4. DIALÉCTICA DEL ESTALLIDO
5.9. LEY DEL INCESTO, LEY DEL DESEO
The examiner services machine performs all data collection and processing activities. The Examiner service must be able to communicate both with the sources where data will be searched and with all databases.
Multiple examiner service machines may be installed and configured to connect to the same data service and databases.
Guidance Software strongly recommends that all examiner service machines be configured with the same operating system, software, and settings.
Before you begin installation, make sure:
The computer running an examiner service machine is available over the network through Remote Desktop Connection with /admin and /console access.
You have local admin rights to the examiner service machine.
If you are not using a NAS license for the computer(s) running an examiner service machine, and do not have physical access to the computer(s) on-site, ensure that the security key drivers are loaded on each examiner service machine, and that the examiner service dongle is inserted into one of each computer’s USB ports.
The host-based firewall is set to allow TCP port 4445 for connections.
The data service is functioning and ready.
• Additionally, if Windows authentication is enabled, ensure that the examiner service account being used is authorized to access the data service. This enables the data service to start immediately after the setup is completed.
Configuration—Examiner Service Machine
Class Desktop or Server class hardware (64-bit)
Operating Systems Windows XP Professional SP3 64-bit
Windows 7 SP1 64-bit
Windows Server 2003 SP1 64-bit Standard, Enterprise
Windows Server 2003 R2 64-bit Standard, Enterprise
Windows Server 2008 SP1 64-bit Standard, Enterprise
Windows Server 2008 R2 64-bit Standard, Enterprise Processor (CPU) Intel® Quad-Core (e.g., Intel® Xeon®)
For machines doing heavy OCR processing, Guidance Software recommends a minimum of two or more hyperthreaded multi-core processors. Four or more cores per processor are preferable.
Memory (RAM) 16 GB or more (48 GB recommended)
1 additional GB of RAM per thread is recommended to process OCR. For most users, this translates to an extra 5 GB of RAM per running examiner service.
Hard Drive Capacity 500 GB or more with > 2.5 GB available on the drive where the operating system is installed. An additional 3 GB of free space is needed for the examiner service, whether it is installed on the C: drive or any secondary drive or partition.
The amount of disk storage required after installation depends upon the size of the original source data to be processed and the processing options selected. As a general guideline, allow enough storage for 10 times the original data size.
Configuration—Examiner Service Machine Hard Drive Speed 7,200 RPM (10,000 RPM or faster preferred) Number of Hard Drives
Recommended
For best performance, three hard drives are recommended: an application drive, a temp drive, and a separate drive for LEF files
Network Configuration Gigabit Ethernet (GbE)
Restrictions Intel® Itanium processors not supported
A dedicated, unshared USB port must be present, unless the Examiner license is acquired using Network Authentication Server (NAS)
Port 80, or 443 for SSL, must be available on this machine VMware The examiner service can be run using VMWare and Boot Camp as follows:
WMware Workstation 6.5
WMware Workstation 7.0
VMware Server 1.1 (GSX)
VMware vSphere 4.0 ESXi
Boot Camp v2.0
Boot Camp v3.0
Configuration—Examiner Service Machine
Additional Software IBM Lotus Notes Client v7 v8, v8.5 (if collecting or processing Domino server or NSF emails).
Microsoft Office 2003, 2007 SP2, or 2010 including a full version of Outlook and Excel (required)
Microsoft SQL Server 2008 or Microsoft SQL Server 2005 administration software.
Windows Imaging Component (WIC) must be installed to support Microsoft .NET 4, which is automatically installed if not present on the system. The WIC is available on all supported operating systems except Windows Server 2003. If you are installing the data service, examiner service, or Web components on Windows Server 2003, you must first install WIC. Please refer to Installing the .NET Framework at
http://msdn.microsoft.com/en-us/library/vstudio/5a4x27ek(v=vs.100).aspx.
For processing OpenText Livelink Repositories, a download is needed for Open Text if the Microsoft C++ runtime (CRT) is not present on the system. If you attempt to create an Open Text definition without the CRT, Open Text does not display as an option in the Create New Source dialog box.
For processing Documentum Repositories, the Documentum client must be installed.
For processing Symantec Enterprise Vault Repositories:
The examiner service machine and the Enterprise Vault servers must be on the same domain.
The examiner service machine must also point to the correct DNS Server when trying to connect to the Enterprise Vault server.
Connection is made using port 80; proxies are not supported.
The Enterprise Vault API runtime application must be installed on any computer running the desktop client or the examiner service, using Enterprise Vault as a source. You can find this on the Symantec installation media. Double click the .msi file to install the application and accept all of the defaults.
If collecting an Exchange email or journal archive on the Vault server, Outlook must be installed on the examiner service machine, and be configured for an Exchange account.
If collecting a Lotus Domino email or journal archive using a Vault 8 or 9 server, the Lotus Notes client must be installed on the examiner service computer.
To collect from SharePoint Online:
All components of Microsoft .NET v3.5.1 SP1 (installed automatically on 32-bit machines) must be installed. For 64-bit machines use "Add Features" (for MS Server 2008 R2) or "Turn Features On or Off" (for Windows 7) to install.
Collection from SharePoint Online is supported on Windows 7, Windows Vista SP2 or higher, and Windows Server 2008 R2 only.
The Windows Process Activation feature should be installed automatically. If prompted, agree to the installation.
Additional applications are required. See Connecting to SharePoint and SharePoint Online Repositories.
Collecting email and archives
To search electronic mail, the examiner service machines must have the same mail client software (Microsoft Outlook or Lotus Notes) installed. The version of the mail client must match that of the mail server to be searched. See Connecting to Email and Document Repositories on page 103.
To search Documentum and Symantec Enterprise Vault document servers, examiner service machines must have the respective client or runtime installed.
OpenText Livelink and SharePoint do not require any additional client-side installation.
SharePoint Online is supported on Windows 7, Vista SP2 or higher, and Windows Server 2008 R2 operating systems. It is not supported on Windows XP or Windows 2003 operating systems.
Connecting to the database server
If the examiner service machine connects to SQL Server using Windows Authentication, then the user logged into the examiner service machine must:
Be trusted for delegation (the user's Active Directory administrator can enable delegation).
Have read access to the Internal Output folder.
Additionally, the user through which the examiner service machine connects to the database must have Administer Bulk Operations permission.
Network ports and permissions
TCP Port 4445 is available for connectivity throughout the enterprise network.
If servlet deployment will be inter-domain, inter-domain trusts must be available for access to the SAFE and examiner service machines.
If network shares are to be collected, parent folders must allow read access. For example, when
collecting from \\server\share\folder, \\server\share must allow the examiner read access.
Pre-installation checklist—software
Before you begin installation, make sure the examiner service machine has the following settings:
Fast User Switching is set to off.
If you are using Windows Vista or Windows 7, and if the examiner service machine has the Windows Search service enabled, you must switch it off during installation. You can turn it off completely, or disable it only for the installation temporary directory (go to Control Panel >
Administrative Tools, and double click Services to locate the Windows Search service).
The host-based firewall is set to allow TCP port 4445 for connections.
Examiner service user permissions
The following are typical permissions required for successful collections:
Users must have local admin privileges to computers where the software will be installed.
For UNC collections of network shares, the examiner service doing collections must have Read permissions to the root storage directory for any user shares that will be collected for
eDiscovery.
For processing a live Exchange server, the examiner service must have an Administrator account and a mailbox on the Exchange server that has been logged into at least once. The examiner service must have at least Receive As and Read Only Admin privileges to the Exchange server.
Shared folder and NTFS permissions required to collect from network shares are:
• Share permission: Read
• NTFS Permissions:
− Read and execute: Allow
− List folder contents: Allow
− Read: Allow
Permissions shown in the permission entry table should be:
• Traverse folder/execute file: Allow
• List folder/read data: Allow
• Read attributes: Allow
• Read extended attributes: Allow
• Read permission: Allow
For Lotus Domino server versions 8.5, 8.0 and 7.0:
• Read public documents
• Write public documents
• Replicate or copy documents
For Lotus Notes local NSF versions 8.5, 8.0, and 7.0:
• Guidance Software does not support switching between Multiple User and Single User modes if you reinstall the Notes client on the examiner service computer(s). Because of how Lotus handles the .INI file, EnCase eDiscovery may not be able to connect to the Domino server after switching installation modes.
• EnCase eDiscovery collects the address books from the server. Set up users to back up their personal address books on the server, if you want EnCase eDiscovery to collect them.
• To assure that collection results remain consistent, do not run an older version of the Lotus Notes client against a newer version of the Domino server or NSF archive file, as collection results can be inconsistent.
For processing Open Text Livelink, the examiner service must have proper credentials on the OpenText server.
For processing Documentum, the user account must have access to the document repository (be added to the repository database) to collect document files. Normal user privileges are adequate.
For processing SharePoint Repositories, the examiner service must have Administrator permissions on the Sharepoint Repository.
To process Symantec Enterprise Vault and run a collection job against a Vault archive, the user must have Read permissions on that specific archive. Permissions on the Vault store or the Vault server are not sufficient.