1. A method of organizing and presenting data gathered in response to an event, the method being performed by one or more computers coupled to a network and comprising the steps of: (a) authenticating a plurality of memory sources by verifying whether a certificate presented by each of the plurality of memory sources is valid within a trust domain, each of the certificates indicating whether a respective one of the plurality of memory sources and all stored data of the respective one of the plurality of memory sources can be trusted; (b) in response to a successful authentication of the plurality of memory sources, importing the stored data from the authenticated plurality of memory sources into a first memory coupled to the network; (c) converting the stored data into a specified format to produce uniform data, the specified format being one of general purpose markup language and plain text format, the stored data providing a relational comparison between sets of the stored data; (d) providing an interface to a user through which the user requests a search of the uniform data; and (e) presenting one or more subsets of the uniform data to the user in response to the request from the user, wherein, the event is one of (i) a request for production of documents, and (ii) a data security breach.