DETAILED DESCRIPTION OF THE INVENTION

[0047] A method and apparatus for visualizing both the electronic paper trails referred to as “discussions” and the statistical anomalies and patterns that are directly computable from these discussions is disclosed. A discussion in this context is a heterogeneous set of causally related communications and events for which either electronic evidence exists, or can be created to reflect. Thus, a discussion provides a means of reviewing a series of related events that occurred over time. One example of generating such discussions from raw communications data is discussed in more detail in copending application Ser. No ______, entitled “A Method and Apparatus for Retrieving Interrelated Sets of Documents”, filed concurrently herewith (hereinafter referred to as ‘An Apparatus for Sociological Data Mining’). The visualizations and user interface tools described in this application greatly facilitate the efficient and effective review and understanding of such chains of events.

[0048] The views described in the following sections provide both graphic visualizations, as well as a means of navigating through the complex chains of communications and events that comprise the data being visualized. These views may be offered to the user in a Model View Controller (MVC) graphical user interface, or via a web-based application.

[0049] The present invention will typically be used in conjunction with a computer network. FIG. 1 depicts a typical networked environment in which the present invention operates. The network 105 allows access to email data stores on an email server 120 , log files stored on a voicemail server 125 , documents stored on a data server 130 , and data stored in databases 140 and 145 . Data is processed by an indexing system 135 and sociological engine 150 , and is presented to the user by a visualization mechanism 140 . The visualization mechanism 140 is described in more detail in the present application.

[0050] The present invention is for use with digital computers. FIG. 2 depicts a typical digital computer 200 on which the present system will run. A data bus 205 allows communication between a central processing unit 210 , random access volatile memory 215 , a data storage device 220 , and a network interface card 225 . Input from the user is permitted through an alphanumeric input device 235 and cursor control system 240 , and data is made visible to the user via a display 230 . Communication between the computer and other networked devices is made possible via a communications device 245 .

[0051] It will be appreciated by those of ordinary skill in the art that any configuration of the system may be used for various purposes according to the particular implementation. The control logic or software implementing the present invention can be stored in main memory 250 , mass storage device 225 , or other storage medium locally or remotely accessible to processor 210 .

[0052] It will be apparent to those of ordinary skill in the art that the system, method, and process described herein can be implemented as software stored in main memory 250 or read only memory 220 and executed by processor 210 . This control logic or software may also be resident on an article of manufacture comprising a computer readable medium having computer readable program code embodied therein and being readable by the mass storage device 225 and for causing the processor 210 to operate in accordance with the methods and teachings herein.

[0053] The present invention may also be embodied in a handheld or portable device containing a subset of the computer hardware components described above. For example, the handheld device may be configured to contain only the bus 215 , the processor 210 , and memory 250 and/or 225 . The present invention may also be embodied in a special purpose appliance including a subset of the computer hardware components described above. For example, the appliance may include a processor 210 , a data storage device 225 , a bus 215 , and memory 250 , and only rudimentary communications mechanisms, such as a small touch-screen that permits the user to communicate in a basic manner with the device. In general, the more special-purpose the device is, the fewer of the elements need be present for the device to function. In some devices, communications with the user may be through a touch-based screen, or similar mechanism.

[0054] It will be appreciated by those of ordinary skill in the art that any configuration of the system may be used for various purposes according to the particular implementation. The control logic or software implementing the present invention can be stored on any machine-readable medium locally or remotely accessible to processor 210 . A machine-readable medium includes any mechanism for storing or transmitting information in a form readable by a machine (e.g. a computer). For example, a machine readable medium includes read-only memory (ROM), random access memory (RAM), magnetic disk storage media, optical storage media, flash memory devices, electrical, optical, acoustical or other forms of propagated signals (e.g. carrier waves, infrared signals, digital signals, etc.).

[0055] Navigation among views is facilitated by the fact that all of the viewable entities have very close relationships to one another, as depicted in FIG. 3 . The user can submit queries 320 , which return discussions 305 . Each discussion must contain at least two actors 310 . Each of the actors 310 about whom the user can submit queries 320 must appear in zero (0) or more discussions 305 (an actor can appear in 0 discussions by being connected in some way with a singleton document which, by definition, is not part of a discussion). An actor 310 can be associated with multiple topics 315 , and vice versa. Each discussion 305 can be associated with multiple topics 315 , and vice versa.

[0056] Hence, for example, in a view depicting discussions, the user can generally click on an image representing an actor to see additional information about this actor, and vice versa.

[0057] More generally the usage of the user interface flows as shown in FIG. 4 . A user submits a query 320 using either Query by Example 405, Multi-evidence Query User Interface 410 ; Query Language 415 ; Canned Query Templates 420 , Visual Query Interface 425 , or Query Building Wizard 430 . The resulting query specifies at least one of a number of parameters, including but not limited to actors, time, topic, related events, communication type, specific documents and work-flow processes. Additionally, the system allows the user to submit queries in natural language format.

[0058] The results may comprise singleton documents 425 , discussions 305 , actors 310 , statistics 440 and topics 315 . Results are displayed in one or more of the formats appropriate to the results content and shown in FIG. 4 . Thus, singleton documents are displayed in tabular list view. Discussions are displayed as a participant graph, overview graph, transcript view, question and answer list, matrix view, cluster view, or tabular list view. Actors are displayed in an activity graph, participant graph, actor profile, matrix view, tabular list view or cluster view. Statistics are displayed as an activity graph as a profile view (for example, actor profile view or data set profile view), or as a Venn diagram. Topics are displayed as an activity graph, Venn diagram, overview graph, matrix view or tabular list view. These views are discussed in more detail below with respect to other Figures.

[0059] Views:

[0060] Participant Graphs: graphs that connect the actions of a certain set of participants as related to one or more discussions

[0061] Activity Graphs: comparative or individual graphs that indicate the historical communication or collaboration activity over time among various actors.

[0062] Overview Graphs: diagrams that contain data on one or more discussions, documents, topic discussion, or other aggregate behavior.

[0063] Document Trail Graphs: diagrams that display data tracing the lifecycle of a document or group of documents, including but not limited to such events as document revisions, check-ins and transmissions.

[0064] Money Trail Graphs: diagrams that chart the flow of money, based on information gleaned from a discussion.

[0065] Transcript View Variations: any primarily text-oriented view that lays out a sequence of events and/or communications

[0066] Object Lifecycle Views: views that are focused on the electronic data objects, rather than on the actors.

[0067] Animation: description of different ways that interactive or animated aids or trial art could be generated from any of the above.

[0068] Related Materials include:

[0069] Querying Tools: any view that can serve the purpose of generating a query, including some of the above

[0070] Case Management Application

[0071] Query Language

[0072] Mobile, Voice & Related Applications

[0073] Participant Graphs

[0074] Participant graphs shown in FIGS. 5 - 8 represent the set of communication items which belong to a particular discussion, or in some embodiments, multiple discussions.

[0075] FIG. 5 is a screen shot showing one embodiment of the participant graph for a fragment of a discussion, showing the actors involved and the various communications that took place between the actors during the discussion fragment. Each actor is denoted by a unique icon 545 , which in this example is a photograph or some other graphical representation of the actor. In other embodiments, a textual representation of the actor (far example, the actor's name) could be used. Communications are denoted by connections 540 between actors. In this example, three communication types are shown: documents, email and instant messages, each of which is denoted by a unique color code, pattern, icon, or other distinguishing mechanism. A legend 550 at the top-right of the screen shot indicates the meaning of each color, and of each of four icons that are used to label the connections. These icons, when clicked on, allow the user to view communication content, view the communication type, receive more information about the communication (for example, the exact time at which it was created), and obtain help. A timeline 505 allows the user to see the date and time at which each transaction in the discussion took place. By interacting with a content icon 510 , the user can see the content of any document and the time when the transaction took place. A type icon 515 allows the user to see information about the transaction type and/or document type. A ‘more info’ icon 520 allows the user to see basic information about the transaction. A clock icon 525 allows the user to see the precise time at which the transaction took place. The system may further display a popup 530 , which shows a chronological list of the transactions in which the current actor participated within the current discussion. For one embodiment, the popup 530 is displayed when the user clicks on an actor's icon 545 . In one embodiment, the personality (or personalities) of a given actor that participated in a discussion can be displayed.

[0076] FIG. 6 shows a screen shot of a participant graph similar to that shown in FIG. 5 . Additionally, it uses background color 610 and a series of time-of-day icons 615 at the top of the screenshot to denote the time of day at which the communication was created. In FIG. 6 , the user has positioned the mouse cursor close to the ‘more info’ icon 520 , thereby causing a popup window 605 to be displayed containing basic information about the transaction. In one implementation, a panning widget 630 allows the user to navigate forwards and backwards within the discussion using the time-of day bar 620 . In one implementation, a drop-down list box 625 allows the user to switch between different time zones, thereby adjusting the alignment of the discussion with the time-of-day icons 615 .

[0077] FIG. 8 shows a screen shot of a participant graph similar to those shown in FIGS. 5 and 6 . Additionally, it shows a toolbar 810 at the top of the screen that allows the user to select between different discussion views: activity, participant (shown here), and transcript. A second toolbar 815 provides buttons to allow the user to carry out the following actions: to zoom in on a particular part of the discussion, thereby showing the elements of said discussion in greater detail; to pan between different sections of the discussion; to filter the discussion on criteria that may include (but are not limited to): actor, communication type and time; to adjust the view of the discussion based on time span; to print the discussion or the contents of the graphical view; or to define new events to add to the view. In this screen shot, the user has hovered the mouse over the link 540 between two actors, thereby causing a popup 605 to be displayed. The popup 605 contains further details about the communication over whose link the user is hovering the mouse. A user interface navigation mechanism 830 at the bottom of the page allows the user to control which section of the discussion is displayed on screen. A pair of drop-down list boxes 825 allows the user to control the discussion display through the use of filters. An icon 820 and vertical dotted line 835 indicate the occurrence of a significant event (in this example, a board meeting) during the period displayed.

[0078] Participant graphs show the images 545 of the actors participating in a discussion, and the links 540 between the transactions in which they participated. Participant graphs may display a timeline 505 to show when user activity occurred, and may also display a background 610 in varying shades in order to represent daytime and nighttime activity. Participant graphs can optionally be limited to a partition of a discussion, or to only include certain specific actors of interest, either individually or by some property such as organization. It may also be limited to displaying only those actors who played an active rather than passive role in the items in question, where “active” is defined as initiating one or more of the items. In one embodiment of the invention, the user may set a threshold value for how active the actor had to have been in the discussion in order to be displayed, based on measures including, but not limited to, the number of items in the discussion initiated by that actor, the importance of these items; whether any were “pivotal” as described in ‘An Apparatus for Sociological Data Mining’. For one embodiment, if an actor has been filtered out, but was responsible for initiating a transaction, a small icon containing “ . . . ” is displayed in lieu of the regular actor icon. Clicking on this icon expands that instance to the form of the regular icon for that actor. Alternatively, the actor may be identified in other ways including, but not limited to, a smaller icon, or a browned out icon.

[0079] In this view, each items is depicted as a line connecting two or more actors. The color of the line indicates the type of item. Choices include, but are not limited to:

[0080] Email

[0081] Instant Message

[0082] Sending a document (as an attachment in email)

[0083] Phone call (one version with transcript, one without)

[0084] Voicemail (presuming that it had been processed by a speech to text indexer)

[0085] Wire or other funds transfer

[0086] Fax

[0087] Sending/Receipt of FedEx or other electronically trackable package

[0088] Actors 545 may be individuals, or they may be aggregate actors. Examples include an organization, the executive team, or de facto actor group such as a “circle of trust” as defined in ‘An Apparatus for Sociological Data Mining’. A group mail alias would also be considered an aggregate actor. In some cases, an actor might be a system or automated process, for example, a daemon that sends out a particular status message. Actors may be represented by actual photographs 3810 of themselves when available. Alternately, the user may choose a graphic representation for each actor by choosing from a canned library of images, or adding any electronic image that they wish. Once selected, the same image is used to represent this actor visually throughout the entire system.

[0089] If an actor has more than one distinct personality (as defined in ‘An Apparatus for Sociological Data Mining’ patent), in some embodiments of the invention, the user has the option to use a different image or graphic for each such personality. If the user opts not to do this, where multiple personalities exist the system Will use the one graphic provided to represent all personalities, but will tint the image with different colors in order to allow the various distinct personalities to be readily identified. The user may globally specify the color scheme to be used in such cases; for example, the primary personality will always be tinted blue.

[0090] The graph is represented as a timeline of events; the resolution can be increased or decreased using zoom in and out controls. In one embodiment, daytime and nighttime hours are indicated by a change in background color; as shown in FIG. 6 . In some embodiments, icon markers 615 indicating time of day may also be used; as shown in FIG. 6 . Icons may optionally be displayed that indicate the document type of the transaction in those cases where it is appropriate, for example, to indicate that the document being sent was an Excel spreadsheet rather than a Microsoft Word document. In the event that there are multiple documents attached, each appropriate document type icon is displayed. In another embodiment, a multiple document type icon is displayed, which depicts a stack of overlapping rectangles. In one embodiment, the system provides a different visualization for documents which were attached as opposed to incorporated by reference with a URL or something similar. Rolling the mouse over or near any of the transaction lines will bring up a pop-up 605 with basic information about the transaction ( FIG. 6 ). The exact types of information vary by transaction type, but include, as appropriate, the following:

[0091] Originating timestamp and timezone

[0092] Originating geographic location

[0093] Wire transfer amount

[0094] Length of phone call or voicemail message

[0095] Subject or title

[0096] Sensitivity level

[0097] Urgency or priority

[0098] Ending timestamp and timezone

[0099] Return of read receipt timestamp

[0100] Alternately, the user may click on the small icon to get only the timestamp details. In one embodiment, right-clicking on this icon provides an immediate chronology of events just before and after the item in question with timestamp information. This is to help clarify which event preceded which, in those cases where the events were almost contemporaneous. The “content” icon can be used to pull up the content of the document involved in the transaction. In one embodiment, there is also optionally a “More info” icon that can be configured to display other types of data that are appropriate. Examples of such data include, but are not limited to: prior user annotations about the transaction, its retrieval history, or the relation of that transaction to a known workflow pattern.

[0101] In one embodiment, actors are shown partially grayed out if their presence in the transaction was likely, but could not be verified solely on the basis of the electronic evidence. One example of this is the case of a meeting entry pulled from an online group calendar which asserts that Joe, Jack, and John will be present at the meeting. Without other supporting evidence, such as meeting minutes indicating that all parties were present, it cannot be definitively asserted that all three men attended the meeting.

[0102] Mousing over an actor icon will bring up a pop-up with the basic information available on that actor. This includes, but is not limited to, the following:

[0103] Full name

[0104] Title

[0105] Organization

[0106] Primary electronic identity

[0107] Electronic identity conducting the transactions whose lines connect to this icon (if different than the primary)

[0108] Clicking on an actor icon brings up a panel with a chronological list 530 (shown in FIG. 5 ) of the transactions this actor participated in within the discussion(s) being visualized.

[0109] In one embodiment, the user interface allows the user to add items that were not originally part of the discussion being visualized. This is done through filling out a form panel, shown in FIG. 7 , in the user interface, specifying all of the information that would have been associated with an actual item.

[0110] FIG. 7 is a screen shot of a form panel for adding items that were not originally part of the discussion being visualized. The panel displays the discussion title 705 , start date 710 and end date 715 , and actors 720 involved. A text box 725 allows the user to enter a label for the item to be added. In one embodiment, this text box 725 is replaced with a dropdown listbox, combo box, or other user interface tool for adding an item from a preconfigured or dynamically generated list. A series of option buttons 730 allow the user to specify the type of item to be added. After an item is added, it would be shown on the participant graph. For one embodiment, items added by a user are flagged in the participant graph, to indicate their nature. For another embodiment, the information that an item has been added can be obtained using the ‘info’ icon 520 .

[0111] In one embodiment, the view is implemented as a canvas, so the user may drag and drop shapes, lines, and text on it as they please. In one embodiment, such additions are checked for semantic correctness. For one embodiment, added events are indicated by color, patterns, icon, or some other indicator.

[0112] Events of interest are depicted as icons above or below the canvas from which vertical lines extend, cutting across the canvas at the appropriate point in the X axis. These events fall into one or more of the following categories:

[0113] An event belonging to the discussion, but which is not directly a transaction among its actors. For example, a milestone in a workflow process.

[0114] An event extracted from one of the online calendars of the primary actors in the discussion.

[0115] An event entered manually in the UI by the user

[0116] A canned library of icons to represent common concepts like “meeting” may be provided in the UI; the user may elect to add and use their own images as well. The user may also add descriptive text about the event. This text would appear when the user clicks on the icon representing that event.

[0117] In one embodiment of the invention, numerous animation utilities are provided in order to make the visualizations more vivid. Animation can help accentuate the involvement of certain actors of special interest; it can also highlight the accelerating or decelerating pace of the transactions. Types of animation provided in one embodiment of the invention are as follows:

[0118] Rendering the transaction lines and actor icons individually, in the order and timing in which they occurred, according to a condensed timeline appropriate for viewing in generally less than one minute. This emphasizes the lag time (or lack thereof) between contiguous transactions.

[0119] Similarly, but partially graying out, via compositing or other techniques, all transaction lines rather than not rendering them until their appropriate place in the timeline.

[0120] The layout algorithm for the view can be implemented with a number of commonly available graphing libraries. In one embodiment of the invention, a limit of 8 line connections per actor icon is imposed for readability purposes. For one embodiment, should additional connections be necessary in order to represent the underlying data, a second actor icon will be drawn to accommodate the additional lines. Note that while the graph generally follows a left to right timeline, a reply to an email message or IM will show a line going backwards to indicate that the transaction is a reply to a previous transaction, and that these two transactions should be considered part of a single nested transaction.

[0121] However, from an adherence to the timeline perspective, the placement of the two (or more) actor icons involved will be approximately at the start and end time of the nested transaction. If needed, additional actor icons will be rendered to ensure it. Since the purpose of the visualization is to provide an overview of the related transactions in a discussion, exact centering of the actor icons around the relevant line in the X axis is not considered essential. Exact event chronology information can be had from the ancillary panels that are only a single click away. In one embodiment of the invention, transaction lines are represented with directional arrows. In one of these embodiments, a “reply to” can be indicated with a line that has arrows on both ends; if there were N replies, the number N would be rendered near the appropriate arrow.

[0122] Finally, in one embodiment of the invention, the participant graph view can be used modally as a visual querying interface. The user may select a transaction by selecting its objects with a marquis tool, and generate a Query by Example (QBE) query. One example of QBE queries that may be used with this system is defined in ‘An Apparatus for Sociological Data Mining’. The user may also select individual actor icons in order to see all transactions involving all of these actors.

[0123] Other accompanying UI widgets and tools include, but are not limited to, the following. A panning widget 620 , shown in FIG. 6 . This widget 620 utilizes a thumbnail image of the full discussion transcript view, shrunk to whatever length necessary to fit in the visible view. The participant graph automatically scrolls to the position indicated by the panning widget 620 , making it especially useful for viewing discussions of long duration. Daytime and night-time hours are indicated in the thumbnail, allowing the user to easily detect, for example, anomalously high amounts of communications after standard or usual working hours. In one embodiment, nighttime starts at 5:00 PM in the primary time zone, or some other pre-configured time, and any communications or events after that time are distinguished, for example by being colored darkish gray. In another embodiment, a gradient fill is used to indicate rough time of day, as shown in FIG. 6 . In one embodiment, communication and events occurring during weekends or holidays are coded, for example by being colored pink. For one embodiment, the time zone defaults to the one in which the greatest amount of transactions occurred; times from other time zones will be normalized to this time zone. In one embodiment, there is a control 625 above the panning widget allowing the user to change the default time zone used by the panning widget 620 . In another embodiment, parallel instances of the thumbnail will be drawn for each time zone from which transactions originated. One panning widget extends across all of the thumbnails. In a different embodiment, the transcript view elements being thumbnailed are color-coded according to initiating actor rather than time of day. In yet another embodiment, these items are color coded by topic.

[0124] “Rainbow” View

[0125] To visualize really large volumes of discussions, or individual messages, a different approach to the visualization is necessary. FIG. 11 is a screen shot showing one embodiment of the activity graph for a discussion. The user has selected this view of the discussion using the tool bar 810 . This view shows the level of activity over time in two ways: as a line graph 1120 , and as a diagram 1125 in which levels of communication activity are denoted by colors of the rainbow. In this embodiment, a legend 1130 explains the meaning of the colors. An icon 820 and vertical dotted line 835 indicate the occurrence of a significant event (in this case, a board meeting). A toolbar 815 and navigation mechanism 830 as shown in FIG. 8 , are also shown. A slider 1115 allows the user to create a different viewable span on the canvas.

[0126] The rainbow view uses a color, pattern, or similar distinguishing mechanism which uses the color spectrum to help users to discern small shifts in the communication activity of a very large population of actors. Specifically, this view is used to pinpoint the amount of communication on specific topics. It is accompanied by a graph below which allows the assignation of numerical values to the colors used in the spectrum view. Maximum density is determined by historical values over the same time span and same or comparable population.

[0127] Activity Graphs

[0128] Activity graphs are used to illustrate the amount of communication among a small set of actors over a user-specified period of time. They may optionally be additionally constricted by topic. Actor sets may be specified in any of the following ways:

[0129] Manual specification of particular actors through the user interface.

[0130] Manual specification of one or more actors, with the checkbox enabled to include the “circle of trust.”

[0131] Manual specification of one or more aggregate actors which may then be expanded in the view.

[0132] FIG. 12 is a screen shot showing one embodiment of the activity graph for a discussion. Lines 1220 linking actor images 545 are terminated with boxes 1215 showing the number of communications that took place between the actors. In one embodiment, each actor is represented by both an image or other icon 545 and a text item 1205 containing the name of the actor. A legend 1225 shows the mapping between colors and levels of communication activity. For each pair of actors, where actor A has sent more communications to B than B has sent to A, the connecting line 1220 has two colors, and the portion of the line adjoining each actor represents the number of communications sent by that actor to the other actor of the pair. Where each of the two actors has sent a comparable number of communications to the other, the line 1220 connecting the two actors has a single color throughout its length. A number 1215 at each end of each connecting line shows the exact number of communications that the actor at that end of the line 1220 has sent to the actor at the other end of the line 1220 . The user can invoke a communication profile popup window 1210 . In one embodiment the popup window 1210 is invoked by double-clicking on the line 1220 connecting actor images 545 . The popup window 1210 provides additional data about the communications, including average communications length and depth, and document types exchanged. For one embodiment, any anomalies noted by the system are also flagged.

[0133] Referring to FIG. 12 , Each individual or aggregate actor is represented by an image provided or selected by the user. There is at most one line 1220 connecting any two actors in the activity graph. For one embodiment, a single line is used to indicate all communication between actors, in both directions. The direction of the arrows at the ends of the line indicate which way the communication is flowing. The number in the box 1215 embedded in the arrow indicates the number of communications to the other actor. For individual actors, these are the communications to that actor specifically, as opposed to communications sent to various distribution lists. If an aggregate actor is included in the display, all such aggregate communications are included, since such aggregate actors often correspond to distribution lists. Note that for purposes of readability, only communication between pairs of actors is shown. In order to show communication between tuples of actors, aggregate actors may be created.

[0134] The coloring of the lines is used to indicate one of the following, depending on how the user has configured the user interface:

[0135] Whether the amount of communication to this actor relative to other individual actors during the same period of time is unusually high or low.

[0136] Whether the amount of communication to this actor is high or low relative to what has historically been the case (presuming that comparison data exists.)

[0137] Whether the amount of communication to this actor as a fraction of total communication to other individual actors is high or low compared to what has been true historically.

[0138] Whether the amount of communication is high or low relative to a particular workflow process, or informally, among teams of similar size working on similar projects, either contemporaneously, historically, or both.

[0139] In one embodiment, the color or pattern of the line indicates the frequency of communication, while the thickness of the line indicates the volume of communication. In another embodiment, the thickness of the line indicates the frequency of communication, while the color or pattern of the line indicates the volume of communication.

[0140] The number of communications can be based on any or all of the following, depending on how the user has configured the user interface:

[0141] Email

[0142] Instant Messages (IM)

[0143] Phone calls

[0144] If for some reason, the user has specified an actor who is totally unconnected to the other actors in the display, the icon for that actor will have no lines attached to it.

[0145] The activity graph can be superimposed on an org chart in order to highlight communication flows that appear to differ from the org chart. In this event, actor titles are listed, and additional lines to indicate reporting relationships may be rendered. It can also be used as a visual querying tool; the user may select two or more actors in order to see all of the discussions, or individual communications between them. The user may also click on the line connecting any 2 actors in order to bring up a panel 1210 , shown in FIG. 12 , containing the communication profile of these actors. Which information to display is user-configurable, but would typically include the following:

[0146] Average depth of communication

[0147] Average interval between successive communications, optionally calculated bi-directionally

[0148] Breakdown of communications by time (for example if the graph spans the period of one year, the communications would be broken down by the month)

[0149] Document types exchanged

[0150] Average length of communication

[0151] Change from immediately previous observation period of same length

[0152] Anomalies

[0153] Ontologies which trap it

[0154] Overview Graphs

[0155] FIG. 13 is a screen shot showing one embodiment of one view of a discussion timeline. Sets of adjoining rectangles 1305 , linked by lines 1310 and color-coded by actor (as shown in legend 1315 ), are used to represent the communications within a discussion (so that each discussion appears as a set of adjoining rectangles 1305 ). The x-axis of the screen represents the timeline, and the sets of rectangles are arranged one above the other on the y-axis as in a Gantt chart. Above each discussion 1305 appears that discussion's title 1320 . The lines 1310 show related discussions, which are generally either precursors to, or offsprings of, the current discussion.

[0156] The purpose of the overview graph, shown in FIG. 13 , is to show a set of discussions which occurred approximately contemporaneously. These graphs are one of the possible types of output from a query. In one embodiment, each discussion appears as a rectangle 1305 of the length appropriate relative to its duration in the timeline. The title 1320 of the discussion appears directly above the rectangle; in some embodiments, this is followed by the number of items in the discussion. The rectangles are thumbnails of the content part of the transcript view of the discussion, scaled down to the necessary size and rotated 90 degrees to the left. Specifically, each item within the discussion is coded according to one of the following, depending on the user's preference:

[0157] Initiating actor

[0158] Topic

[0159] Document or communication or event type

[0160] The graphic resulting from this is then scaled to the appropriate dimensions and then placed on the chart. Note that an arbitrary number of discussions may be so rendered on this graph; the view simply becomes longer along the Y axis.

[0161] In addition, the user may configure the user interface to color code all communications originated or received by a particular actor of interest. In one embodiment, numerous parallel thumbnails may be created in a dedicated view in order to help the user observe the overlap between different actors of interest.

[0162] As there may be significant time lags between events in some discussions, in some embodiments, a bounding box is used to help indicate that all of the items in question are members of the same discussion. Connecting lines between discussions are used to depict forks in discussions. Similarly to the participant graph, events and other objects may be added to the graph. Zoom controls allow the resolution to be changed; the different visual representations of days, nights, and weekends/holidays may also be used here.

[0163] FIG. 14 is a screen shot showing one embodiment of another view of the discussion timeline. In this view, four discussions 1405 are displayed, and the level of activity within each discussion is represented by vertical lines 1415 of various thicknesses, where a thicker line denotes a greater level of communication activity. A panning widget 1410 over one portion of a discussion magnifies the vertical lines in the portion of the display under the widget 1410 . The user can move the panning widget 1410 by mouse manipulation. In one embodiment, when the user does so, a hand icon 1420 appears on the panning widget 1410 . An icon 820 and vertical dotted line 835 indicate when a significant event occurred.

[0164] In another embodiment, the discussion names appear to the left of the view, and one discussion occupies all of the real estate in that range of the Y axis.

[0165] For viewing smaller numbers of discussions, FIG. 15 depicts a timeline of the individual events in a discussion. FIG. 15 is a screen shot showing one embodiment of another view of the discussion timeline. In this view, detailed information about each individual communication event 1505 is arranged along a discussion timeline 505 . Communication events 1505 are depicted as blocks on the chart (in one embodiment, different types 1530 of events are depicted using distinctively colored or patterned backgrounds). Each block depicting an event 1505 contains header information 1520 related to the corresponding communication, including but not limited to: the sender or creator of the communication; the person who last modified the communication; the date of the communication; the subject of the communication; and any associated attachments or linked documents. In one embodiment, the user can click on an area 1510 of each block in order to display the content of the communication. Color-coded lines 1525 linking each event denote the primary type of evidence used by the system to incorporate that particular item into the discussion. A zooming tool 1535 at the top right of the screen allows the user to zoom in (to show less communications in more detail) or out (to show more communications in less detail). In one embodiment, the background area 1515 of the chart is color-coded or coded with a distinctive pattern to represent daytime and nighttime.

[0166] FIG. 15 provides an overview of the constituent parts of a discussion and the connections between them. Communication events are depicted as sets of interconnected blocks 1505 . The blocks 1505 may be color-coded as elsewhere described; actor icons may be optionally included in the block. The different colored lines 1525 reflect the primary type of evidence used by the system to incorporate that particular item into the discussion. Evidence types include but are not limited to, the following: similarity of participants, “reply to”, lexical similarity, pragmatic tag, same attachment, and workflow process. These terms are explained in ‘An Apparatus for Sociological Data Mining’.

[0167] Another variation of this view uses clustering to group whole discussions together, connecting different clusters by the appropriately colored lines, as shown in FIG. 16 . FIG. 16 is a screen shot showing one embodiment of a discussion cluster view. In this view, the total number of discussions meeting certain user-specified criteria is reflected in the size of the shape (in this embodiment, a circle) representing the cluster. In one embodiment, the shape that currently has the focus (is selected by the user) is displayed in a distinctive color 1635 , with a distinctive pattern, or is shown enlarged, thereby distinguishing it from circles 1610 that do not have the focus. Links 1615 between clusters are color-coded according to whether the clusters share: commonality of actors, commonality of topics, or commonality of another type. Commonality of actors occurs when two clusters, distinctive from each other by virtue of meeting different clustering criteria, nevertheless share the same set of actors. Where this is the case, a distinctive color is used to trace the link between the two clusters in question. Icons allow the user to see more information 515 , the date and time 520 of the communication, and to view 525 the underlying document discussion. A separate, smaller, window 1630 allows the user to navigate within discussion space by moving a panning tool 1620 . In one embodiment, when the user activates the panning tool 1620 , a hand icon 1625 is displayed.

[0168] In this view, shapes 1610 are used to represent groups of discussions. The shapes 1610 are labeled with the number of discussions contained in that group, and a description of the group. In one embodiment, a smaller window 1630 shows a map of the entire discussion space, or a relatively large part thereof, and contains a smaller frame 1620 to represent the area of discussion space under analysis. Since this view is independent of the information content, it is suitable for use even when the information has been strongly encrypted, and thus is not accessible for analysis.

[0169] Document Trail Graphs

[0170] Document trail graphs depict the life cycle of one particular document. FIG. 9 is a screen shot showing one embodiment of the document trail graph for a discussion. Each cluster of items on the graph consists of one actor icon 905 and at least one document icon 935 . The actor's actions with regard to the document (such as creation, modification, check-in, etc) are represented by displaying a document icon 935 in an appropriate color or pattern, according to a legend 930 . The x-axis of the graph represents the time line, with dates shown along a timeline display 505 at the bottom of the graph, and lifecycle increments 910 displayed along the top. In one embodiment, at each stage of the document trail, the length of the document in pages is indicated by a number 925 inside the document icon. Links 915 between versions of the document are color-coded according to function. In one embodiment, hovering the mouse over the ‘more info’ icon 520 invokes a popup 920 summarizing data related to the document in question.

[0171] A timeline 505 allows the user to see the date and time at which a particular event 935 in the document's life occurred. An actor icon 905 denotes the actor responsible for said event 935 . Events 935 are depicted as clusters of activity comprising document icons 925 and an actor icon 905 . Links 915 between the various versions of the document that comprise a single event are color-coded according to function. Document revision numbers 910 (for example, but not limited to, source control system revision numbers, or revision numbers assigned by the present invention) are displayed along the x-axis of the graph. Document icons 925 are color-coded according to the type of user activity that triggered the event. Examples of said user activity include, but are not limited to, document creation, modification, revision, deletion, check-in, check-out, distribution, viewing, third-party transfer and content transfer. In one embodiment, a legend 930 explaining the color-coding is superimposed on the graph.

[0172] Document trail graphs further show icons allow the user to see more information 515 , the date and time 520 of the communication, and to view 525 the underlying document. Hovering the mouse over (in one embodiment, clicking) the ‘more info’ button 515 displays a popup 920 containing a summary of information related to the event in question. In one embodiment, document icons 925 contain a count of the number of pages (or other size metric) contained within the document at the time of the event 935 in question.

[0173] Money Trail Graphs

[0174] The purpose of the money trail graph, shown in FIG. 10 , is to chart the movement of money using data available within a discussion. This visualization displays information related to money transfers that have been extracted from a discussion. The data is displayed along a timeline 505 . Each extracted data point in the money trail includes a financial institution 1010 or money manager, at least one actor 545 party to the transaction, and a sum of money 1005 , if that data is available. Links 540 connecting the elements of a financial transaction are color-coded according to transaction type following a color code specified in a legend 1025 . Hovering the mouse over the ‘more info’ icon 520 beside a link 540 invokes a popup 1015 summarizing data related to the financial transaction. An account icon 1020 allows the user to see which financial accounts are involved in the transaction.

[0175] Any transactions within a discussion that relate to money transfers, whether they are merely documents discussing the transfer, or documents that in themselves constitute the instruments of transfer, are used to build a money trail graph. The graph displays actors 545 (whether individuals, groups, or organizations) and the financial institutions 1010 who are involved with the transfer. Color-coded links 540 between actors denote the type of transaction, and are explained in one embodiment in a legend 1025 .

[0176] Transcript View Variations

[0177] The basic transcript view, shown in FIGS. 18 to 25 , is a linear presentation of the causally related communication events that make up a discussion. Communications 1830 are displayed in chronological order, and relevant metadata is displayed at the top of each communication. The metadata includes, but is not limited to: date and time created, saved or sent; subject; recipient list; and time (in one embodiment, time is denoted by a clock icon 1815 .) Actor names 1820 are color-coded. A header area 1805 provides information related to the discussion, including (but not limited to) discussion title, message count, list of participants, date range and total number of attached documents (in one embodiment, the total number including duplicates; in another embodiment, the total number of distinct attached documents). In one embodiment, an actor image 545 is associated with each communication, to denote the actor who created or changed the document. Clickable links 1810 contain the names of any attachments, and open the corresponding attachment when clicked. A display tool 1825 at the top-right of the screen allows the user to show or hide message headers, quoted text within each message, or message content. Communications may further provide document-type coding: for example, by pattern or color coding.

[0178] A sequence of documents 1830 (or other communication events, such as instant messages 2525 ) is displayed beneath a discussion header 1805 . In one embodiment of the invention, the discussion might be augmented by external events, either manually by the user through the user interface, or via an automated process defined for a specific case. In one embodiment of the invention, this view consists of a user-configurable summary portion at the top, followed by a list of the various items in the discussion. Each item has an author or creator, and optionally a set of other participants, such as those actors appearing in the cc: line of an email. As shown in FIG. 18 , for one embodiment, each actor 1820 is automatically color-coded by the system. Since the number of actors in any given corpus can be arbitrarily large, and there are a finite number of variations in color that the eye can readily distinguish, color coding of actors is done relative to the individual discussion. However, actors of particular interest can be assigned colors that are to be used globally. In other embodiments of the invention, colors are recycled by the system within non-intersecting sets of actors. Each item also has a title, a date, and an item type, such as: email, meeting, document modification, etc.

[0179] In one embodiment of the invention, shown in FIG. 19 , activity associated with each actor is represented in a horizontal bar 1905 containing colored areas 1910 , where the areas are color-coded by actor and spaced to represent time intervals.

[0180] In one embodiment of the invention, shown in FIG. 20 , discussion partitions 2005 are displayed. The partitions 2005 represent the threads that make up the discussion. In one embodiment, the partitions 2005 include the number of communications in each thread of the discussion. In this embodiment, discussions that have been partitioned (for example, because they are so large or complex) can be accessed by clicking on the title of the partition 2005 .

[0181] In one embodiment of the invention, items of different types are displayed with different background colors or patterns 2110 , as shown in FIG. 21 . In one embodiment, document type is shown via the use of an icon. In one embodiment, the time of day that a message was sent is shown by an icon 2105 .

[0182] In one embodiment of the invention, as shown in FIG. 22 , any attachments associated with communications in the present discussion are flagged via distinctive icons 2205 in the header or in the communication body. In one embodiment of the invention, documents linked by reference to communications in the present discussion are flagged via distinctive icons 2210 in the header or in the communication body. Examples of documents linked by reference include, but are not limited to: a document whose URL is referred to in a communication; and a data file whose file name and path is referred to in a communication. In one embodiment, clicking on the icon displays the attachment.

[0183] In one embodiment, shown in FIG. 23 , quoted text 2320 is distinguished. In one embodiment, the background 2315 is color coded. In another embodiment, the text 2320 itself is color-coded. In one embodiment, within each communication that contains quoted text, each distinct quote is assigned a timestamp 2310 . The communication header area contains explanatory text 2305 stating how many pieces of quoted text are associated with the current communication. In one embodiment, the explanatory text 2305 is replaced by an icon.

[0184] To make it easier for the user to immediately discern the time of day that an event occurred, in one embodiment, a clock icon 1815 as shown in FIG. 18 appears that is set to the time that the event occurred. In other embodiment, an icon indicating general time of day appears. For example, a document modification that occurred at night would have an icon with a partial moon against a dark backdrop with stars, while an email sent at dawn would have a rising sun. In one embodiment, in addition to color coding the actors, their picture 545 appears at the top of each item that they created, as shown in FIG. 18 . In cases where no actor image is available or desired, a user-selected graphic can be used in its place.

[0185] The summary portion 1805 contains the discussion timeline, participating actors, number of items, and controls which allow certain information to be viewed or hidden. In one embodiment of the invention, the discussion timeline is represented graphically ( FIG. 17 ) as a series of headers 1705 connected by color-code lines 1710 . In order to view message content, the user clicks on a command button, hyperlink or active area of the header. This includes, but is not limited to, transport and other header information in emails, quoted text from a prior email, routing information for a wire transfer, and check-in messages to document repositories. One embodiment of generating the summary or resolution is described in ‘An Apparatus for Sociological Data Mining’.

[0186] Optional UI tools include controls to “fast forward” to the next item created or otherwise involving particular actors. This, like the panning widget, which is also used with this view, is especially useful for long discussions which have many participants associated with them.

[0187] In one embodiment, shown in FIG. 24 , items that are or are suspected to be missing from a discussion are flagged visually. A deleted item 2415 can be flagged in any or all of several ways: the background 2420 has a distinctive color or pattern, or is otherwise displayed in a distinctive way; a red flag icon 2425 is displayed on the item; a text box 2405 displays additional information including but not limited to the computed level of certainty that an item was deleted, and the computed level of suspicion associated with the deletion; a “torn document” effect 2410 graphically conveys to the user that this discussion is incomplete. For one embodiment, only suspicious deletions are flagged.

[0188] An item may have been deleted, yet leave traces behind of its prior existence. A simple example of this is the case in which message B was a reply to message A, but message A itself no longer exists other than what is to be found in the header and content information of message B. There are two subcases of interest related to this:

[0189] The case in which a great deal of information about A—possibly all—can be reconstructed from other sources.

[0190] The case in which only the suspected existence of A can be posited by the system, but virtually no other information is available.

[0191] These two cases differ considerably in their treatment in the user interface, since in the former case, the main consideration of interest is to inform the user that he is seeing reconstructed and/or partial information. For example, in the above example of message A and message B, the header of information of A would be lost, so there would be no way of knowing who had been cc'ed on A. Thus, in a reconstructed version of A in a transcript view, the “cc:” line content would contain a colored block containing question marks, or another representation of the user's choosing. For one embodiment, the item itself has a grayed out background color, and in one embodiment, a broken zig-zag line across it.

[0192] The latter case by definition presumes that there is no content available to display. An example of this would be references in other documents to a document that there is no independent evidence of; for example, a link that no longer resolves. In that instance, the available information is displayed in the appropriate location in the template. In one embodiment, a certainty factor, as shown in box 2405 , of the system's belief that the document ever actually existed may also appear.

[0193] In some situations, the question of whether the deletion (or suspected deletion) of the data was either legal in the context of a given matter, or was in compliance with some defined standard of behavior is of interest. One embodiment of a system for making this determination is described in copending application Ser. No. ______, filed concurrently herewith, and entitled “A M ETHOD AND A PPARATUS TO P ROCESS D ATA FOR D ATA M INING P URPOSES .” Once the determination has been made that the deletion of an item is possibly suspect in a given instance, the system will flag the item. For one embodiment, a red flag icon 2425 is used. Missing information is noted in bold red text. The background color of the item will be set to whatever the user's preference is for displaying this kind of item, for example a background containing a tiling of question marks 2420 , as shown in FIG. 24 .

[0194] In the case of the various graph views, suspected deletions are handled similarly:

[0195] Items which were suspiciously deleted will have an icon.

[0196] Items which were partially or largely reconstructed from other forensically available sources are shown with a zig-zag line across them or have a zig-zag line icon above or to the side of them.

[0197] Items whose content could not be reconstructed at all would bear a red question mark icon.

[0198] FIG. 25 is a screen shot showing one embodiment of the transcript view of a discussion, focusing on instant messages 2525 within the discussion. Actors 2515 are color-coded, and time-stamps 2520 are shown at regular intervals. A slider 2505 at the left of the screen allows the user to navigate through the set of instant messages, as does a vertical scroll bar 2535 to the right. The slider 2505 at the left of the screen additionally shows a panning tool 2510 representing the position of the visible portion of instant message text within the larger body of text. Note that for instant messages (IMs) 2525 , a simpler item form is used, where IMs 2525 are displayed in chronological order and timestamped 2520 at regular intervals. A panning tool 2505 with a slider 2510 allows the user to navigate through the IMs 2525 . In one embodiment, the user can also navigate using a conventional scrollbar 2535 . The same form may also be used to represent emails in a condensed format in which data about additional participants is not deemed of interest. In such cases, the view is constructed by decomposing the emails into the separate text blocks attributable to each actor, and then linearizing them by time (accounting for differences in time zone.) In another embodiment, all contiguous communication from the same actor is presented in the same item, separated by line breaks, much like the traditional form of a play dialog.

[0199] Querying Tools

[0200] In order to help facilitate the iterative querying that is so essential when the user is confronted with an arbitrarily large and unfamiliar corpus of documents, an extensive querying language is provided. For one embodiment, this language reflects the actor orientation of the document analysis engine that is described in ‘An Apparatus for Sociological Data Mining’ patent. Since it is well known that the vast majority of searches contain one or two keywords, and no operators, it is important for the query language for “discussions” to break away from this standard, but ineffective paradigm. This is accomplished by using a sequential structuring of the query information. It is assumed that the majority, but not all, of queries performed with the query language will be one of the following forms, or subsets of the forms described below.

[0201] In FIG. 32 , the query is of the format: who 3205 (actor/actor group) knew/probably knew/saw/believed/asserted 3210 (verb relationship) what 3215 (topical or specific document instance or version) when 3220 (time, timeframe, or timeframe relative to a particular event). Optionally, the query may specify how 3225 (for example, via pager, mobile device, desktop machine) or where 3230 (if it is possible on the basis of the electronic evidence to place the person geographically at the time of the communication) for the communications as well.

[0202] In FIG. 33 , the who 3205 is narrowed by adding additional features. Thus, the query may include, with what frequency 3305 (for example, once, repeatedly) an actor, did what 3310 (for example, edit or check-in a document, delete a document, commit a pattern of actions or single action 3305 , such as excluding particular other persons from meetings or discussions, etc), what object 3315 (actor 3205 and/or content 3215 ) did they do this to, and when 3220 .

[0203] In FIG. 34 , the user can specify how 3310 did patterns of behavior (relationship between an object 3215 and an actor 3205 or content 3215 ) change over a specified period of time 3220 , or with respect to some other specific context 3405 . For example, the user can query how the patterns of communication between two litigants changed after a particular material event. The user may further query if there any relationship of statistical significance between the occurrences of events of particular tuples of event types, and if so, what kind.

[0204] For one embodiment, the language generally requires that an actor be specified prior to any other terms. In the event that the actor is immaterial to the query, an actor of “anyone” may be specified, or may be automatically inserted by the system. Individual actors can be specified by first name and last name; if only one or the other is provided, the system will look in the recent command history for that user in an attempt to disambiguate it. If nothing suitable is found, the system will try to match the string to both actor first and last names present in the corpus. It will then present a list of appropriate choices, or if there is only choice echo it back to the user for confirmation. An actor's circle of trust can be specified by adding a plus sign “+” after the actor's name. In the case of an aggregate actor, the union of the actors in the different circles of trust is taken. Similarly, an actor group, such as the set of all employees of ACME Corp. could be specified. Similarly, in one embodiment, certain personalities of a given actor (or actors) can be specified.

[0205] Next, the language uses an operator. For one embodiment, if the operator is omitted, it will be interpreted to mean “knew” or “asserted”. There are two main classes of operators, those involving content creation or observation, and those that do not. Operators may be active or passive in nature relative to the actor. For example, modifying a document is active, while getting promoted to a higher position is passive. Content modification operators include, but are not limited to, the following:

[0206] Asserted: There is text attributable to a particular actor that contains the assertion in question.

[0207] Had reason to believe: This has to do with what knowledge the actor had, on the basis of the electronic record, in the face of omissions. For example, if there were 5 versions of a document prior to it being finalized, but a particular actor was only privy to the initial 4, he might not be aware of the existence of the 5 ^th version. So, he might reasonably believe that the 4 ^th revision was the final one.

[0208] Knew: The actor actively engaged in discussion about the topic(s) in question.

[0209] Probably Knew: The actor's membership in a particular circle of trust suggests that even absent specific electronic evidence, that the actor probably was aware of a particular thing.

[0210] Saw: The actor in question saw an instance of the content in question. That the actor saw it is established by either their responding to, or commenting on the material. Other evidence of “saw” includes, but is not limited to, any logged access of a document containing this content.

[0211] May Have Seen: There is relevant content that the actor may have seen, but there is no direct evidence that he saw it. For example, the fact that person A sends person B an email cannot reasonably by itself be construed as person B reading this email, at all or in its entirety.

[0212] All of the above also have negations, which may be specified by the use of either “not” or a minus sign. Non-content operators include employee lifecycle events such as Hire, Departure, Transfer, Promotion, and Role Change. Other non-content events include, but are not limited to: Vacation or leave of absence or sick day, Travel event, Wire transfer send or receive, or Phone call, presuming no transcript of the phone call exists.

[0213] “When” may be specified as any of the following:

[0214] Absolute time, using any of the standard date/time formats.

[0215] Time of day (day, night/evening, morning, afternoon, after hours)

[0216] Day of week (or weekday, weekend)

[0217] Holiday or work day or vacation day or one or more specific actors “out of town” as gauged from online calendars and HR system information.

[0218] Note that all time information is implicitly actor-relative. Differences in time zones, national holidays, and even what is considered “after hours” are addressed. Therefore a “when” phrase is interpreted according to what is true for the greatest number of actors specified in the query. If a different behavior than this is desired by the user, she may explicitly bind the “when” term to either an actor or a specific location. For example:

[0219] 1:00 PM in London

[0220] Holiday in France

[0221] Evening for Linda Holmes

[0222] If “when” is not specified, it is presumed to mean:

[0223] The lifespan of the actor specified in the query, if only one actor is specified.

[0224] The interval of time beginning with the earliest lifespan in the actor group specified in the query, and ending with the latest lifespan (or current date/time,) if an actor group were specified.

[0225] The intersection of actor or personality lifespans as specified in the query, if communication among different actors is required by the query

[0226] The “how” may optionally be specified as either a specific device type, such as a Blackberry, or as a category of device, for example a mobile device. The “how” could also be a fax or a voicemail, or a paper letter. In one embodiment, the “how” is identified by its immediately following an unquoted “by” or “via.”

[0227] The “where” may be optionally specified by entering the geographic location of the actor at the time of their participation in the particular transaction. This can be done hierarchically, if a tree of locations is provided. If there is more than one actor specified in the query, the where is modified by actor. In one embodiment, this is specified as <actor name> in <location> or <actor name> at <location>.

[0228] Because of the highly iterative nature of large corpus querying, any of these operators can be iterated on by either reducing or expanding their scope. As described in ‘An Apparatus for Sociological Data Mining’, for one embodiment, the core engine calculates the primary limiting factors in a query. The information is used to indicate to the user which terms are responsible for very substantially reducing or expanding the result set. To facilitate the appropriate use of such iteration, the system can optionally inform the user on which terms could be generalized or specialized one level further for best effect on the results set. In one embodiment, these alternate queries are run automatically on separate threads at the same time as the base query, in order to facilitate an immediate response to a user question, such as a request for “more” or “less.”

[0229] Content or “What” Operators

[0230] Each of the operators below can be used in the context of retrieving discussions or individual communications, or both. These may be used to override the system defaults described previously. For one embodiment, the actual retrieval behavior of these operators is determined by the current relevance scoring mechanism in place. One example of such relevance scoring is described in ‘An Apparatus for Sociological Data Mining’.

[0231] Keyword (an operator 3510 ): Result set contains all discussions or communications with at least one occurrence of a specified term, depending on the context in which it is used. This operator can specify sets of terms through techniques including but not limited to use of wildcard characters and matching using the Levenshtein edit distance.

[0232] Phrase (an operator 3510 ): Result set contains all discussions or communications with at least one occurrence of the sequence of terms. This operator can specify sets of related phrases using techniques including but not limited to the use of wildcard characters in individual terms, matching by Levenshtein edit distance between terms and matching by Levenshtein edit distance between sequences of terms.

[0233] Classifier (an operator 3510 ): Result set specified by the set of sub-queries obtained from expanding a given class from an ontology loaded into the document analysis engine.

[0234] NamedEntity (an operator 3510 ): Result set specified by the query obtained from expanding a given named entity from all ontologies loaded into the document analysis engine.

[0235] InDiscussionOnly (a document type 3505 ): Return only results from discussions

[0236] InSingleDocOnly (a document type 3505 ): Return only singleton documents that are not members of any discussion.

[0237] Evidence Operators

[0238] The second group of operators search over metadata collected from each individual communication as well as relationships between documents created during the evidence accrual process while building discussions. These operators return discussions when applied.

[0239] CommunicationType: Returns all discussions containing certain types of communication items, for example email.

[0240] EventType: Returns all discussions that contain an event of a particular kind, such as a board meeting.

[0241] Event: Returns all discussions that contain a particular instance of an event, for example, the board meeting that occurred on Mar. 15, 2001.

[0242] WithItemRelatedToQuery: Will return all discussions containing communications that are a match for a query, regardless of other parameters.

[0243] WithSimilarEvidenceLinks: Will return all discussions with a certain frequency or statistical distribution of evidence links of specific kinds.

[0244] HaveRevisions: Returns those discussions that have more than one version (i.e., have at least one revision due to the subsequent addition of further evidence.)

[0245] PragmaticTag: Returns any discussions containing one or more items with the given pragmatic tag.

[0246] Multi-Discussion Operators

[0247] The third group of operators search over metadata collected from each discussion as well as relationships between discussions. These operators return discussions when applied.

[0248] WithSimilarProperties: return discussions containing a distribution of properties of contained documents. For instance “discussions where most communications sent after hours”.

[0249] WithSimilarActors: discussions containing specified set of actors, actors can be marked as primary, regular, observer or passive participant. For example:

[0250] primary:<joe rudd>.

[0251] WithSameWorkflow: return all discussions that are an instance of the given template. Templates include formal and informal workflows, etc.

[0252] RelatedDiscussions: return discussions related to the given discussions, for example, offspring.

[0253] The fourth group of operators search over inferred sociological relationships between communications in a discussion. In gen