admin

See this link for the Optimization Folder usage. http://community.vound-software.com/index.php?/topic/185-beta-optimization-folder/

What product exported the PST's from the EDB.

Hi All, We are asked all the time what system do we recommend people buy to use with Intella. We have some guidelines that we send out. Those are: Example configuration for a cost-effective high performance desktop machine • Intel® Core™ i5 2500 CPU • Main board with two or more SATA-600 connectors • Three SATA-600 Western Digital® Caviar Black drives • 8GB dual channel DDR3-kit RAM • Example configuration for a very high performance desktop machine Intel® Core™ i7 2600 is the latest CPU • Three fast SATA, SSD, SAS or RAID for Case, Evidence and Optimization Folder • Separate drive for Windows • 32GB RAM of memory, dual channel If others wanted to share/showoff the systems they use Intella on please do so in this thread. It will help others to set up there Intella indexing and Connect computers. To start things off here is my test computers setup. I have kept it on the lower end of systems (total cost was under $1000). Not going for a Xeon or the likes. I am running 600 gig of PST in 35 hours using this system. Operating System Windows 7 Enterprise 64-bit SP1 CPU Intel Core i7 3770 @ 3.40GHz Ivy Bridge 22nm Technology RAM 32.0GB Dual-Channel DDR3 @ 667MHz (9-9-9-24) Motherboard Gigabyte Technology Co., Ltd. Z77X-D3H (Intel Core i7-3770 CPU @ 3.40GHz) 28 °C Graphics S27C350 (1920x1080@60Hz) 3072MB ATI AMD Radeon HD 7900 Series (Gigabyte) 30 °C Storage 1863GB Seagate ST2000DL003-9VT166 ATA Device (SATA) 31 °C 111GB KINGSTON KINGSTON SVP200S SCSI Disk Device (SSD) 26 °C 1863GB Intel Raid 1 Volume SCSI Disk Device (SATA) 26 °C 1863GB Intel Raid 1 Volume SCSI Disk Device (SATA) 26 °C Optical Drives TSSTcorp CDDVDW SH-222BB ATA Device Audio AMD High Definition Audio Device I used this tool to dump the details above. http://www.piriform.com/speccy

Hi All - In advance of the beta here is some details on using the new Optimization Folder. Note that Intella will index the evidence first (You will see activity in the Indexing Speed graph). Then it will start case creation (no changes in the graph). Case creation takes about the same time to create as the indexing phase. This is different to 1.7.X that indexed and created the case at the same time. Note in the image above. The Speed Graph shows that evidence processing took approximately 175 minutes. The total case times was 5.46 hours - 346 minutes. So case creation took 171 minutes. 125 gig of PST's i7 with 16 gig RAM + 20gig per hour on $800 computer Set up your system as such. Drive 0: OS Drive Drive 1: Case Folder Drive 2: Evidence/ESI Drive 3: Intella Optimization Folder (at least 1.5 times the evidence size) RAM 32Gig or above. OS is best at Win7 or 8. (but Server 2012 will work fine) For Drive 1,2 and 3 we suggest FAST drives such as. SAS, SATA or RAID if possible. No Green Drives, USB2 or 3 or network drives. Here is how to set the new Optimization Folder feature. Add new case. In Case folder Select 1 drive. Then click Advanced to add the Optimization folder. When in the add Source wizard (after case setup) select the 3rd drive that has the evidence to be indexed. In the example above the evidence is on the D:\ drive so as to have 3 separate drives. (Drive order or letter is not important, just use 3 physically different drives - no USB2/3 or Network folders).

The release of Windows 8.1 Update 1, know as KB2199255 has broken the way that the HASP dongle works. By working with Safenet (the makers of the HASP dongle) we can offer the following solution. To solve the issue caused by KB2919255: HASP SRM Run-time Environment DLL (E0004)" on Windows 8.1 update 1: 1. Please save the attached haspjert.zip file to your desktop. 2. Open Windows Explorer and navigate to C:\Program Files\Vound\Intella 1.7.3 (or wherever you have installed Intella) 3. In the install folder you will see a file called haspjert.dll 4. Right-click and Rename haspjert.dll to old-haspjert.dll 5. Unzip the haspjert.dll in the zip you saved to your Desktop in to the Intella folder (C:\Program Files\Vound\Intella 1.7.3) 6. Restart Intella and the error should now be gone. KB2919255 broke lots of software. See below. https://www.google.com.au/search?q=KB2919255&oq=KB2919255&aqs=chrome..69i57.959j0j7&sourceid=chrome&es_sm=122&ie=UTF-8 haspjert.zip

Installing Intella on Windows Server Windows Server 2008 and 2012 Intella will run on Windows Server 2008 and Windows Server 2012. Be aware that by default the security settings on these platforms are heavily locked down. The reason we say we formally do not support 2008 and 2012 is because a number of users were having issues setting up the security of these platforms to work with Intella (e.g. changing firewall settings). Those users were then pushing these questions about the Windows platform to Vound support. This meant we had to do a Webex session to fix their system for them so they could use Intella. This was time consuming and not really a support issue. It was also risky as we had to alter the platform security settings to make Intella run correctly. If they then got hacked it may be blamed on Vound. Therefore, Intella runs fine on Windows Server 2008 and 2012, but the user must take full responsibility for configuring the system. We cannot support the system settings. It should be noted that the Windows Server editions are not recommended to be used as a workstation as they are not optimized to do so. Windows 7 will run better and faster.

Content created Returns a Date indicating the creation time for the message. This property corresponds to the MAPI property PR_CREATION_TIME. Read-only. Other details on file times. http://en.wikipedia.org/wiki/MAC_times Info on PDF's http://www.4n6k.com/2014/02/forensics-quickie-pdf-metadata.html

Hi Adam, The beta of what will be Intella 2.0 will be release in the next few day. We will post details to the forum when ready.. Testing by a 3rd party shows Intella V2.0 to be up to 3 times faster at indexing on a mid range computer (around 35 gigs an hour).

Afraid to say I have not tried to IMAP on either. We see two sides to IMAP. The collection and the exporting. When our customers collect using IMAP they often go on to have issues when exporting where the data has been deleted from the server. Hence we recommend in training that people collect via Thunderbird to create a local copy. They can use the IMAP when on a local IMAP server or trying Groupwise. With collections we see a lot of "Network not available errors" in the logs of people who do use IMAP. Most are related to internet connects that drop. That said there are some improvements to IMAP due in the next version. However we will still recommend making a local copy to avoid loosing access to data if removed.

Hi All the new wishlist thread.

Hi, This functionality is discussed here... http://community.vound-software.com/index.php?/topic/152-quick-preview-of-a-new-visualization/

Hi Mark, The Enscript is only for V6. The person who wrote it for us did not wish to create a V7 scripts as they were sticking with V6 in daily use. It is worth asking about the script on the Encase forum. Others may have updated it.

Hi Adam CTRL + O or Top menu > View > Preview Item.

Hi Adam, I have (I think) upped the limit. Please can you try now.

Thank you for your feedback. You could make use of tagging to get to the results you wanted. Search 1: "real estate" Search 2: investment" Tag the overlap Search 3: "Estate Investment"~5 Include Tag The above may need a few tweaks but it is the similar to the method we teach in training rather than the single search string approach that we don't suggest. There is also the Lucene documentation that details what searches are available. http://lucene.apache.org/core/2_9_4/queryparsersyntax.html

Hi Mark, We have a section in our training course that cover this. Here is a test you can try. Take an existing Word and PDF, doc note the File Created or File Last Modified dates. Email those documents to yourself. Save to a new location and check the File Created or File Last Modified dates.

We have seen so many issues with USB2/3 that we no longer recommend they are used. We see case file corruption and slow speeds all of the time. We recommend internal SATA or better for all Intella tasks. If you are forced to use USB make sure you have a valid backup and be prepared for slow processes (USB3 is the same).

Yes Intella will process edb files. I would expect in 2 releases from now. You can test the alpha of the EDB tool if you wish. Let us know in the EDBee forum.

Just click the icon again...

What disks are you indexing from and too. I.e. are they local or external disks? .

We are looking at this for a future version of intella. Most likely after EDB processing is complete

It is possible to have one case indexing and one exporting. Or to have 2 -3-4-5 cases all indexing at the same time. The bottleneck will be disk access more than CPU.

HI - Attached is a document that describes how a network dongle will function. It is possible to set a permission on who can use a dongle in the dongle control panel. Here: http://localhost:1947/_int_/config.html HASP HL NET Configuration.pdf

Where specifically on you would you like us to add the button?

HI PFF, I have seen something similar with IMAP timeouts. If the IMAP server has any long timeouts Intella is not as tolerant to this as thunderbird.