On Thursday, October 28, 2004, 4:08:30 PM, Sanford wrote: >> Show me a search of a full text index that can positively give you >> 100% of the hits on a given topic and I'll let you have this one :)
SW> The regulators will typically give you a list of search terms to be SW> used in a full-text search. Their specifications are what guide the SW> accuracy of the search. Of course, deliberate and deep obfuscation of SW> all nouns and verbs will elude the search. But you _must_ search all SW> communications, including message bodies and attachments. This is the SW> law. You can debate the constitutionality of the law or what-have-you, SW> but the realities of an investigation are that all communications must SW> be searched, and in any volume and with the deadlines one is always SW> under, that mandates full-text indexing. <snip/> SW> Yes, it is time-consuming. On that we agree. And shirking statutory SW> obligations that in fact shorten the time to settlement/dismissal, and SW> in turn bringing additional scrutiny, is not a wise tactic. All of this makes me wonder if our pattern matching engine and a simple archive of messages might be a useful product in this case. Picture if you will an MTA with Message Sniffer installed where an archive is generated automatically using a compressed format. Perhaps one file per day. If such a request were to come in then a rulebase would be generated to match the search phrases and then the sniffer engine would scan through the messages in the archives and deliver those that matched to a specified email address along with a list of the patterns that were found... that is, the matching message as an attachment to a report message that describes the original envelope and the list of matching patterns. Might this be a useful product do you think? The thing is - this is probably a fairly simple augmentation to the hold/release mechanism I'm working on for Message Sniffer - so I'm curious to know if the enhanced capability is "worth the trip". My gut tells me it is. _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
