102 may maintain any number of administrative levels for users of the tool with varying types of access to user data.

In operation 314, the data management tool 102 may utilize the user token to make one or more API calls to the various data sources. For example, operating system gateway 110 and/or user hardware gateway 112 may receive the validation token from the data management tool 102 as a portion of a request to retrieve data from the corresponding databases or systems. Based on the validation token, the gateways 110, 112 (or any other gateway or access point for the data management tool 102) may determine if the user has approved access to the requested data. In general, a verified user of the data management tool 102 may have access to their own data. However, a higher level of administrative access may be required for access of data of other users of the system. In one particular example, an LHO custodian may be granted access to data associated with users or members of the organization other than the custodian. The data management tool 102 may include any number of administrative levels, with each level providing any level of access to user or member information or data, such as access to particular types of data, particular types of databases, particular types of computing devices, particular security levels of data, and the like. The data sources may allow or deny access to some user data based on the administrative level associated with the validation token included in the data request. In this manner, the validation token associated with the user identification information may be utilized to provide access or deny access to specific information in one or more databases or through one or more gateways or interfaces.

In some instances, the data management tool 102 may be used to gather data and/or information in response to an LHO provided to an organization. FIG. 4 is a flowchart of a method 400 for utilizing a data management tool 102 for identifying and obtaining data associated with a member of an organization. The operations of the method 400 may be performed by one or more computing devices, either under control of an operator or independent from an operator, and may include components of the system 100 of FIG. 1, including the data management tool 102. As such, the operations may be executed through one or more software programs, one or more computing hardware components, or a combination of both hardware and software components.

Beginning in operation 402, an LHO or other similar data hold order may be received and acknowledged. The LHO may identify particular users of the data management system 100 or members of an organization for which potentially relevant data may be needed at a future date. The data identified in the LHO may therefore be collected and/or maintained for presentation to a recipient identified in the LHO. In one example, the LHO may be associated with a potential litigation such that the requested data may be provided as potential evidence in the litigation. Regardless of the purpose behind the LHO, the identified information or data may be collected using the data management tool 102. In response to receiving the LHO, a communication for a custodian of at least a portion of the requested data may be generated from a template of custodian communications. For example, the LHO may identify a particular user or member of the organization for which the LHO applies. The data management tool 102 may further refer to the identified party as a custodian of that user's data, although other members may also be referred to as a custodian of the user data, including Information Technology (IT) staff, legal staff or attorneys, supervisors, or any other member of the organization given privilege over user data. The custodian communication generated in operation 404 may be any form of electronic communication, such as an email, a direct message, a text message, a post to a website, and the like. The template for the custodian communication may include portions that are populated with user-specific information. For example, the communication may include a portion in which the identified user's name may be inserted. In general, the template may include a space or portion for any custodian or user-specific information for inclusion in the communication.

In some instances, one or more potential databases or sources may be noted in the custodian communication in which data for the identified user in the LHO may be found. For example, the LHO may request that a particular user maintain or store all emails from or to the user over a specific time period, related to a specific event or project, to or from a particular third party or other member of the organization, and the like. The LHO may also request a similar hold on direct messages or other types of messages in other databases. As such, the data management tool 102 may be utilized to, in operation 406, identify possible data sources for a particular user and the types of data stored by those sources for the user. For example, a custodian identified in the LHO may access the data management tool 102 and provide a particular user identifier, such as an employee identifier, a first and last name, a member number, etc. to the tool. The data management tool 102 may, upon authentication of the custodian and processing of an administrative level of the custodian, access one or more gateways or databases to determine which data sources may store data for the identified user. Using the system 100 of FIG. 1 as an example, the data management tool 102 may access a cloud-based data storage system 108, an operating system gateway 110, and/or a hardware gateway 112 to determine the databases in which the identified user has stored data or information. Additional or fewer databases and/or gateways may be accessed by the data management tool 102 to determine the available data sources. The data management tool 102 may provide the verification token for the custodian to one or more of the databases or gateways to obtain access to the stored user-specific data in response to the received LHO.

The data management tool 102 may generate a visual graphic in the user interface 104 and displayed on a display device to illustrate the identified databases of user data. For example, FIG. 5 is an example screenshot of a user interface 500 of a data management tool 102 displaying various sources of user-associated data. The screenshot may be generated by the data management tool 102 and generated on a display device of a computing system. In general, the user interface 500 may display information associated with an LHO and data associated with a particular party identified in the LHO. For example, a custodian may provide a user identifier to the data management tool 102 to begin to collect data associated with that user and based on the request included in the LHO. The user interface 500 may include a display wheel 504 in which various information about the identified user and the potential databases in which the user may have stored data is displayed. In this example, the center 506 of the display wheel may display identification information of the user based on the information provided to the data management tool 102 by the custodian. Such information may include a first and last name of the identified user, one or more identifiers of the user (such as a user ID), and a location of the user. This information may be obtained from the user directory 106 or the organizational database 116 discussed above. In addition to the user identification information, the display wheel 504 may also include portions identifying databases storing potentially relevant data for the identified user and/or functionalities of the data management tool 102. For example, the display wheel 504 may include a portion showing an email database, a collaboration database, a hardware database, etc. and an option to export the data obtained by the tool for the identified user. In general, the display wheel 504 may display any information or databases identified by the data management tool 104. One or more of the portions may be selectable via an input device to the display device to access additional information about the database, including the data stored in the identified database associated with the identified user. A site map 502 portion may also be included in the display 500 with selectable links to one or more of the identified databases. In some instances, the particular databases displayed in the user interface 500 may be based on one or more queries transmitted by the data management tool 102 to gateways or data storage systems in communication with the tool.

Returning to FIG. 4 and in operation 408, the data management tool 102 may be utilized to obtain data associated with the identified user from the available databases. For example, the custodian may utilize the data management tool 102 to communicate with the cloud-based storage system 108, the operating system gateway 110, and/or the user hardware gateway 112 to obtain data associated with the identified user. Requests for the user-specific data may be submitted by the data management tool 102 in response to a selection of a particular database from the user interface 500 or may be obtained regardless of a selection of a database. In operation 410, relevant data associated with a cause of the LHO may be gathered. For example, a discovery team of the organization may collect aspects of the data associated with the identified user to respond to a discovery request associated with a litigation. In this manner, the relevant data may be properly managed and provided in response to the LHO in a fast and efficient manner.

The data management tool 102 may include several additional features to make the collection of data of an identified user. For example, the tool 102 may be configured to determine an assigned data location for users or members of the organization. Different jurisdictions may have different laws or procedures for storing and providing user data in response to an LHO or for any other reason. Thus, the data management tool 102 may associate the user or the retrieved data with a particular jurisdiction to comply with local data privacy laws. In general, any jurisdiction rule may be applied to data or users as the data management tool 102 collects user data. Also, the data management tool 102 may allow all users or members of the organization to easily identify data that is not in compliance with the records management policy for the organization. The tool 102 may be used to audit data sources for a user, in some cases with an official attestation conducted yearly or over another time frame. Users may also use the tool 102 to identify particular databases or sources that are relevant to an LHO or other order, reducing the amount of time used for a custodian interview. The identified databases or sources may be tagged by the data management tool 102 based on one or more inputs provided by a user of the tool as relevant to a hold order of some kind.

As mentioned above, the data management tool 102 may also access one or more third party databases, such as social media sites associated with a user or member of the organization. Access to user data may be provided to the data management tool 102 upon a request and included in the collected data for the identified user. In addition, although screen shot 500 is illustrated and discussed herein, it should be appreciated that additional data charts, screen shots, images, graphics, and the like may be generated and displayed in the user interface of the data management tool 102. In some instances, such additional displays may include weights for data size and volume.

Referring now to FIG. 6, a detailed description of an example computing system 600 having one or more computing units that may implement various systems and methods discussed herein is provided. The computing system 600 may be applicable to the data management tool 102 of FIG. 1 and other computing or network devices. It will be appreciated that specific implementations of these devices may be of differing possible specific computing architectures not all of which are specifically discussed herein but will be understood by those of ordinary skill in the art.

The computer system 600 may be a computing system is capable of executing a computer program product to execute a computer process. Data and program files may be input to the computer system 600, which reads the files and executes the programs therein. Some of the elements of the computer system 600 are shown in FIG. 6, including one or more hardware processors 602, one or more data storage devices 604, one or more memory devices 608, and/or one or more ports 608-610. Additionally, other elements that will be recognized by those skilled in the art may be included in the computing system 600 but are not explicitly depicted in FIG. 6 or discussed further herein. Various elements of the computer system 600 may communicate with one another by way of one or more communication buses, point-to-point communication paths, or other communication means not explicitly depicted in FIG. 6.

The processor 602 may include, for example, a central processing unit (CPU), a microprocessor, a microcontroller, a digital signal processor (DSP), and/or one or more internal levels of cache. There may be one or more processors 602, such that the processor 602 comprises a single central-processing unit, or a plurality of processing units capable of executing instructions and performing operations in parallel with each other, commonly referred to as a parallel processing environment.

The computer system 600 may be a conventional computer, a distributed computer, or any other type of computer, such as one or more external computers made available via a cloud computing architecture. The presently described technology is optionally implemented in software stored on the data stored device(s) 604, stored on the memory device(s) 606, and/or communicated via one or more of the ports 608-610, thereby transforming the computer system 600 in FIG. 6 to a special purpose machine for implementing the operations described herein. Examples of the computer system 600 include personal computers, terminals, workstations, mobile phones, tablets, laptops, personal computers, multimedia consoles, gaming consoles, set top boxes, and the like.

The one or more data storage devices 604 may include any non-volatile data storage device capable of storing data generated or employed within the computing system 600, such as computer executable instructions for performing a computer process, which may include instructions of both application programs and an operating system (OS) that manages the various components of the computing system