Intella Investigator Administrator Manual 2.7.1 (2024)

• File or Folder: A single file or folder with source files on a local hard drive or on a shared/network drive. Such source files could be:

  • Regular loose files like MS Word, Excel, and PDF files.

  • Email containers such as MS Outlook PST/OST, HCL/IBM Notes NSF files, Mbox files.

  • Cellphone XML and UFDR reports such as made by Cellebrite UFED, MicroSystemation’s XRY and Oxygen Software’s Forensic Suite.

  • Even large containers like EDB files and disk images can be indexed this way, together with many other files in one go. The downside of doing this is that any EDB- or disk image-specific configuration options are not available this way.

• Load file: A Concordance, Relativity, or CSV load file.

• Hotmail Search Warrant Result (experimental): a collection of files in HTML and other formats, provided by Microsoft pursuant to a search warrant.

• Disk Image: One or more disk images in E01, Ex01, L01, Lx01, S01, AD1, AFF4, VHD, VHDX, AVHDX, VMDK, X-Ways or DD format.

• MS Exchange EDB Archive: a single MS Exchange EDB file.

• Vound W4 Case: A case created in the Vound W4 application.

• IMAP account: An email account on an IMAP email server.

• Dropbox: all files stored in a personal Dropbox or DropBox for Business account.

• Google: A Google account: Gmail, Drive, Contacts, Calendars and Tasks.

• Microsoft 365: The complete contents of a Microsoft 365 account, incl. the Outlook, OneDrive and SharePoint services of that account.

• iCloud: The complete contents of an iCloud account, incl. iCloud Drive, Mail, Calendar, Contacts, and other services.

• AWS S3: The complete contents of an Amazon AWS S3 bucket.

1. Create a text file named after the XML report. For example, if the report is called report.xml, the text file should be named report.numbers.txt.

2. Put it in the same folder as the XML report.

3. Store the phone’s own number in this file.
   When the XML report holds information about multiple phones, enter the number of each phone on a separate line, like this:
   number1
number2
   …​

4. The first line will be used for the first phone found in the report, the second line for the second phone, and so on.

• Windows Vista, Windows 7, Windows 8/8.1, and Windows 10:
  C:\Users\<username>\AppData\Local\Microsoft\Outlook

• Windows 2000 and XP:
  C:\Documents and Settings\<username>\Local Settings\Application Data\Microsoft\Outlook

• Windows 2000 and XP:
  C:\Documents & Settings\<username>\Local Settings\Application Data\Identities\
\{<arbitrary string>}\Microsoft\Outlook Express

• Version 7.x:
  C:\Program Files\Lotus\Notes\Data

• Version 8.x:
  C:\Program Files\IBM\Lotus\Notes\Data

• Version 9.x and 10.x:
  C:\Program Files\IBM\Notes

• Version 11.x:
  C:\Program Files\HCL\Notes

9.2.1. Note on source locations

9.2.2. Files and Folders

Follow these steps to add a File or Folder source to Intella Investigator:

Click "Next" to continue.

The last steps in the definition of a source type are almost the samefor all types. They are described in section Last steps in a source definition.

9.2.3. Load files

Follow these steps to add a load file to an Intella Investigator case:

Important notes on load file importing

There are several aspects to be aware of when importing a load file intoan Intella Investigator case:

You can save the specified load file import options as a template forlater usage on the last page using the button Save Template. All importtemplates are stored as XML files in the "<Intella HomeFolder>import-templates" folder.

9.2.4. Hotmail Search Warrant Results

Follow these steps to add a Hotmail Search Warrant Result to Intella Investigator:

The last steps in the definition of a source type are almost the samefor all types. They are described in the section Last steps in a source definition.

9.2.5. Disk Images

Follow these steps to add a Disk Image source to Intella Investigator:

Select "Verify hashes for AFF4 images" to verify hashes in AFF4 physical disk images during the disk image validation. If a hash mismatch is detected in a physical image, the disk image validation will fail and an error message will be shown. Please note that AFF4 physical image hash verification may take some extra time.

Note that the hashes for AFF4-L logical images are always verified during indexing. If a hash mismatch is detected in a logical image, it will be reported as an indexing error and can be found in the Exception report or Exception items facet.

Select "Carve unallocated space" to enable file carving. File carving is the process of reassembling computer files from fragments in the absence of filesystem metadata. Intella Investigator uses Testdisk and Photorec to recover deleted files from unallocated areas of the disk image. See https://www.cgsecurity.org/wiki/PhotoRec for more details.

These are some important details about file carving in Intella Investigator:

After you click Next button in the wizard footer, Intella Investigator willvalidate selected disk image. This process may take long time dependingon the complexity of the data.

The last steps in the definition of a source type are almost the samefor all types. They are described in the section Last steps in a source definition.

Filtering disk image content

A disk image often contains a lot irrelevant files, such as executables,DLLs. These files add to the processing time and disk space that thecase will consume. It is possible to define a set of rules to filter outunnecessary files and folders, to save processing time and disk space.

Note that search results can also be filtered after indexing, using theHide Irrelevant filter option in the Details tab.

Supported disk image formats

The Disk image source type supports EnCase E01, Ex01, L01, Lx01 and S01files. Password-protected files are supported and indexed without manualinteraction, except for FTK-encrypted files.

DD images are supported, but when a Folder source is used, they need touse the .dd file extension to be detected and processed as DD images.Because of potential issues with DD image detection, we recommend usingthe Disk Image source directly. This is also required when you want toindex a multi-volume DD image

Supported file systems and partition types

The following file systems have been tested: FAT16, FAT32, ExFAT, NTFS, Ext2, Ext3, Ext4, HFS, HFS+, APFS and ISO 9660. Other file systems such as YAFFS2, ISO 13346 (UDF), UFS 1 and UFS 2 may work but have not been tested yet.

MBR and GUID partition tables (GPT) partitions are supported. Apple Partition Maps (APM) have been tested but results were mixed. When an image cannot be indexed, we recommend mounting it manually and indexing the mounted drive using a “File or Folder” source.

APFS and BitLocker encrypted volumes are supported. When an encrypted volume is detected, a dialog will be shown where it’s possible to enter a password or recovery key. BitLocker volumes with suspended protection (also known as "clear key") will be indexed automatically without a password prompt. If a BitLocker volume is protected with multiple keys, you can enter any key.

Multi-volume files

When using a Folder source to index multiple image files, Intella Investigatorwill rely on the following file name convention to determinewhich files together make up a single image:

image1.e01 (first volume of image 1)image1.e02 (second volume of image 1)image1.e03 (third volume of image 1)…image2.e01 (first volume of image 2)image2.e02 (second volume of image 2)image2.e03 (third volume of image 2)…image2.e99 (99th volume of image 2)image2.eaa (100th volume of image 2)image2.eab (101st volume of image 2)…

Volume shadow copies

Volume shadow copies (VCS) is a mechanism in Windows OS that preserves previous versions of files in a special hidden area on the disk. A new VSC snapshot is often created automatically by Windows when installing major system updates or drivers.

When Intella Investigator detects that the disk image contains VCS, the Specify Volume Shadow Copies page will be shown. On this page you can select specific snapshots that need to be processed.

By default, Intella Investigator will only extract the files that were changed between snapshots. That allows to save a lot of processing time and disk space by not indexing the same file several times:

Intella Investigator uses the last modified date of the file to determine whether it has changed. It is also possible to take the last access date into account.

The "Has Shadow Copies" option in the Features facet can be used to see all items that have other versions in shadow copy volumes.

To see all items extracted from all volume shadow copies, use the "Recovered → Recovered from volume shadow copy" option in the Features facet.

9.2.6. MS Exchange EDB Archives

The currently supported MS Exchange versions are 2003, 2007, 2010, 2013and 2016.

Follow these steps to add a MS Exchange EDB Archive source to Intella Investigator:

The last steps in the definition of a source type are almost the samefor all types. They are described in the section Last steps in a source definition.

When an EDB source has been added and not all mailboxes were selected,it is still possible to index additional mailboxes in that EDB file at alater stage. To do that, the following steps should be performed: 1.Click on the "Edit" button for the respective source on Sources page.2. Indicate which mailboxes should be processed. Note that you cannotunselect or remove already processed mailboxes. Click OK. 4. Use the"Index new data" button option to index the new mailboxes.

9.2.7. Vound W4 Case

This source type lets one import an entire case created with the Vound W4 application into the current Intella Investigator case.

Follow these steps to add and process a W4 case source:

The last steps in the definition of a source are almost the same for all types. They are described in the section "Last steps in a source definition".

9.2.8. IMAP accounts

Follow these steps to add an IMAP Account source to Intella Investigator:

The last steps in the definition of a source type are almost the samefor all types. They are described in the section Last steps in a source definition.

9.2.9. Dropbox accounts

A Dropbox source reconstructs the entire folder tree in a Dropboxaccount and downloads current and past revisions of the files in theaccount.

The official Dropbox REST API used by Intella Investigator limits this to amaximum of 10 revisions per file. All revisions except for the last onehave their file names decorated with the revision identifier.Furthermore, additional Dropbox-specific metadata is retrieved for bothfiles and folders. These are displayed in the Previewer’s Raw Data taband are subject to full-text indexing.

Intella Investigator uses the OAuth2 (Open Authorization) protocol to accessthe account. Prior to defining the source, the investigator needs toobtain an OAuth2 token for the account.

Next, follow these steps to add a Dropbox source to Intella Investigator:

The last steps in the definition of a source type are almost the samefor all types. They are described in the section Last steps in a source definition.

9.2.10. Google accounts

A Google source allows to download items from the following Google services:

More Google services will be added in the next versions.

Different services require different APIs to be enabled:

Optionally, the set of retrieved items can be restricted to a certaindate range.

Benefits of using the Google/Gmail source over the generic IMAP source are:faster performance, more accurate data representation (e.g. folders vs.Gmail’s Labels, threads), and a read-only data connection ensuring thatno data is altered on the server.

Intella Investigator uses the OAuth2 (Open Authorization) protocol to accessthe account. Prior to defining the source, the investigator needs toobtain an OAuth2 token for the account. The token will be downloaded asa JSON file, which Intella Investigator can use to access the account.This process is described in detail in the following Knowledge Base Article: Collecting data from a Google source.

Next, follow these steps to add a Google source to Intella Investigator:

The last steps in the definition of a source type are almost the samefor all types. They are described in the section Last steps in a source definition.

9.2.11. Microsoft 365

The Microsoft 365 source types allows for retrieving both user account anduser groups. For each user account, used to access Microsoft 365, thesource can retrieve data from Outlook, OneDrive and SharePoint. For eachuser group, the source retrieves titled conversations containing emails.

Once the credentials are established, follow these steps to add a Microsoft 365 source to Intella Investigator:

A connection will be established and the credentials will be validated.If credentials validation is successful, basic information about theaccount such as the tenant name and location will be shown beneath theconfiguration fields.

Note the Help button at the top of the screen. Clicking it will displaythe steps required to create the client ID.

Click Next to continue.

Selective indexing of part of the account data is not possible at thismoment.

Click Next to continue.

The last steps in the definition of a source type are almost the samefor all types. They are described in the section Last steps in a source definition.

9.2.12. iCloud

The iCloud source type is used for indexing the contents of an iCloudaccount, such as emails, photos and notes.

Prior to defining an iCloud source, the investigator must obtain theApple ID and password used by the account owner. When the account hasbeen configured to use two-factor authentication (2FA), iCloudadditionally sends a verification token. The verification token is sentonly if a valid phone number is set for the Apple ID. Hence, theinvestigator needs to have access to one of the physical device (aniPhone or an iPad) associated with the account, including the passcodeto unlock the device.

Intella Investigator supports the retrieval of the following data from an iCloudaccount:

Follow these steps to add an iCloud source to Intella Investigator:

When this account requires two-factor authentication, Intella Investigator willextend the form with an option to choose the verification deliverymethod: SMS or Idmsa.

Both methods are equally capable of providing access to the account’sdata. When the account is linked to an iPhone and/or iPad, the Idmsamethod is recommended. When the account is linked to a non-Apple device(e.g. a cellphone or tablet from a different vendor), SMS is the onlyway to obtain the verification code. Even when using an Apple device,SMS can be selected as the preferred method for delivering theverification code. In that case, the registered device may receivemultiple notifications from Apple’s identify management service (IDMSA).Such notifications should then be ignored and the code from the SMSmessage should be used.

Choose the desired delivery method and click Get Verification Code. Asix-digit verification code will be either sent as an SMS or show up asa native iOS notification on the Apple device. The controls for choosingthe delivery method will be replaced by a Verification Code field. Enterthe received verification code in this field. Click Connect to iCloud.

When the credentials and the verification code are all valid, Intella Investigatorwill list some account info such as the Full Name of the account owner.Click Next to continue.

The last steps in the definition of a source are almost the same for alltypes. They are described in the section Last steps in a source definition.

When Intella Investigator establishes a connection to iCloud using the accountcredentials, it will obtain a trust token. This token allows Intella Investigator toconnect to iCloud at a later point in time without requiring the user tore-enter the credentials and perform any two-factor authenticationsteps. The trust token has a limited validity period. iCloud sources canbe indexed and re-indexed during the validity period of the token. Oncethe token has expired, the source must be re-created; there is no way torefresh the token of an existing source.

9.2.13. AWS S3

An AWS S3 source reconstructs the entire folder tree in the selected S3 buckets and downloads current and past revisions of the files.

All revisions except for the last one have their file names decorated with the revision identifier. Furthermore, additional S3-specific metadata is retrieved for both files and folders. These are displayed in the Previewer’s Raw Data tab and are subject to full-text indexing.

Prior to defining the source, the investigator needs to obtain an access key for the account. This process is described in detail in the following Knowledge Base Article: Creating AWS access keys.

Next, follow these steps to add an S3 source to Intella Investigator:

The last steps in the definition of a source type are almost the samefor all types. They are described in the section Last steps in a source definition.

9.2.14. Additional options

In version 2.7 of Intella Investigator, some new source wizard sheets have been moved to "Additional options" section. This change streamlines new source creation as only some required options are necessary for source creation.Additional options will have defaults set and can be changed by simply clicking on the sheet and changing the option.Additional options will appear once completed source definition sheet is reached, by settings required options and clicking on next button.

9.2.15. Last steps in a source definition

The following final steps are the same for all source types.

9.2.16. File name filters

In the file name filters you can specify file name patterns that need to be excluded from processing. File name filter can include ? or * characters to represent a single or multiple wildcard characters. Examples: .exe, case-main-.log.Excluded items will be added as stub items that only contain the item’s type and file name (if available). Note: items embedded in excluded items will still be processed and included. You can also choose whether filtering applies either to all items or unknown items only.

• Statistics on indexing speed.

• Statistics on encountered file types.

• The amount of data that is being indexed and how much has been indexedalready.

• The number of indexing steps to perform, which current step is beingperformed and (for some steps) a progress percentage.

9.3.1. Note on finishing indexing operations

While an indexing operation takes place, the case remains opened and locked by Intella Node. During that time, running a different indexing operation is not possible. The case also cannot be opened for sharing.After the indexing operation is completed, the case will be automatically unlocked and can be shared by case administrators.

9.3.2. Re-indexing a case

There may be circ*mstances when you want to re-index individual sources or the entire case, e.g. to use extraction features offered by a newer Intella Investigator/Intella Node version or fix a broken index.

To rebuild the case index from scratch, choose one or more sources in the Sources view, click on "Indexing" button and use the Re-index option either for selected sources or entire case. Intella Investigator/Intella Node will remove all indices it has previously created and create new ones.

In order for this to work, all evidence files have to be present at the location they had during the initial indexing.

9.3.3. Updating a case

Alternatively, there may be times when you want to update an index, e.g. in the following scenarios:

In these cases the "Index new data" option, shown when clicking on "Indexing" button in the Sources view will scan either the selected sources or all sources for new evidence items depending on what is chosen. Items that have already been indexed are not changed, also when their original evidence items are no longer available.

9.4.1. Supported formats

The following file formats can be decrypted by Intella when the credentials are specified before indexing:

Furthermore, password-protected PST files can be automatically decrypted without specifying any passwords.

9.4.2. Supplying access credentials

To let Intella automatically decrypt the encrypted items that it encounters, their keys (passwords, certificates, etc.) need to be added to the Key Store first.Navigate to Sources page and click on Key Store button and follow the instructions below.Afterwards you can (re)index your data and let the items be decrypted automatically.

All credentials that you enter will be tried on all encrypted files to which they can apply. It is therefore not necessary to specify e.g. which password applies to which file or file type.

After indexing you can see which items were successfully decrypted by using the "Decrypted" category in the Features facet or by using the "Decrypted" column in the Details table. Note: due to technical reasons, decrypted NSF files will not be marked as such.

Password-protected files
Passwords are the simplest type of key. They are used for decrypting PDF and MS Office documents and archives.

You can either add passwords one by one, or load them in batch from a text file: specify a password per line and use UTF-8 encoding for the file.

HCL/IBM Notes NSF files
To decrypt HCL/IBM Notes NSF files, so-called ID files need to be added to the key store. Go to the "HCL/IBM Notes ID Files" tab and click "Add…​". Enter the location of an ID file and the password associated with the file. Click OK to add it to the store. Intella will validate the ID file to make sure you entered the password correct. Repeat this for all ID files.

Intella will also try to decrypt encrypted messages in non-encrypted NSF files using the provided ID files.

S/MIME-encrypted emails
To decrypt emails with S/MIME encryption, one or more X.509 certificates and private keys need to be added. Go to the "X.509 Certificates" tab and click Import, then select a PKCS12 archive file (*.p12 or *.pfx file) that contains the keys. Intella will analyze the key file and import all found certificates and keys.

Usually you can export the certificates and keys from a mail client in this format. Do not forget to include private keys as they are critical for decrypting the emails.

PGP-encrypted emails
To index PGP-encrypted emails you will need to import the PGP private keys. Go to the "PGP Keys" tab and click Import. Intella can import ASCII armored PGP private keys (*.asc files), but it is also possible to import key in binary format.

An ASCII armored PGP private key usually starts with the following text:

-----BEGIN PGP PRIVATE KEY BLOCK-----

Importing multiple .p12 files
At the moment it is not possible to enter multiple .p12 files in a single action, they need to be entered one by one. We have put this feature request on our roadmap for future development.

Please note that .p12 files can contain multiple certificates. Therefore, if your environment is able to export multiple certificates into a single .p12 file, or you can find a third party tool that merges them, you can effectively import multiple certificates at once.

Furthermore, note that you can copy the keystore files to another case. That way you can reuse the entered credentials if they apply to other cases/evidence sets as well.

Encrypted volumes in disk images
To decrypt BitLocker and APFS volumes in disk images, a correct password, recovery key, or recovery file needs to be added. Passwords can be added via the "Passwords" tab. "BitLocker Recovery Keys" and "BitLocker Recovery File" tabs should be used to add BitLocker-specific credentials.

Note that BitLocker images protected with other methods, such as a Smart Card or TPM, are not supported.

• Text — The column can hold arbitrary text of any length.

• Integer — The column can hold a whole number in range between -2,147,483,648 and 2,147,483,647.

• Long Integer — The column can hold a whole number in range between -9,223,372,036,854,775,808 and 9,223,372,036,854,775,807.

• Floating Point — The column can hold a 64-bit floating point number.

• Boolean — The column can hold either True or False.

• Date — The column can hold a date-time value.

• The Type option allows to restrict the rule to a specific file type or type category. By default, the type is set to "Any" which means that the rule applies to any item.

• The From option defines where the metadata field comes from: Raw Data or Headers.

• The Field option defines the name of the metadata field that should be extracted.

• The Date Format option allows to specify a date format if this is a date column. The Language option can be used to tell which language should be used when parsing certain date elements, like day of the week or month names.

• The Case Sensitive option can be used to specify whether the Field name is case sensitive.

• Extract the email client information into an "Email Client" column:

• Name: Email Client.

• Type: Text.

• Extract data from:

  • Type: Email Message

  • From: Headers

  • Field: X-Mailer

• Extract the camera model information from JPEG photos into a "Camera Model" column:

• Name: Camera Model.

• Type: Text.

• Extract data from:

  • Type: JPEG Image

  • From: Raw Data

  • Field: Model

9.6.1. Tasks

Intella Investigator/Intella Node allows for the definition of "tasks". These areessentially compound processing steps such as searching for all itemsthat match a certain keyword or keyword list and tag or export theresults. These tasks can be defined and selected during source creation,which will run these tasks right after indexing. Tasks panel can be opened by clicking on the Tasks icon (three vertical progress bars) inside the Secondary Navigation Bar,which allows for defining and running the tasks at any point in time after index creation. See thetaskssection for more details.

Each task consists of conditions, post-conditions and actions. A taskmust have at least one condition and one action.

A condition (Step 1 in the task dialog) defines a search query thatselect items from the case. Currently the following conditions can bedefined:

A task may combine any number of conditions. The match option controlsif the items should match all specified criteria or at least one ofthem, i.e. a Boolean AND or OR of the specified conditions.

An optional list of post-conditions (Step 2) specify how to transformthe item set retrieved in the previous step. Possible post-conditionsteps are:

It is possible to define multiple post-conditions for a single task. Thefirst post-condition is applied on the set of items resulting from theconditions in Step 1. Subsequent post-conditions are applied on theoutcome of the preceding post-condition.

Finally, task actions (Step 3) define the operations that will beapplied to the items resulting from the previous steps. The followingactions can be defined:

Every task may define multiple actions that will be applied sequentiallyto the determined item set.

Tasks can be exported to a file so that they can be reused in othercases. These files are self-contained, i.e. when the task involves MD5hash lists or keyword lists, these lists are embedded in the task file.

Tasks are executed in the order they have in the task list. This makesit possible to "pipeline" tasks, e.g. use one task to assign specifictags to a subset of the items and use a subsequent task that is based onthose tags. The order can be changed by selecting a task and using the"Move Up" and "Move Down" buttons.

9.6.2. Custodians

The Custodian attribute can be assigned to items after indexing. Thiscan be used to represent the custodian of the evidence items. To enableautomated assigning of multiple custodians in a folder source, the rootfolder should organize the evidence in subfolders, one subfolder forevery custodian. If the evidence folder is structured in this way, the"Indexing Tasks" step in the Source Wizard will contain a "Custodians"tab that opens the settings panel for automated assigning of multiplecustodians. By default the custodian names are set to equal thesubfolder names. It is possible to alter the used custodian names in thetable. This Custodian value will be assigned to all items obtained fromthe evidence files within the respective subfolder. For other types ofsources, the "Indexing Tasks" tab contains a text field for setting asingle custodian name. Besides the above method, the Custodianattributes can also be set or changed using the "Set Custodian" indexingtask with an arbitrary condition, or edited manually in the Details’right-click menu.

9.6.3. Thumbnail generation

9.6.4. Importing an overlay file

An overlay file is a file that contains additional information about thecurrent items in a case. By importing the overlay file, the metadata ofthese items can be extended.

Intella Investigator currently only supports the importing of tags, tag columns,comments and metadata columns (both regular and custom). Importingoverlay images, texts, and natives may be added in a future release.

The following file formats are supported for overlay files:

To import an overlay file you need to add another Load filesource. Set the Import operation to Overlay and specify thelocation of the file. You can optionally use a previously savedtemplate.

On the "Configure delimiters" page you can set the file encoding,delimiter settings and date formats. Please see theLoad files section for a descriptionof these options.

On the "Map fields" page you need to specify the identifier field andtype. This is how Intella Investigator will match items in the overlay filewith the existing items in the case. There are four options for matchingitems:

The “Also overlay metadata shared with duplicates” option is used tocontrol whether the imported metadata will be applied to all duplicatesas well (see the limitations below for this setting).

Current limitations:

Please see the Adding sources > Load file section fora description of the remaining options on this page.

9.6.5. Content analysis

9.6.6. Email threading

Email threading can be scheduled to run either as an indexing Task or bya reviewer directly from a shared case. The latter procedure is described inReviewer’s manual > Email threading.

9.6.7. Near-duplicates Analysis

A technique to reduce the reviewing time is Near-duplicates Analysis. It splits a selected set of items into groups based on the similarity of their text content. Every group is centered around a "master item" which is the most common near-duplicate for other items in the group (usually, an item with the largest text size). Other items are included in the group if they are determined to have an appropriately high similarity score to the master item. The similarity score is based on an amount of co-occurrent text fragments and is a number between 0.0 and 1.0. The master item and its exact duplicates are assigned a score of 1.0. The rest of the group items have scores between 1.0 and a threshold value specified by the user before the analysis.

To start the Near-duplicates Analysis process, select multiple items in the Detailstableand select"Near-Duplicate Detection"in the right-click menu. In the dialog window, move the "Similarity threshold" slider to set the desired minimum similarity score for items to be included in near-duplicate groups. Select the "Ignore excluded paragraph" option if you don’t want the content of excluded paragraphs to be considered by the similarity calculation algorithm.

The dialog window allows the user to select a text analysis method. We recommend choosing the "Word-based" option for documents written in languages in which the representation of meanings is contained in words. The “Character-based” option is intended for languages in which the semantic representation is represented by morphemes (Chinese, Japanese, Vietnamese, Korean). Typically, these are languages in which the use of white space characters is optional. Choosing the appropriate algorithm for a data set will improve the quality of the analysis results.

Upon completion, near-duplicate groups are available for search in the "Near-duplicates" facet (seeReviewer’s manual > Near-duplicatessection for details). Additionally, "Near-Duplicate Group", "Near-Duplicate Master Item" and "Near-Duplicate Score" columns can be made visible in the Details table to show the group names, master item IDs and similarity scores of items included in near-duplicate groups.

To query for Near-Duplicates of specific items that are subject to Near-duplicates Analysis, select the item in the Detailstable, right-click, and choose "Show Near-Duplicates". This option will be enabled only when the selected item has at least one Near-Duplicate.

The total set of analyzed items and items included in near-duplicate groups can be retrieved via the "Analyzed for Near-Duplicates" and "Has Near-Duplicates" nodes in the Features facet.

9.6.8. Custom IDs

“Generate Custom IDs” task allows to assign each item a unique custom IDtaking families into account. Such IDs can often then be used in loadfile exports. Or it can help to easier identify item position or role inits family.

Items are processed in hierarchical order starting from the roots andexploring as far as possible along each branch before backtracking(Depth-first search). Items that are on the same level of hierarchy areprocessed in the order defined by Sort Order setting. If the selecteditems don’t contain complete families, the task will add the remainingitems automatically.

Click Configure button on the task action panel to configure thenumbering settings:

Generated custom IDs can be used in load file export and can be importedfrom a load file.

Custom IDs don’t change when the case is re-indexed, provided that thecase is re-indexed using the same version.

• The item ID. This can be used to quickly locate the item using View > Preview Item…​ The Previewer will also show a warning icon when displaying such an exception item.

• The MD5 hash. This can be used to locate duplicates of the item within the case or in other cases.

• The source to which this item belongs.

• The file name, file size and detected file type of the problematic item.

• The name of the source in which the item was found.

• The location of the problematic item. This includes both the path to the containing evidence file (e.g. a PST file) as well as the path within that file (e.g. the mail folder and parent email, when the exception occurred on an attachment).

• Information on the parent email if there is any: its item ID, the sender, sent date and subject.

• A warning scope, warning code and warning description. The scope and code are the most useful for end users and are documented below. The description provides a low-level error message that is also contained in the log file and can be used for error diagnosis by Vound’s technical support team.

• Item — the entire item is affected.

• Text — the extracted text is affected.

• Metadata — the extracted metadata is affected.

• Embedded — embedded items such as attachments and archive entries are affected. An example is a document that internally references an embedded image but the image is not present in the file, resulting in an error when processing the embedded items of the document. In that case the document gets an error with "Embedded items" as the Warning Scope.

• Unprocessable data — The data cannot be processed because it is corrupt, malformed, or not understood by the processor. Retrying will most likely result in the same result.

• I/O errors — The processing failed due to I/O errors. The processing might succeed in a repeated processing attempt. There can be a lot of reasons for such errors, e.g. a drive that fails to respond, or permissions blocking Intella from accessing it. The indexing logs will have the full error. The difference with the other errors is that the reason is typically external to Intella, which is why retrying indexing may sometimes resolve the issue.

• Decryption failed — The data cannot be processed because it is encrypted and a matching decryption key is not available. The processing might succeed in a repeated processing attempt when the required decryption key is supplied.

• Timeout — The processing took too long and was aborted. See more details on how to configure crawler timeout in "Memory, crawler count and timeout settings" chapter.

• Out of memory — The processing failed due to a lack of memory.

• Processing error — The processing failed due to a problem in the processor. The description should contain the stack trace.

• Truncated text — The item text was not fully processed due to one of the following reasons:

  • The item text was larger than the imposed item text limit and any additional text was ignored. See the Sources section for a description of this limit and how to alter it.

  • Binary content was removed from the item text. Intella will try to detect and remove so-called binary content from all processed text to reduce memory usage when processing corrupt or recovered files. It includes any control and non-printable characters that are not normally present in regular texts. Items with binary content removed will have an error description: "Binary content detected".

  • The item text could not be extracted because the format is not fully supported yet.

• Crawler crash — The processing failed due to a crawler crash. This is a more severe error compared to the Processing Error type. When it occurs, Intella will also reject all items that are related to crashed item (e.g. PST file and all of the emails that it contains). More details about why the crawler crashed can usually be found in a hs_err_pid_XYZ.log file which is located in the case logs folder (one file per crash). Crawler crashes will not affect other items and the case integrity.

• Number of exceptions per source, subdivided by the warning codes.

• Overall statistics for the warning codes.

• Source-level errors, e.g. broken PST files.

• The data, metadata, OCR results and (load file) images associated with the removed items, except for those that are still associated with item duplicates originating from other sources.

• Any redactions and comments associated with the removed items.

• All references to the removed items in tags, flags, batches, export sets, custodian sets and near-duplicate groups.

• Refences to the source and the evidence items contained in the logs files.

• References to the numeric item IDs in the event log.

• MD5 hashes of item locations.

• Metadata extracted by the email threading procedure, such as Message-ID headers and Conversation Index properties.