Arman Gungor's Blog Litigation Support and Technology


APC Smart UPS Loud Beeping Problem

I have been using an APC SUA1000 at home for about 5 years. I have used other APC devices in the past and have always been happy with their build quality and performance. However, this unit has been giving me trouble lately. It all started about 2 years ago when I came back home from a long trip to find the UPS emitting a constant, loud, excruciating sound. The beeping did not stop when the UPS was turned off or its power cord was disconnected from the outlet. The only way to stop the noise was to either disconnect the battery or braindead the UPS.

After a few e-mail exchanges and phone calls with APC customer service, I was informed that my warranty had recently expired and my only option was to send the UPS for a repair at my own cost. I decided to open the unit's case and take a look inside to see if there was anything obviously wrong with it before shipping it for repair. I disconnected the batteries, looked inside the UPS and did not notice anything obvious. Closed the box, powered up again and to my surprise, the noise was gone. It passed self test and I tested it a few times under load by disconnecting it from the outlet and it continued to provide power without failure. I was able to use the device for another 2 years or so without any trouble.

Life was good again until the unit ran out of battery recently. I ordered a replacement APC battery and installed it. As soon as I turned the unit on, I was welcomed by the good old constant buzz. Went through the same process of opening the box and disconnecting the battery a few times without any luck. I also sent some messages to APC message boards and found out that there were at least a few more people with the same problem. Their UPSs (not only SUA1000 but other models such as SUA1500, SUA2200 etc.) appear to work perfectly fine except for the annoying noise.

Finally, not having been offered a viable explanation or solution by APC, I was forced to operate on my UPS. I opened the case again, located the piezoelectric buzzer (see picture) and de-soldered it. I am sure the UPS is still trying to emit the same sound but at least I am not hearing it. It has passed self test as well as my manual tests and has been powering my computer successfully for the past couple of days.

Filed under: Hardware 5 Comments

Western Digital Fiasco

I bought a Western Digital My Book Essential 2 TB USB 2.0 Desktop External Hard Drive yesterday. When I plugged it into my computer, I was greeted by a driver installation prompt. I have seen hard drives and flash drives with launchers before and swiftly ignored the prompt and let the driver installation fail. I noticed that a separate, read-only volume with WD junk popped up as expected. I proceeded straight to disk management to remove the hidden partition and re-format the drive as a vanilla hard drive. To my dismay, WD appears to have integrated this hidden partition into the drive's firmware! Apparently, it is not possible to simply re-format and get rid of this hidden partition short of taking the actual hard drive out of the enclosure (voiding the warranty) and plugging it directly to the computer as an internal HDD via SATA. WD provides a piece of software that hides the read-only partition from view but does not delete the junk software or prevent the automatic driver installation prompt.

I have several problems with the software that comes with the drive:

* The driver installation is problematic and works only on Windows. Consequently, the drive causes problems when used in MacOs, Linux or any other non-Windows system such as XBox, PS3 etc.
* The software bundled with the hard drive takes up a significant amount of disk space, reducing the usable disk space on the drive.
* Most importantly, when I buy a hard drive, I expect it to function as a hard drive. I do not require additional junkware, especially the non-removable kind, to help me "manage" my data.
* Need I say that the software is worthless?

I think this is a disgrace and a big blow to any power user. The drive is going back to where I bought it from tomorrow and Western Digital lost some points in my book. I heard that the same problem applies to their passport model mini hard drives (of which I used to buy older versions regularly) as well and there is a fairly large community of people bashing them as we speak. I may continue to use their internal hard drives but I will look for a better alternative for external hard drives.

Tagged as: No Comments

How to Shrink SQL Database Logs

SQL database logs have the tendency to get very large if you are using SQL in full recovery mode. If you have come to a point where you are certain that you will not need point in time recovery and if you would like to reclaim the space log files are taking, you can issue the following command in SQL 2005 or before. This will truncate the transaction log and shrink the log file. For the purposes of this example, let's assume that our log file is named "Sample_log.ldf" and our database is called Sample.

DBCC SHRINKFILE(Sample_log, 1)
DBCC SHRINKFILE(Sample_log, 1)

If you are using SQL 2008, you will notice that the TRUNCATE_ONLY backup option has been discontinued. The only way I was able to find to truncate the log in SQL 2008 was to temporarily switch the database recovery model to simple, shrink the log and switch back to full recovery mode. You can accomplish this as follows:

DBCC SHRINKFILE(Sample_log, 1)

From a best practices standpoint, truncating log files is not recommended.  If you need full recovery, you should ideally invest into sufficient disk space to accommodate the log files.


Opening Older Ms Word Documents in Word 2007

We occasionally run into Word documents created with older versions of Ms Word (i.e. Word 2.0). When we attempt to open such files in Word 2007, we get an error message along the lines of: "You are attempting to open a file that was created in an earlier version of Microsoft Office. This file type is blocked from opening in this version by your registry policy setting." Here is a quick fix:

Create a new key called "FileOpenBlock" under:

Create a DWORD value under this key called "FilesBeforeVersion" and set its value to 0.

This should allow Word 2007 to open files created on older versions.


Remote Desktop Connection Problem

We have been having an RDP connection issue with one of our Precision workstations at work. When an employee tries to connect to the computer, the remote desktop login screen is displayed as expected, the employee enters his/her credentials and presses the connect button but the connection is never established. Moreover, no error message is displayed. The mstsc window simply disappears. We have looked into all sorts of potential issues from firewall problems to the version of mstsc. We also checked the event log on both the client and the server and saw no errors related to this problem until yesterday.

While looking at the server's event log yesterday, we noticed some "information" messages. Their event source was "Application Popup" and the message read "\SystemRoot\System32\RDPDD.dll failed to load". "RDPDD.dll" mentioned here is the RDP Display Driver. Based on this information, we decided to update the display driver of the server computer (the graphics adapter is NVIDIA Quadro NV290) and voila! Strangely, this issue seems to affect only this specific computer. We have other Precisions with the same NV290 drivers and they have been working fine.

Filed under: Hardware No Comments

Text Split Merge 1.0 Beta

Text Split Merge 1.0 Beta

Text Split Merge 1.0 Beta

I have lately been working on a small utility for manipulating text files.  I have come to a point where most of the functionality I have been planning on implementing is there, but not yet fully tested. Feel free to give it a whirl if you would like. Here is briefly what it can do:

  • Inserts Law, Ringtail or custom page markers into single page text files.
  • Combines single-page text files into document-level text files by using a text based list of document breaks (page markers can also be inserted at the same time)
  • Identifies page breaks in document-level text files (by the page break character, a custom anchor, Law or Ringtail style page markers), inserts page markers at page breaks and splits the text file into page-level text files.
  • Accepts a text reference file (similar to an Opticon load file) and merges page-level text files by the document breaks provided in the load file  (The text reference file can be automatically validated prior to processing).
  • Supports Unicode.
  • Outputs an OCR list file.
  • Mirrors input folder structure or splits text files into subfolders.

A few words of caution:

  • While splitting a document-level text file into page-level text files, Text Split Merge assumes that there are no gaps in the bates numbering scheme as it assigns bates numbers to each individual page. It also assumes that there is no bates overlap between two document-level text files.
  • Having named your text files as their starting bates numbers is a requirement.
  • When merging page-level text files via a document break list, Text Split Merge first sorts the document breaks as well as the input files alphabetically. File names should be zero-filled properly in order for the text files to be combined in the correct order.

To Do:

  • The application needs to be tested thoroughly in different scenarios.
  • Exception handling needs to be improved.
  • Performance improvements.
  • Detailed help file.

Download Text Split Merge Beta 1.0 [36 KB]
Requires .NET Framework 3.5


Preventing Field Results from Updating in Microsoft Word

Printing a Word Document correctly can be a hassle if you have fields that update automatically during printing. Fields are codes that instruct Microsoft Word to insert text, graphics, page numbers, and other information into a document automatically. For example, the { DATE } field inserts the current date and { FILENAME \p \* MERGEFORMAT } inserts the full file path into a document. To work around this issue, you can choose to lock certain fields:

  • To lock a field so that field results are not updated, click the field, and then press CTRL+F11.
  • To unlock a field so that field results can be updated, click the field, and then press CTRL+SHIFT+F11.


Filed under: Litsupport, Software 1 Comment

Turning off the Show Repairs Dialogue Box in Microsoft Word 2007

One of the common annoyances during batch processing of Word documents is the "Show Repairs" dialogue box. While most modern e-discovery applications dismiss such dialogues successfully, you may need to disable these pop-ups one day. Here is how:

Add a new DWORD value called "BulletProofOnCorruption" under HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options and set it to 1.

While turning this dialgoue may come in handy for batch processes, I would recommend that you leave it active on your QC stations. It is important to know that there were errors detected in the native file during QC.


IPRO eCapture de-Duplication

IPRO_logoMany of you are familiar with eCapture as an ESI processing tool. It can be frustrating at times that you have to run a data extract or processing job on discovered material to be able to identify duplicates. What if you need to run a quick report prior to processing? If you are not de-duplicating compound documents (i.e. not maintaining compound document structure), then this is fairly easy. You go to the Items table in your eCapture database and de-duplicate the documents based on the MD5Hash column.

However, if you are looking to de-duplicate on an attachment family level, you will find that the FamilyHash column is not populated until a data extract or processing job is run. This is still not a big deal as you can create family level hashes outside and run your report. However, if you need to de-duplicate against a previous job, you will have to make sure that your family hashes are calculated exactly the same way as eCapture calculates them. As of version 4, eCapture calculates family hashes by individually hashing each document, concatenating the hash values in an attachment family in ItemID order and hashing the resulting string.

For example, if your attachment family consists of files F1, F2 and F3 (in ItemID order) with MD5 hashes H1, H2 and H3 and md5() is an MD5 hash function, the family hash value will be md5(H1&H2&H3).  Once you establish a workflow to do this efficiently, I would highly recommend running your own de-duplication outside of eCapture on a previous project and verifying the results.

Another important point to consider

When eCapture calculates family hashes, it combines the hashes of every item in the attachment family. This includes extracted embedded documents if the option is selected. This has two consequences worth considering:

1- If you are de-duplicating against a previous job where embedded document extraction options were set differently (i.e. jobs have a different number of extracted embedded items), eCapture will naturally produce different family hashes for the two attachment families with different extracted embedded item counts. This will obviously prevent the same original native document group to be de-duplicated, simply because it was handled differently during the two processing sessions.

2- I have also run into cases where extracting embedded items from the same file results in extracted items that look identical but have different MD5 hashes. This will also prevent two identical e-mail families from being properly de-duplicated against each other.

Filed under: Litsupport, Software 1 Comment

USB Write Protect

USB_Write_ProtectBeing in the litigation support industry, we work with USB devices almost every day. When working with customer-furnished data, it is very critical to prevent data spoilation by using a write-blocking device. Actions as simple as plugging the hard drive into a computer running Ms Windows and taking a look around are sufficient to alter metadata.

I recommend using OS independent, hardware based write blockers. The brands that I prefer are Tableau and WiebeTech. These products act as a bridge between your computer and the device that you are working with and block write requests at a hardware level while allowing you to read from the device.

Even though these devices are fairly affordable, unfortunately not every litigation support professional has one in his/her arsenal. There are different strategies for those of you who do not have access to such hardware. One of the easiest ways of blocking write requests to USB devices on a Ms Windows computer is by changing the storage device policy in the registry. The following key, starting with Windows XP Service Pack 2, controls whether or not Windows is allowed to write to USB devices:


I made a very small utility yesterday to automate this task and make it a little bit more user friendly. It is called USB Write Protect. All it does is to check whether or not you have a compatible operating system and to allow you to toggle the registry key mentioned above. Please feel free to download it via the link below and let me know if you have any questions or concerns. Please note the following:

  • This method blocks write access to USB devices that are connected after the registry key is set. In other words, you need to make sure the device you will be working with is disconnected prior to running USB Write Protect or changing the registry key manually.
  • This method only works with Microsoft Windows XP Service Pack 2 and up.

USB HD Download USB Write Protect 1.0 [140 KB]
Requires .NET Framework 3.5