing a custodian name and clicking the right arrow, you will be shown the data uploader applet.  You can click and drag files into this box, or click the Add Files button and select single or multiple files using your operating system’s file browser.

 

 

There is a chance that the uploader module in Shift may appear differently depending on which browser you're using, and what features it supports. For the best experience, we recommend that you have the latest version of Java installed on your system and ensure your browser allows Java. (for more information, please visit www.java.com)

c)      Uploading Multiple Custodians at the same time

By opening additional tabs or windows in your browser logged into the same or different user sessions connected to the same project, it is possible to run concurrent uploads to different custodians at the same time, from the same, or different workstations.

d)     Format of uploaded Data:

Source data must be a RAR or ZIP archive for non-emails, or a .PST file.  Do not place a PST file inside of a ZIP or RAR file.

PDF portfolios, when contained in a RAR or ZIP file will extract into individual records with appropriate fields.

Recursive container files will extract.

Embedded PST files will NOT extract.

Individual files within a container file of greater than 2 GB (if not a recursive container file) may cause processing errors.

Uploading uncompressed data is not supported in order to reduce data transfer time.  To preserve the directory structure of the source data, it is recommended that you use a program such as WinRAR to compress the parent directory and all subdirectories and then upload that large archive into Shift.

f you wish to associate data with custodians, note that it if you choose to compress multiple custodians into a single compressed file, the data may only be associated with one custodian.

e)      Supported File Formats

Shift supports hundreds of file formats, including all of the industry-standard file formats such as Adobe Acrobat PDF, and Microsoft Office documents (including Outlook, Word, Excel, and Powerpoint, etc). Shift will attempt to extract & index all files in your dataset including attachments and embedded items. If Shift cannot index a document for some reason (including unsupported file formats) it will reference the document as an Exception.

3)   Shipping Data for On-Site Data Intake

For larger volumes of data, depending upon Internet transfer speeds, you may elect to ship your source data to a Shift data center for local / on-site data intake. To ship data to a Shift processing facility for on-site data intake, please see below for instructions on how to package your media for shipment (under the section "PACKAGING YOUR MEDIA FOR SHIPMENT"), and contact support to request a prepaid shipping label.

NOTE: if you send your request for a prepaid shipping label from a different email address than your Shift user account email address, please be sure to indicate as such in your email.

You may ship your data directly to Novitas Data Corporate Headquarters (where the Shift data center is located) at the following address:

 

Novitas Data LLC
ATTN: Shift Data Intake
610 SW Alder Street
Suite 1111
Portland, OR 97205

a)      Packaging your media for shipment

Please include a DATA INTAKE FORM (available from a link on the Shift web application) and a Chain of Custody Form (one for each media being shipped, the form can be in your company’s format) in the package with the source media.  Please add additional instructions, comments, or notes as needed. Also, please ensure that media is properly labeled if there are multiple media sources in the same package.

b)     On-Site Data Intake Policy

All On-Site Data Intake services are performed by a Novitas Data Computer Forensics Specialist. All forensic specialists deployed by Novitas Data are EnCase Certified Examiners (EnCE).

 

Once the data has been loaded, Shift will begin the very same background processes as described above (under the section "Uploading Files"), after which it will send the same email notifications and reports as described above.

c)      Email Notifications

Upon completion of your upload, unless specified in your personal profile, Shift will send an email to your contact email address confirming receipt of the uploaded file. Once a file is successfully uploaded Shift will begin a number of background processing tasks to prepare your data for Early Evidence Assessment (EEA).   These processes include fully recursive extraction of the source data (i.e. recursively extracting out emails, attachments, and embedded documents), metadata collection, and building a full text index of the entire dataset to prepare it for searching. Upon completion of these background processes, Shift will send an email notification to let you know your data is ready and available for searching and/or export. This email will also inform you of the availability of the following standard data intake reports:

 

4)   Reports

a)      Collected Data by Custodian (depends upon how you classify data during intake)

a)      Document Types

i)        Domains

b)     Duplicates

i)        Tags – (affected by the tags that you apply to your searches and documents)

c)      Timeline Report

d)     Exceptions Report:

The Indexing Exceptions Report provides a complete listing of unsearchable documents in the dataset. An unsearchable document is one that Shift was unable to index for any reason; common reasons for indexing exceptions are password-protection and/or file encryption, image documents (including "image-only" PDF files), corrupted files, unsupported file formats, and empty files. This list includes custodian, filename, path, file extension, file type, and file size information for every file in the dataset, as available (some properties may be unavailable). This report will also contain information about any errors that may have been encountered while processing certain documents).

 

5)   Searching

Searching in Shift is a powerful Lucene-based tool for finding, culling, and doing preliminary review of data.  All indexed file properties and many standard fields can be searched.  The more you use Shift, the more you will come to rely upon the flexibility that is no available in any other processing platform.

a)      Search Quick Help Table

b)     Starting a New Search Query

To create a new query, enter a description in the "Search Name" field (above), and press "Add" to open the search query editor. For example, enter "Privilege Terms", or "Initial Search Terms", etc.

c)      Sorting the Search List

The search list can be sorted by name ("Name"), most recently used ("Recent"), or by created date ("Created"), in ascending or descending order. Clicking on any one of the sort order buttons will sort the list by the appropriate condition. Click a sort order button a second time to reverse the list by the approriate condition (by name, most recently used, or created date).

d)     Delete a Search

To delete a search query, click the "delete" button next to the export name in the search list. A confirmation dialog will appear prompting you with further information about the deletion process; after reviewing the prompt, press "delete" again to confirm the deletion, or press "cancel" to abort.

e)      Search Query Editor

Shift uses an optimized version of the Apache Lucene search engine, which is very similar to other electronic discovery solutions. If you are familiar with the Lucene search syntax, you will be right at home with Shift. Regardless of your familiarity with Lucene, or any other search engine, the following Shift-specific search documentation should provide you with all the information you need to get started building powerful search & filtering queries in Shift:

f)       Building Searches

See below for documentation on the different types of searches that are supported in Shift. For some practical examples on how to perform certain types of searches, skip to the Example Searches section.

i)        Stop Words

As in any search index, certain words are ignored as search terms.  These are called “stop words.”  Any of these words are ignored in a search term:

"a", "an", "and", "are", "as", "at", "be", "but", "by", "for", "if", "in", "into", "is", "it", "no", "not", "of", "on", "or", "such", "that", "the", "their", "then", "there", "these", "they", "this", "to", "was", "will", "with"

 

g)      Single Term Search

A Single Term is a single word such as "test" or "hello". Multiple terms can be combined together to form a more complex search, or query (see below).

 

EXAMPLE(S)::

apples oranges bananas

 

EXPLANATION:

There's not much to explain here - in all of these examples, results will be returned for documents that hit on the search term in question.

As you'll learn later, the default operator in Shift searches is 'OR', which means that if you were to provide a list of search terms as shown above, results would be returned for documents that hit on any of the search terms in the list. If you're just getting started building complex search queries, this is a good place to start - just type (or copy and paste) all of the terms you are searching for into the search box and Shift will find any documents that hit on any of the terms in question.

h)     Phrase Search

A Phrase is a group of words surrounded by double quotes (").

EXAMPLE(S):

"Brooklyn Bridge"

EXPLANATION:

In this example, results will be returned for documents that hit on the exact phrase '"Brooklyn Bridge"', but not on documents that contain these words in any other order (e.g. "over the bridge to Brooklyn" would not match).

 

NOTE: “smart quote” characters (angled quotes) as opposed to straight quotes will search for the smart quote character and will not work for phrases.

i)        Fielded (Metadata) Search

Shift supports metadata searches through fielded search. When performing a search you can specify a field to search against by typing the name of the field followed by a colon (:), and then the term you are looking for in that field.

EXAMPLE(S):

Subject:meeting
Extension:xls
Recipients:"John Doe"

EXPLANATION:

In the first example, results will be returned for documents that have the term 'meeting' in the 'Subject' metadata field. In the second example, we demonstrate how it is possible to filter by extension; results will be returned for documents that have the value 'xls' in the 'Extension' metadata field. In the third example we demonstrate how to look for a particular phrase in a metadata field.

FIELDS:

 

One of the strengths of the fresh approach to data processing in Shift is the virtually unlimited access the software gives you to metadata fields, all of which are searchable.  What fields can be searched, depends upon what fields exist in your data, however, certain default fields are almost always populated.  The following is a list.  You can begin typing the name of a field and auto-complete will fill in the rest, and provide choice.  Shift also provides the below default fields in addition to other metadata fields.

 

Default Searchable Fields (case sensitive)

Description

AttachmentCount

Number of attachments associated with the documents.

AttachmentFilenames

The filenames of attachments, separated by semi-colon.

Attachments

The BegDocs of attachments, separated by semi-colons.

CC

The email CC field

Custodian

The custodian name associated with the document (exactly as you entered it)

Dataset

The filename of the search file uploaded to Shift (zip, rar, pst)

Domains

The email domains from any sender or recipient field of an email separated by semi-colon.

DisplayName

Filename of files and attachments, or Subject of emails

EmailAttachmentFilenames

semicolon-separated list of attachment filenames

Exception

Whether or not there was an exception

ExceptionReason

What kind of issue was discovered related to the document.  This will also show password protection and other items that show up in the exceptions report.

Extension

the file extension of the document

FSCreatedDate

File system created date property

FullText

The body text of a document that would become the extracted text file at export.

FSModifiedDate

File system modified date property

FileSize

(In bytes; e.g. 1024 bytes = 1 kb, 1048576 bytes = 1 MB)

GUID

Unique Shift identifier (always include in any export for purpose of overlay)

GlobalDedupe

The Guid of the original document against which the current one is being compared for global deduplication.

CustodianDedupe

The Guid of the original document against which the current one is being compared for custodian deduplication.

ParentGuid

The Shift identifier of the parent from which the document was extracted.  This is a viable candidate for an attachment field where ZIP or RAR files should not be considered parents.

RootGuid

The Shift identifier of the original parent from which the document was extracted.  This would be the root in instances of recursive extraction.

HashCode

MD5 hash code

IsRootDocument

True/False – Shows the very root document from which the item was extracted.

MimeType

The file type detected according to the MIME standard

NativeID

The document’s original filename.

NsrlHashcode

This is the hash code for purposes of comparing with a list for DeNSTing.  If a document has a hash code matching the most current NSRL list, it will be exluded if the deNST option is checked at export.  This also allows post-export deNST.

ReceivedDate

(in YYYY-MM-DD HH:MM:SS format, using 24-hour time)

Recipients

All email recipients.

RootGuid

(Internal ID of root/parent document)

Sender

The sender of an email.

SentDate

(in YYYY-MM-DD HH:MM:SS format, using 24-hour time)

SubPath

(Subdirectory, or email folder where document was extracted from)

Subject

The subject line of an email.

To

The TO recipient of an email.

Tags

Shift tags that have been applied to documents.  See the following section.

Additional Fields:

The fundamental shift in processing strategy is to identify and provide all metadata fields from the very beginning, whether they exist or not depends upon the source data.  Below are some widespread examples.

OfficeCreator

The name of the user who created the office document.

OfficeSharedDoc

Whether the document was shared.

Thread-Topic

The subject line minus the RE: and Fwd: extracted from Outlook pst files.

ConversationIndex

The conversation index field in an encoding suitable for parsing by Relativity for email conversations.

OutlookMessageFlags

Whether a document was “read”, sent to “self” or another of other interesting items.

PDF metadata and metadata that has yet to be discovered in the wild may also be discovered in your collected data.

 

Custom Fields

We can add a overlay metadata to your data of any text description that contains any information so long as we can associate it with a Shift Guid.  This is a custom process requiring technical time.  Generally the Tags field will serve this purpose best without custom time.

 


Boolean Operators

Boolean operators allow terms to be combined through logical operators 'AND', 'OR', 'NOT', '-', and '+' (the plus '+' symbol is used to indicate required words; the minus '-' symbol is used to indicate excluded words). NOTE: operators must be in UPPER CASE.

As hinted at earlier, the 'OR' operator is the implied or default operator. This means that if there is no boolean operator provided between terms, the 'OR' operator is used automatically.

EXAMPLE(S):

apples OR oranges
apples oranges
apples AND oranges
apples NOT oranges
apples -oranges
+apples oranges bananas

EXPLANATION:

In the first two examples, results will be returned for documents that hit on the word 'apples' or the word 'oranges' (in the second example OR is the implied/default operator). In the third example, results will only be returned if documents hit on both 'apples' and 'oranges'. In the forth example, results will be returned if documents hit on 'apples', but do not hit on 'oranges'. The fifth example is the same as the forth, using the minus character instead of the operator term 'NOT'. The sixth and final example is the equivalent to "apples OR (apples AND (oranges OR bananas))", as apples is the required term, but oranges and bananas are optional.

j)        Grouping

Use parentheses to group clauses into sub queries.

EXAMPLE(S):

(apples OR oranges) AND bananas
apples OR (oranges AND bananas)

EXPLANATION:

Grouping can change the meaning of your search terms. In the first example, results will be returned for documents that hit on 'bananas' and one of the two terms in parenthesis - 'apples' or 'oranges'. In the second example, results will be returned for documents that hit on 'apples', or for documents that hit on both 'oranges' and 'bananas'.

k)      Wildcards

Single-character wildcard replacement

Use the question-mark character (?) for single character wildcard replacement.

EXAMPLE(S):

appl?
appl???
a?t

EXPLANATION:

Using the single-character wildcard is useful to constrain the number of possible matches to your search term. In the first example, only documents that hit on 5-letter words that begin with 'appl' and end in any other character will be returned; 'appl?' will match on words like 'apple' and 'apply', but not 'applied'. In the second example, 'appl???' would return documents that hit on 7-letter words that begin with 'appl' and end in any three additional characters; 'appl???' will match on words like 'applied' and 'applies', but not on 'apple'. In the third example, results will be returned for documents that hit on any 3-letter word that starts with the letter 'a' and ends with the letter 't', such as 'ant', or 'art', etc.NOTE:You cannot use a ? wildcard as the first character of a search term.

Multiple-character wildcard replacement

Use the asterisk character (*) for multiple-character wildcard replacement.

NOTE: You cannot use a * wildcard as the first character of a search term.

EXAMPLE(S):

appl*a*le

EXPLANATION:

The multiple character wildcard is useful to find all words that contain a certain set of characters. In our first example, 'appl*' will return words such as apple, apples, applied, appliance, appliqué, etc. In the second example, results will be returned for documents that hit on any word (of any length) that begins with the letter 'a' and ends with the letters 'le', such as 'apple', 'ample', 'angle', 'aristotle', 'available', etc.

l)        Fuzzy Search

Use the tilde character (~) at the end of a term to make it a "fuzzy" search. Fuzzy searches will match on terms that deviate from the spelling of the provided search term by a certain factor (i.e. percentage). You may control the deviation of the fuzzy search by adding a value between 0 and 1.0 after the ~ to modify the required similarity of the fuzzy logic (1 meaning higher similarity; 0 meaning very low similarity). By default, if a value is not provided after the tilde character, all fuzzy searches are run at 0.5.

EXAMPLE(S):

roam~
roam~0.5
roam~0.75

EXPLANATION:

The first and second example are the exact same. The third example will match on fewer deviations from the term 'roam' than the previous examples. In this case 'roam~0.75' would match on 'road', or 'roams' (both one-character deviations from 'roam').

m)   Proximity Searches

Use a tilde (~) and proximity distance on the end of a phrase to create a proximity search. The proximity distance must be two (2) or more.

EXAMPLE(S):

"John Smith"~5

EXPLANATION:

Proximity Searches are used to find two related words when they are only relevant if they are in close proximity to each other. In the example, the name 'John Smith' is being searched for.

This example will hit on:

"The letter came from John F. Smith in the mail today"

But will not hit on:

"John White was the gentleman leading the group, but it was actually
Tom Smith that came up with the idea"

 

NOTE: Phrases will not work for “smart quote” (angled) quote characters, as seen in this example, beware when cutting and pasting from word processing software.

n)     Range Searching

Use brackets with a value range in a fielded search to gather all results withing that range. Square brackets '[ ]' are inclusive of the boundary, curly brackets '{ }' are exclusive.

EXAMPLE(S):

DateCreated:{2010-01-01 TO 2010-06-15}
AttachmentCount:[2-10] (not that ranges are alphabetical not numeric as this is a text index)

EXPLANATION:

Range searches allow for searching for a range of data within a field. This can be extremely useful for finding documents in a certain date range. The first example is a date search that will return all documents with a date of 2010-01-02 through 2010-06-14. Notice the curly brackets '{ }' make the search exclusive of the defined boundaries. The second example will find all docs that have 2 to 10 attachments. The square brackets '[ ]' are inclusive of the boundary.

o)     Special Characters

Special character searching allows for a search string to use any of the special characters:

+ - & | ! ( ) { } [ ] ^ " ~ * ? : \

To search for a term that includes one of these special characters it is necessary to "escape" the character so that it is treated like plain text, and not like an operator.

EXAMPLE(S):

Wendel\+Carson

EXPLANATION:

Special Characters are sometimes needed within search terms for content specific searches. Using the backslash followed by a special character will enable the special character to be used as a search character. In the example, if a company in a matter always refers to themselves as "Wendel+Carson", the first example search (above) would be used to find hits for that company name.

6)   Tagging

After conducting a search, rather than making ever more complex searches (although you may certain do so), you may rather create Tags in Shift.  Tags can be searched, and they will also be associated with the data that you export, allowing you to carry your preliminary work product, searching and culling activities in the review platform of your choice.

a)      Tag all X documents

You may elect to tag all results of a search by simply entering the name of your tag (without spaces) in the box that contains the text “Tag all XXX documents” and pressing enter.  Depending upon number of documents, your tags will be applied and searchable within seconds, or minutes.

b)     Tag individual documents

You may elect to tag a single document by clicking on the “add tags” box above the text snippet of a search result and entering a tag name.

7)   Exporting Data

a)      Creating a New Export

Native document review exports can be generated out of the Shift service in a number of ways, including downloadable volumes that can be loaded into traditional review platforms like Summationor Concordance. Native document review volumes contain the following contents:

Load file

Document metadata (reduced field load file and a load file containing all extractable metadata)

Native documents

text

HTML rendering

Exceptions Report (list of documents not included in export and why )

 

To create a native document review export, enter the name of the export into the "Export Name" field, and press "Add" to open the Export Settings screen.

b)     Sorting the Export List

The export list can be sorted by name ("Name"), most recently used ("Recent"), or by created date ("Created"), in ascending or decscending order. Clicking on any one of the sort order buttons will sort the list by the appropriate condition. Click a sort order button a second time to reverse the list by the approriate condition (by name, most recently used, or created date).

c)      Delete an Export

To delete an export, click the "delete" button next to the export name in the exports list. A confirmation dialog will appear prompting you with further information about the deletion process; after reviewing the prompt, press "delete" again to confirm the deletion, or press "cancel" to abort.

NOTE: deleting an export will DELETE ALL FILES associated with the export. Shift does NOT provide any facility for restoring deleted exports!!!

d)     Document Set

To create an export it is necessary to select a document set. The set of documents in a Shift Export is defined by selecting a saved search, or by selecting the "All Documents" export option to export the entire dataset.

e)      Starting Control Number

Input a starting Control Number for Shift to use for the export (e.g. "ABC000001"). Shift will maintain "zero padding" and auto-increment control numbers as it assigns them to document in the export volume. Control Numbers are used as a reference during the document review process, very much similar to Bates Numbers, but more transient in nature as Control Numbers are typically replaced by Bates Numbers in the later stages of the litigation process.

 

NOTE: if the total count of documents exceeds the allocation of digits indicated by the Starting Control Number Shift will add digits as they are needed (e.g. ABC001, ..., ABC999, ABC1000, ABC1001, etc). Shift supports alpha-numerical prefixes, where the last series of numerical digits following an alpha character are the numbers that will be incremented (e.g. for control numbers representing "John Doe 2011 email" you could use JD2011E00001 as a Starting Control Number). Shift also supports suffixing by using the hyphen character (-), however suffixing requires a hyphen character to be used _after_ a numerical sequence. For example, a Starting Bates Number of ABC-001 will result in the following sequence: ABC-001, ABC-002, etc; whereas a Starting Bates Number of ABC1-001 will result in the following sequence: ABC1-001, ABC2-001, ABC3-001, etc.

f)       Export Method

Shift supports two primary export methods: Download, or Online Hosting. Select "Prepare my export for DOWNLOAD" to have the native export volume created and made available to download for loading into a review platform or another viewing method.

 

·         Your export will be arranged a compressed zip file containing  DATA folder, a SOURCE folder, a TEXT folder, an HTML folder, depending upon the settings you selected. 

·         The DATA folder will contain a simple load file and a load file containing all indexed fields as well as exceptions reports.

·         The TEXT folder will contain text files named after control number, one per document.

·         The SOURCE folder will contain the native files, native after control number.

·         The HTML folder will contain HTML renderings of each native file, named after control number.

 

 Alternatively, you may select "Prepare my export for ONLINE REVIEW" Selecting one of the ONLINE REVIEW export methods will put  you in touch with Novitas Data Project Manager who will be available to consult on customizing your review database to your needs.

 

For custom output, please contact support@novitasdata.com and request a project manager to address your specific needs.  A template for custom field naming and custom fields can be set up for your project.

 

Shift 2.6, Help version 1.0