JP6404294B2 - Forensic system, forensic method, and forensic program - Google Patents

Description

The present invention relates to a forensic system, a forensic method, and a forensic program, and more particularly, to a forensic system, a forensic method, and a forensic program for collecting document data related to a lawsuit.

  Conventionally, when computer crimes and legal disputes such as unauthorized access and leakage of confidential information occur, the equipment, data, and electronic records necessary for investigation and investigation are collected and analyzed, and the legal evidence is revealed. Means and techniques to make it have been proposed.

  Also, eDiscovery (electronic disclosure) is required in US civil lawsuits, and both the plaintiff and the defendant in the lawsuit are responsible for submitting all relevant digital information as evidence. Therefore, digital information recorded on a computer or server must be submitted as evidence.

  On the other hand, with the rapid development and spread of IT, since most information is created by computers in today's business world, a lot of digital information is flooded even within the same company.

  Therefore, in the process of preparing for submission of evidence to the court, it is easy to make mistakes that include confidential digital information not necessarily related to the lawsuit as evidence. Moreover, it has been a problem to submit confidential document data not related to the lawsuit.

  In recent years, Patent Documents 1 to 3 have proposed techniques relating to document data in a forensic system. In Patent Document 1, a specific person is specified from at least one target person included in the target person information of the document submission order, and the specific person is based on the access history information regarding the specified specific person. Extracts only the accessed digital document data, sets incidental information indicating whether each document file of the extracted digital document data is related to a lawsuit, and documents related to a lawsuit based on the incidental information A forensic system for outputting a file is disclosed.

  Further, Patent Document 2 displays recorded digital information, and for each of a plurality of document files, specifies a target person indicating which target person is included in the target person information included in the target person information. Information is set, the set target identification information is set to be recorded in the storage unit, at least one target is specified, and target identification information corresponding to the specified target is set Searches the document file, sets incidental information indicating whether or not the retrieved document file is related to the lawsuit, and outputs the document file related to the lawsuit based on the supplementary information. A forensic system is disclosed.

  Further, Patent Document 3 accepts designation of at least one or more document files included in the digital document data, accepts designation of which language the designated document file is to be translated, The common document file that shows the same contents as the specified document file is extracted from the digital document data that has been translated into the language in which the designation is accepted and recorded in the recording unit, and the extracted common document file is translated There has been disclosed a forensic system that generates translation-related information indicating that a document file has been translated by using the translation content of the document file, and outputs a document file related to a lawsuit based on the translation-related information.

JP 2011-209930 A JP 2011-209931 A JP 2012-32859 A

  However, for example, in a forensic system such as Patent Document 1 to Patent Document 3, a large amount of document data of a target person using a plurality of computers and servers is collected.

The work called "review", which sorts whether such a large amount of digitized document data is appropriate as evidence for the lawsuit, is visually confirmed by a user called a "reviewer" The document data needs to be sorted one by one, and there is a problem that the accuracy and efficiency of the sorting work are affected by the ability and physical condition of the reviewer.

The present invention has been made in view of the above circumstances, if the the record information and the prediction information differs, by generating and outputting a arouse data attention to the user, to maintain the motivation of a Subscriber, review the efficiency of it is an object to provide a forensic system and forensic method, and forensic program that allows to achieve reduction.

The present invention includes a memory for recording digital information, and a controller for analyzing the digital information, a forensic system Ru wherein the controller, the extracts a plurality of document data from the digital information, the plurality of documents Causing the user to input data relating to the relevance with the lawsuit, and based on the input, the first information for classifying the relevance into one of a plurality of types; and the input At least one of the second information related to speed is set in the document data related to the input as the user's performance information, and the document is reviewed by the user based on the set performance information Prediction information related to the input of the relevance is generated for the data, and when the record information is set in the document data, the record information is compared with the prediction information. , Said record information, if said prediction information, are different, and generates and outputs arouse data attention to the user, it is characterized. The invention forensic methods to further, and a forensic program.

According to the onset Ming forensic system, if the record information and the prediction information differs, by generating and outputting a arouse data attention to the user, to maintain the motivation of the user, the efficiency of reviews It becomes possible to plan.

The block diagram of the forensic system in the 1st Embodiment of this invention The figure which showed typically the review screen in the 1st Embodiment of this invention The figure which showed typically the review screen in the 1st Embodiment of this invention The figure which illustrated the icon which the icon production | generation part in the 1st Embodiment of this invention produces | generates The flowchart showing the process of the 1st Embodiment of this invention. Block diagram of the forensic system in the second embodiment of the present invention The graph which showed the analysis result in the selection part in the 2nd Embodiment of this invention The flowchart showing the prediction information generation process of the 2nd Embodiment of this invention.

[First Embodiment]
Hereinafter, a first embodiment of the present invention will be described with reference to FIGS.

  A forensic system according to a first embodiment of the present invention is a forensic system that acquires digital information recorded in a plurality of computers or servers and analyzes the acquired digital information, and a plurality of documents included in the digital information. The result information is at least one of the result information indicating the result of the relevance determination with the lawsuit performed by the user and the progress information indicating the information regarding the progress speed of the relevance determination of the user. A determination acquisition unit 111 to be acquired, a recording unit 112 that records performance information acquired by the determination acquisition unit 111, and a prediction information generation unit 113 that generates prediction information related to at least one of result information and progress information; , Based on the comparison result of the information comparison unit 114 that compares the performance information and the prediction information, and the information comparison unit 114 , And a icon generating unit 115 that generates the icon to present the evaluation to the user of the relevance determination.

  The forensic system includes a computer or a server, and operates as various functional units when a CPU executes a program recorded in a ROM based on various inputs. The program may be stored in a storage medium such as a CD-ROM, or distributed via a network such as the Internet and installed in a computer.

  In this embodiment, a user called a reviewer determines relevance with a lawsuit in order to extract a document that needs to be submitted in the lawsuit from document data. In the relevance determination, a classification code may be given according to the degree of relevance. This act of determining whether the system or user is related to a lawsuit is called review. In the review, the document data to be reviewed is classified into a plurality of types based on the degree of relation of the lawsuit and the manner of relation with the lawsuit.

  Document data refers to information including one or more words. Examples of document data include electronic mail, presentation materials, spreadsheet materials, meeting materials, contracts, organization charts, business plans, and the like. It is also possible to handle scan data as document data. In this case, an OCR (Optical Character Reader) device may be provided in the forensic system so that the scan data can be converted into text data.

  FIG. 1 shows a block diagram of a forensic system in the first embodiment. In the present embodiment, the forensic system includes a server device 100 and a client terminal 200.

  Server apparatus 100 and client terminal 200 are connected via a communication network. A communication network refers to a wired or wireless communication line. For example, a telephone line or an internet line.

  The server device 100 includes a determination acquisition unit 111, a recording unit 112, a prediction information generation unit 113, an information comparison unit 114, and an icon generation unit 115.

  In the present embodiment, each component is mounted on the server device 100, but may be mounted in separate housings.

  The client terminal 200 is a computer, and has a screen display unit 211 and an instruction unit 290 (not shown in FIG. 1) for displaying the review screen I1 shown in FIG.

  The screen display unit 211 refers to a display for display (liquid crystal display, CRT monitor, organic EL display, etc.). The instruction unit 290 is a mouse or a keyboard.

  The user connects to the server apparatus 100 via the client terminal 200 and performs a review on the review screen I1 displayed by the screen display unit 211.

  The function of each component will be described with reference to FIG.

  The determination acquisition unit 111 acquires the result information of the relevance determination performed on the document data by the user. The performance information includes at least one of result information and progress information.

  The result information refers to a result of determination of relevance with a lawsuit performed on document data by a user, that is, information indicating the presence or absence of relevance. A classification code indicating the degree of relevance with a lawsuit given to document data by a user may be indicated.

  Progress information refers to the speed of the user's relevance judgment. Specifically, it refers to the number of document data for which the user has made a relevance determination per unit time. Note that the number of document data for which the relevance determination per unit time is performed on all the document data requiring relevance determination may be used. In this embodiment, the determination information acquisition unit acquires the progress information from the time taken by a user to determine the relevance of document data and the data capacity of the document data, and the value divided by the time. get.

  The recording unit 112 records the record information acquired by the determination acquisition unit 111. In the present embodiment, the data is recorded on the hard disk in the server device 100, but may be a database installed outside the server device 100.

  The prediction information generation unit 113 generates prediction information. Prediction information refers to information that predicts a user's relevance judgment. At least one of result information and progress information is included. Moreover, the prediction information generation part 113 is good also as what analyzes the characteristic of a user's relevance judgment from the acquired result information, and produces | generates the prediction information regarding result information based on the result of this analysis. Further, the prediction information generation unit 113 may further analyze the progress of the relevance determination of other users and generate prediction information related to the progress speed of the relevance determination based on the result of the analysis. Further, the prediction information generation unit 113 may further analyze the progress status of the user's past relevance determination and generate prediction information regarding the progress speed of the relevance determination based on the analysis result.

  In the present embodiment, the prediction information generation unit 113 generates prediction information related to result information for document data similar to document data for which the user has determined relevance. It is good also as what produces | generates the prediction information regarding result information using the method of Example 2 mentioned later. Further, the prediction information generation unit 113 can also predict the number of document data and the data capacity to be reviewed by the user per next unit time from the progress information acquired so far by the determination acquisition unit 111.

  The information comparison unit 114 compares the performance information with the prediction information. In addition, it compares when prediction information and performance information contain the same information. Specifically, the prediction information including the result information and the actual information may be compared with each other, or the prediction information including the progress information and the actual information may be compared with each other. Moreover, it is good also as what compares the prediction information and performance information which each contain both result information and progress information.

  The information comparison unit 114 notifies the icon generation unit 115 of the comparison result.

  The icon generation unit 115 generates an icon based on the comparison result. Further, the icon generation unit 115 may change the display format of at least one of icon operation, speech, and facial expression based on the comparison result.

  The icon refers to an item that presents an evaluation to the user. It may be easy to feel a friendliness like a character. FIG. 3 is a schematic diagram of the review screen I1 in a state where the icon generation unit 115 according to the present embodiment presents an icon. 3 represents the icon generated by the icon generation unit 115, and b1 in FIG. 3 represents the evaluation content as a serif.

  Evaluation refers to feedback on relevance judgment made by the user. It may be based on the comparison result. Specifically, for example, when progress information acquired as performance information is significantly slower than progress information predicted as prediction information, a comment that prompts an improvement in determination speed may be presented as an evaluation. In addition, when the predicted result information is different from the result information acquired as a result, an evaluation to call attention may be presented.

  The process of the icon generation unit 115 will be specifically described by taking as an example a case where the information comparison unit 114 compares the performance information related to the progress information with the prediction information. FIG. 4 shows an example of an icon generated by the icon generation unit 115. It is assumed that the prediction information predicted by the prediction information generation unit 113 is 50 document data per unit time based on the past performance information.

  (A1) in FIG. 4 shows an icon that says a line “What happened today?” While performing an operation of raising the neck with a troubled expression. This is generated when the performance information acquired by the determination information acquisition unit is significantly less than 50. As a result, it is possible to prompt the user to improve the review speed.

  (A2) in FIG. 4 shows an icon that says a line “Please do your best” while cheering with a laughed expression. This icon is generated when both the prediction information and the performance information are the same progress information. This makes it possible to give the user confidence that there is no problem if the review is performed at the current pace.

  (A3) in FIG. 4 shows an icon that says a line saying “You need to be careful” while running with a painful expression. This icon is generated to call the user's attention when the performance information exceeds the pace of the prediction information. As a result, it is possible to prevent the user from making a relevance determination without carefully reading the document data.

  Next, a processing flow of the forensic system according to the present embodiment will be described with reference to FIG.

  When the user determines that there is relevance for a certain document data (document 1) (STEP 101), the determination information acquisition unit acquires the actual information about the document 1 (STEP 102). Specifically, the result information that the document 1 is related to the lawsuit and the progress information obtained from the value obtained by dividing the data size of the document 1 by the time taken to determine the document 1 are obtained as the performance information. To do. The acquired performance information is recorded on the hard disk of the server apparatus 100 by the recording unit 112 (STEP 103).

  Next, the prediction information generation part 113 produces | generates prediction information from the past performance information and the performance information of another user (STEP104). The information comparison unit 114 compares the result information with the prediction information (STEP 105). The icon generation unit 115 generates an icon based on the comparison result, and presents an evaluation of relevance judgment to the user as needed (STEP 106).

[Second Embodiment]
Hereinafter, a second embodiment of the present invention will be described with reference to FIGS.

  A forensic system according to a second embodiment of the present invention acquires digital information recorded in a plurality of computers or servers, and analyzes the acquired digital information in a forensic system that includes a plurality of documents included in the digital information. The result information is at least one of the result information indicating the result of the relevance determination with the lawsuit performed by the user and the progress information indicating the information regarding the progress speed of the relevance determination of the user. A determination acquisition unit 111 to be acquired, a recording unit 112 that records performance information acquired by the determination acquisition unit 111, and a prediction information generation unit 113 that generates prediction information related to at least one of result information and progress information; , Based on the comparison result of the information comparison unit 114 that compares the performance information and the prediction information, and the information comparison unit 114 , And a icon generating unit 115 that generates the icon to present the evaluation to the user of the relevance determination.

  The forensic system according to the present embodiment further includes an extraction unit 121 that extracts a predetermined number of document data from digital information, a display unit 122 that displays the extracted document data on a screen, and the displayed document data. On the other hand, the result receiving unit 123 that receives the determination result of the relevance performed by the user, and the extracted document data is classified according to the determination result based on the determination result. A keyword selection unit 124 that analyzes and selects a keyword that appears, a keyword recording unit 125 that records the selected keyword, a search unit 126 that searches the document data for keywords recorded in the keyword recording unit 125, and a search unit Using the search result of 126 and the analysis result of the selection unit 124, a score for calculating a score indicating the relationship between the determination result and the document data is calculated. And a calculation unit 127, the prediction information generating unit 113 is for generating a prediction information about the result information by using the score.

  FIG. 6 shows a block diagram of the forensic system according to this embodiment.

  The server apparatus 100 includes a determination acquisition unit 111, a recording unit 112, a prediction information generation unit 113, an information comparison unit 114, an icon generation unit 115, an extraction unit 121, a display unit 122, and a result reception unit 123. , A selection unit 124, a keyword recording unit 125, a search unit 126, and a score calculation unit 127.

  In the present embodiment, each component is mounted on the server device 100, but may be mounted in separate housings.

  The client terminal 200 has a screen display unit 211 that displays the review screen I1 shown in FIG. A user called a reviewer connects to the server apparatus 100 via the client terminal 200 and performs a review on the review screen I1.

  The function of each component will be described with reference to FIG.

  The extraction unit 121 extracts document data from digital information. When extracting, it samples at random from digital information. Further, it may be extracted based on attributes such as update date and time of document data.

  The display unit 122 displays the extracted document data. Specifically, an instruction is issued to display the extracted document data on the client terminal 200 used by the user.

  The result receiving unit 123 receives the result of the user's relevance determination.

  The selection unit 124 selects a keyword. It is also possible to analyze and select keywords that appear in common in document data for which the same determination result has been made.

  FIG. 7 is a graph showing a result of the selection unit 124 analyzing keywords that frequently appear in document data determined to be relevant. In FIG. 7, the vertical axis R_hot includes a keyword selected as a keyword associated with the document data determined to be relevant among all the document data determined to be relevant by the user, and the relevance The ratio of the document data determined to be present is shown. The horizontal axis R_all indicates the ratio of document data including a keyword searched by the search unit 126 described later, out of all document data reviewed by the user. In the present embodiment, the selection unit 124 selects keywords plotted above the straight line R_hot = R_all as keywords common to document data determined to be relevant.

  A keyword is a group of character strings having a certain meaning in a certain language. For example, the keyword of a sentence “classify a document” may be “document”, “classify”, and “do”.

  The keyword recording unit 125 is for recording a keyword. It may be a database.

  The search unit 126 searches for a keyword from document data.

  The score calculation unit 127 is a unit that calculates the score of document data. The score may be calculated based on the evaluation value of the keyword included in the document data. The evaluation value is calculated based on the appearance frequency of keywords in the document data and the amount of transmitted information, and may be the amount of information that is exhibited in each document data.

  A score refers to the degree of relevance with a lawsuit in certain document data. The score is calculated based on keywords included in the document data. For example, document data including a keyword that needs to be submitted at the time of litigation may have a higher score. The document data may be given an initial score based on certain requirements. For example, the initial score may be calculated based on keywords appearing in the document data and evaluation values of the keywords.

  The score calculation unit 127 can calculate a score from the following formula using the keywords appearing in the document group and the weighting of each keyword.

The weight of each keyword is determined based on the amount of information transmitted by the keyword. The weighting can be learned by the following equation.

  The prediction information generation unit 113 generates prediction information related to the result information based on the score calculated by the score calculation unit 127. Specifically, the document data whose score exceeds a predetermined threshold is predicted to be relevant, and the document data that does not exceed the threshold is predicted to be unrelated, and prediction information is generated.

  The flow of the prediction information generation process in this embodiment will be described using FIG. First, the extraction unit 121 extracts a predetermined number of document data from digital information (STEP 201). The display unit 122 displays the extracted document data on the screen of the client terminal 200 (STEP 202). The result receiving unit 123 receives the result of the user's relevance determination (STEP 203), and the selection unit 124 analyzes the document data from the result of the user's relevance determination and selects a keyword (STEP 204). The selected keyword is recorded by the keyword recording unit 125 (STEP 205). Next, the search unit 126 searches for the keyword recorded from each document data (STEP 206), and the score calculation unit 127 calculates the score of each document data using the formula (1) (STEP 207). Based on the calculated score, the prediction information generation unit 113 generates prediction information related to the result information (STEP 208).

  Other configurations and functions are the same as those in the first embodiment.

[Other Embodiments]
In addition to those shown in the first embodiment and the second embodiment, the icon generation unit 115 can present an evaluation based on the content of the document data currently being reviewed by the user. .

  For example, it may be presented based on the date and time of creation of the document data, the creator, and the security level. Specifically, when a user performs a review on document data created by a person highly relevant to a lawsuit, an icon that particularly calls attention may be generated to present an evaluation. .

  Other configurations and functions are the same as those in the first embodiment.

  A forensic system acquires digital information recorded in a plurality of computers or servers, and analyzes the acquired digital information. A forensic system performs a plurality of document data included in the digital information by a user. A determination acquisition unit 111 for acquiring at least one of the result information indicating the result of the relevance determination with the lawsuit and the progress information indicating the information regarding the progress speed of the relevance determination of the user, and the determination acquisition; Information obtained by the unit 111 for recording the record information, the prediction information generating unit 113 for generating the prediction information related to at least one of the result information and the progress information, and the information for comparing the record information and the prediction information Based on the comparison result of the comparison unit 114 and the information comparison unit 114, it is possible to determine the relevance of the user. When the icon generation unit 115 for generating an icon for presenting an evaluation is provided, feedback is appropriately provided to the user according to the progress of the review or the degree of relevance of the document data being reviewed. This makes it possible to maintain user motivation and improve the efficiency of reviews.

  Further, when the prediction information generation unit 113 analyzes the characteristics of the user's relevance determination from the acquired result information and generates prediction information related to the result information based on the analysis result, Thus, when the system predicts the relevance determination result of the user and the prediction result and the actual determination result of the user are different, the user can be alerted.

  In addition, when the prediction information generation unit 113 further analyzes the progress of the relevance determination of another user and generates the prediction information regarding the progress speed of the relevance determination based on the result of the analysis, If the system predicts the judgment result of a specific user for a certain document data from the result of the relevance judgment of the user, and the prediction result and the judgment result of the actual user are different, the specific use It is possible to alert the person.

  Further, when the prediction information generation unit 113 further analyzes the progress status of the user's past relevance determination and generates prediction information related to the progress speed of the relevance determination based on the result of the analysis. The review progress speed is predicted from the user's past progress speed, and when the predicted progress speed is different from the actual user's progress speed, the user can be alerted.

In addition, when the icon generation unit 115 changes the display format of at least one of icon operation, speech, and facial expression based on the comparison result, the icon generation unit 115 presents an appropriate evaluation according to the situation of the user. Is possible.
As described above, the forensic analysis system according to the present invention is a forensic analysis system that acquires digital information recorded in a plurality of computers or servers and analyzes the acquired digital information. At least one of the result information indicating the result of the relevance judgment with the lawsuit performed by the user and the progress information indicating the information regarding the progress speed of the relevance judgment of the user for the document data A determination acquisition unit acquired as information, a recording unit that records the actual information acquired by the determination acquisition unit, a prediction information generation unit that generates prediction information related to at least one of the result information and the progress information, and the results Based on the comparison result of the information comparison unit and the information comparison unit that compares information and prediction information Against and a icon generating unit that generates an icon to present evaluation.
“Document data” refers to information including one or more words. Examples of document data include electronic mail, presentation materials, spreadsheet materials, meeting materials, contracts, organization charts, business plans, and the like.
“Relevance determination” refers to determining whether document data needs to be submitted to a lawsuit. In the relevance determination, a classification code may be given according to the degree of relevance.
“Result information” refers to information indicating a result of determination of relevance with a lawsuit performed on document data by a user. The result information may refer to a classification code that represents the degree of relevance with a lawsuit given to document data by a user.
“Progress information” refers to the speed of the user's relevance judgment. The progress information may indicate the number of document data for which the user has made a relevance determination per unit time. Further, the progress information may be the number of document data for which the relevance determination per unit time is performed on all the document data for which the relevance determination is necessary.
“Result information” refers to information related to at least one of result information and progress information. The record information may include both result information and progress information.
The “determination acquisition unit” refers to a unit that acquires information about a determination result made by a user on document data.
The “recording unit” refers to a unit that records performance information.
“Prediction information” refers to information that predicts a user's relevance judgment. The prediction information may be related to at least one of the result information and the progress information.
The “prediction information generation unit” refers to a unit that generates prediction information. A prediction information generation part is good also as what produces | generates the prediction information regarding at least any one among result information or progress information. The prediction information generation unit may analyze the characteristics of the user's relevance determination from the acquired result information, and generate prediction information related to the result information based on the analysis result. Further, the prediction information generation unit may further analyze the progress of the relevance determination of other users and generate prediction information related to the progress speed of the relevance determination based on the result of the analysis. Further, the prediction information generation unit may further analyze the progress status of the user's past relevance determination and generate prediction information related to the progress speed of the relevance determination based on the analysis result.
The “information comparison unit” refers to a unit that compares a plurality of pieces of information. An information comparison part is good also as what compares, when prediction information and track record information contain the same information. Specifically, each of the information comparison units may compare the prediction information including the result information and the actual information, or may compare the prediction information including the progress information and the actual information, respectively. . In addition, the information comparison unit may compare the prediction information including both the result information and the progress information with the result information.
“Evaluation” refers to feedback on relevance judgment made by the user. The evaluation may be based on the comparison result. Specifically, for example, when progress information acquired as performance information is significantly slower than progress information predicted as prediction information, a comment that prompts an improvement in determination speed may be presented as an evaluation. In addition, when the predicted result information is different from the result information acquired as a result, an evaluation to call attention may be presented.
“Icon” refers to a simple picture that presents an evaluation to the user. For example, the icon may be easy to feel familiarity like a character.
The “icon generation unit” refers to a unit that generates an icon based on the comparison result. The icon generation unit may change the display format of at least one of icon operation, speech, and facial expression based on the comparison result. Further, the icon generation unit may present an evaluation according to the content of the document data for which the user is making the relevance determination. For example, when the user makes a relevance determination for document data created in a specific age, an evaluation that calls attention may be presented.
The forensic analysis system according to the present invention further includes an extraction unit that extracts a predetermined number of document data from the digital information, a display unit that displays the extracted document data on a screen, and the displayed document data. A result receiving unit that receives the determination result of the relevance performed by the user, and the extracted document data is classified according to the determination result based on the determination result, and appears in common in the classified document data Analyzing a keyword to be selected, a keyword recording unit for recording the selected keyword, a search unit for searching the keyword recorded in the keyword recording unit from document data, a search result of the search unit, and a selection unit A score calculation unit that calculates a score indicating the relationship between the determination result and the document data using the analysis result, and the prediction information generation unit uses the score to obtain a result Or as generating prediction information about the broadcast.
“Extractor” refers to a unit that extracts document data from digital information. The extraction unit may sample and extract at random. Further, it may be extracted based on attributes such as update date and time of document data.
The “display unit” displays the extracted document data. The display unit may be displayed on a client terminal used by the user.
The “result reception unit” refers to a unit that receives a result of a user's relevance determination.
The “selection unit” means a keyword selection unit. The selection unit may analyze and select keywords that appear in common in document data having the same determination result.
“Keyword” refers to a group of character strings having a certain meaning in a certain language. For example, the keyword of a sentence “classify a document” may be “document”, “classify”, and “do”.
“Keyword recording unit” refers to a unit that records a keyword. The keyword recording unit may be a database.
The “search unit” is a unit that searches a keyword from document data.
The “score calculating unit” is a unit that calculates the score of document data. The score calculation unit may calculate a score based on an evaluation value of a keyword included in the document data. In the score calculation unit, the evaluation value may be the amount of information that each keyword exhibits in a certain document data. The evaluation value may be calculated based on the appearance frequency of keywords in the document data and the amount of transmitted information.
“Score” refers to the degree of relevance with a lawsuit in certain document data. The score is calculated based on keywords included in the document data. For example, document data including a keyword that needs to be submitted at the time of litigation may have a higher score. The document data may be given an initial score based on certain requirements. For example, the initial score may be calculated based on keywords appearing in the document data and evaluation values of the keywords.
Further, the forensic analysis method according to the present invention is a forensic analysis method for acquiring digital information recorded in a plurality of computers or servers, and analyzing the acquired digital information. At least one of the result information indicating the result of the relevance determination with the lawsuit performed by the user and the progress information indicating the information regarding the progress speed of the relevance determination of the user with respect to the document data is the performance information. A step of acquiring the actual information, a step of recording the acquired actual information, a step of generating prediction information related to at least one of the result information or the progress information, a step of comparing the actual information and the prediction information, and information An icon that presents an evaluation of the user's relevance judgment based on the comparison result of the comparison unit And a step of generating a.
In addition, the forensic analysis program according to the present invention acquires digital information recorded in a plurality of computers or servers, and in the forensic analysis program for analyzing the acquired digital information, the computer includes a plurality of digital information included in the digital information. At least one of the result information indicating the result of the relevance determination with the lawsuit performed by the user and the progress information indicating the information regarding the progress speed of the relevance determination of the user with respect to the document data is the performance information. A function for acquiring the information, a function for recording the acquired result information, a function for generating prediction information related to at least one of the result information or the progress information, a function for comparing the result information and the prediction information, and information Based on the comparison result of the comparison unit, an application that presents an evaluation of the user's relevance judgment Implementing a function to generate a con.
The forensic analysis system of the present invention acquires digital information recorded in a plurality of computers or servers, and analyzes the acquired digital information in a forensic analysis system for a plurality of document data included in the digital information. A determination acquisition unit that acquires at least one of the result information indicating the result of the relevance determination with the lawsuit performed by the user and the progress information indicating the information regarding the progress speed of the relevance determination of the user as the performance information. And the record information recording result information acquired by the judgment acquisition unit, the prediction information generation unit generating prediction information related to at least one of the result information and the progress information, and the result information and the prediction information are compared. Based on the comparison result between the information comparison unit and the information comparison unit If the icon is provided with an icon generation unit that generates a user's icon, feedback is provided to the user appropriately according to the progress of the review or the degree of relevance of the document data being reviewed. This makes it possible to maintain the motivation and improve the efficiency of reviews.
In addition, when the prediction information generation unit according to the present invention analyzes the characteristics of the user's relevance determination from the acquired result information, and generates the prediction information related to the result information based on the analysis result, a certain document When the system predicts the result of the user's relevance judgment for the data, and the prediction result is different from the actual user's judgment result, the user can be alerted.
In addition, when the prediction information generation unit according to the present invention further analyzes the progress of the relevance determination of another user and generates prediction information related to the progress speed of the relevance determination based on the analysis result. The system predicts the determination result of a specific user for a certain document data from the result of the relevance determination of other users, and when the prediction result and the actual user determination result are different, It is possible to alert a specific user.
In addition, when the prediction information generation unit according to the present invention further analyzes the progress of the user's past relevance determination and generates prediction information related to the progress speed of the relevance determination based on the analysis result. Makes it possible to predict the review progress speed from the past progress speed of a user, and to alert the user when the predicted progress speed differs from the actual user progress speed. .
In addition, the icon generation unit according to the present invention performs an appropriate evaluation according to the user's situation when changing the display format of at least one of icon operation, speech, and facial expression based on the comparison result. It can be presented.

DESCRIPTION OF SYMBOLS 100 Server apparatus 111 Judgment acquisition part 112 Recording part 113 Prediction information generation part 114 Information comparison part 115 Icon generation part 121 Extraction part 122 Display part 123 Result reception part 124 Selection part 125 Keyword recording part 126 Search part 127 Score calculation part 200 Client terminal 211 Screen display unit 290 Instruction unit I1 Review screen

Claims (10)

A memory for recording digital information;
A controller for analyzing the digital information;
A forensic system that Ru with a,
The controller is
Extracting a plurality of document data from the digital information;
For the plurality of document data, the user is caused to input related to the lawsuit ,
Based on the input, at least one of the first information for classifying the relevance into any one of a plurality of types and the second information regarding the speed of the input is determined by the user. Set in the document data related to the input as performance information,
Based on the set performance information, generate prediction information related to the input of the relevance for the document data reviewed by the user,
When the record information is set in the document data, the record information is compared with the prediction information,
If the performance information and the prediction information are different, generate and output data to alert the user ,
Forensic system. The controller is
If the performance information related to the second information and the prediction information related to the second information are the same, generate and output data informing the user that there is no problem in the input speed,
The forensic system according to claim 1 . The controller is
If the performance information related to the second information is earlier than the prediction information related to the second information, generate and output data that prompts the user to perform the review carefully.
The forensic system according to claim 1 or 2 . The controller is
If the performance information related to the second information is slower than the prediction information related to the second information, generate and output data that prompts the user to speed up the input.
The forensic system according to any one of claims 1 to 3 . The controller is
Wherein for a plurality of document data, highly relevant person from the previous SL litigation determines whether to create the document data respectively,
When it is determined that the user has created, when the user performs the input, the user generates and outputs data for calling attention to the user,
The forensic system according to any one of claims 1 to 4 . The controller is
Allowing multiple users to perform the input,
Generating prediction information related to the second information corresponding to the first user based on performance information related to the second information corresponding to the second user;
The forensic system according to any one of claims 1 to 5 . The data includes data indicating an icon or data indicating a message,
The controller is
Based on the comparison result, the display format of at least one of the operation of the icon, the mode of the icon, and the message is changed.
The forensic system according to claim 1 . The controller is
By calculating a score indicating the relevance of the previous SL litigation based on keywords included in the document data, evaluating the document data,
The forensic system according to any one of claims 1 to 7, wherein prediction information relating to the first information corresponding to the document data is generated using the score . The digital information recorded in the memory, the controller, a forensic how to analysis based on the forensic program,
The controller is
Extracting a plurality of document data from the digital information;
A step of causing a user to perform an input related to a lawsuit with respect to the plurality of document data;
Based on the input, at least one of the first information for classifying the relevance into any one of a plurality of types and the second information regarding the speed of the input is determined by the user. Setting document data related to the input as performance information;
Generating prediction information regarding the input of the relevance for the document data reviewed by the user based on the set achievement information;
When the record information is set in the document data, the record information is compared with the prediction information;
If the performance information and the prediction information are different, generating and outputting data for calling attention to the user;
Forensic method of Ru with a. A forensic program for causing a computer to analyze digital information recorded in a memory,
A function of extracting a plurality of document data from the digital information;
A function that allows a user to perform input related to a lawsuit for the plurality of document data;
Based on the input, at least one of the first information for classifying the relevance into any one of a plurality of types and the second information regarding the speed of the input is determined by the user. A function to set the document data related to the input as performance information;
A function for generating prediction information related to the input of the relevance for the document data reviewed by the user based on the set record information;
When performance information is set in the document data, a function of comparing the performance information and the prediction information;
When the results information and the prediction information are different, a function to generate and output data for calling attention to the user;
A forensic program for realizing a computer