A non-transitory recording medium recording therein a forensic program which acquires digital information recorded on a plurality of computers or a server to analyze the acquired digital information, for causing a computer to execute:
- a function of acquiring digital information containing digital document information composed of a plurality of document files, acquiring user information about users using the plurality of computers or the server, and acquiring access history information which shows a fact that the users accessed a document file recorded in the server;
- a function of recording the acquired digital information;
- a function of displaying, on a first display unit usable by a first operator, the recorded digital information;
- a function of displaying, on a second display unit usable by a second operator, the recorded digital information;
- a function of selecting, via at least one of the first display unit or the second display unit, a specific first individual and a specific second individual from the users contained in the user information, wherein the first operator, the second operator, the specific first individual, and the specific second individual are different from each other;
- a function of extracting, by an extracting unit operable on a first server, only digital document information which was accessed by the specific first individual and the specific second individual based on the access history information related with the selected specific first individual and the selected specific second individual;
- a function of analyzing, by a file analysis function, a kind of document file which was accessed or possessed by the specific first individual and the specific second individual;
- a function of causing the extraction unit, by a kind selection function, to extract a particular kind of document file;
- a function of preserving, by a preservation function, the extracted document file as a separate file and a function of controlling the status thereof;
- when newly acquiring digital information, a function of clocking by a clock unit a time and date of the acquisition of the digital information, the digital information further including folder information saving digital document information;
- a function of acquiring, by the digital information acquiring unit, the digital document information and the folder information which were produced after a time and date previously clocked by the clock unit, and a function of acquiring user information and access history information related with the acquired digital document information and the folder information;
- a function of simultaneously setting additional information, by a first additional information setting unit usable by the first operator via the first display unit and a second additional information setting unit usable by the second operator via the second display unit, indicating which document files in the extracted digital document information are each related with litigation, and which document files in the extracted digital document information are each not related with litigation;
- a function of searching, by a multi-language full-text searching unit operable on a second server, the full-text of the document files based on the extracted digital document information;
- a function of setting, by an access right control function of a managing unit, one or more rights for each account of a browser;
- and
- a function of outputting a document file related with the litigation based on the additional information.