Bryan La Rock
Members-
Posts
22 -
Joined
-
Last visited
Recent Profile Visitors
The recent visitors block is disabled and is not being shown to other users.
Bryan La Rock's Achievements
Newbie (1/14)
0
Reputation
-
Hi Jason, Thank you so much for your answer. My apologies for the extreme tardiness of my reply. Things got a little crazy after that post, and I never managed to get back here. Actually, I've tried the method you mentioned (see my original post). I've just tested this again using Intella Pro 2.3, and the button still does not seem to function correctly. I am given the warning prompt to confirm deletion, but nothing seems to happen whether I click "Yes" or "No. In the screenshot below, I am attempting to delete export set "Elluma-P01 - Initial Mailbox Upload": Perhaps case corruption is to blame? Have you been able to get this functionality to work on your data sets? Thank you so much, and again, sorry for the long delay! Best wishes, Bryan
-
De-duplication with X.400-style addresses
Bryan La Rock replied to Bryan La Rock's topic in Intella 10/100/250/Pro
As an update, here is the technique I used to deal with this. I don't think this is quite ideal, but it seems to have worked reasonably well in this case: For all Top-Level Parent emails, I exported the following fields to a CSV file: DocID Subject Sent Attachments From To CC BCC Conversation Index Using Excel, I identified all emails that contained the exact same values for ALL of the fields in red above. Using a spot check, I confirmed that the resulting documents indeed appeared to all be duplicates. Note this technique does not actually compare the email bodies. A better technique would certainly consider the bodies as well. Bryan- 1 reply
-
- x.400
- message hash
- (and 7 more)
-
Hello! My apologies if this has already been address, but I could not find it through search. I am dealing with MST Exchange emails. The emails contain a mix of standard SMTP email address as well as Exchange X.400-style addresses. De-duplication becomes a big problem here. Emails that are otherwise identical have different message hashes when one email has the SMTP address and another email has an X-400-style address. Is there any way currently to de-duplicate these? I know that as of the latest version of Intella, you can configure Message Hash to ignore certain attributes (including headers and recipients). This should work, but I'd really like to have more fine-tuned control than this. Ideally, it would be amazing if Intella could intelligently recognize that two emails are identical even if they use a mix of SMTP and X.400-style addresses. From my experience, this issue is very common in dealing with Exchange exports. Any thoughts would be greatly appreciated. Thank you! Bryan
- 1 reply
-
- x.400
- message hash
- (and 7 more)
-
Hello! I'm working on a privilege keyword search for a client. The client has requested that I search for emails to/from their attorney. This part is easy enough to implement. Here's the hard part: The client has requested that I exclude items in which privilege may have been waived by CCing another person. In other words, if the client communicated with their attorney but also CCed someone else, we don't want that search result to be returned. Ideally, it would be great to craft a search something like this: (from:attorney@lawfirm.com OR to:attorney@lawfirm.com) AND NOT cc:[anyone other than attorney@lawfirm.com] Of course, that's not a valid search, and I don't think that such functionality exists. The only way I think this can be done in Intella is as follows: Run the basic search: (from:attorney@lawfirm.com OR to:attorney@lawfirm.com) and select the resulting bubble Review the Email Addresses Facet and look for any CC (or possibly other) addresses OTHER THAN attorney@lawfirm.com Remove these items from the results I believe the above should work, but I'd love to know if there is a better way to do this. Thank you! Bryan
-
Hello! Is there a way to delete (or rename) an Export Set? I have a case in which I created an Export Set with some error in it. Unfortunately, when I fixed the errors, I created a new Export Set with the same name as the bad Export Set. It is really confusing to have both of these in the same case, so I'd like to delete the bad one (or rename it). I see that there exists a button to "remove" an Export Set from the Export menu. This button doesn't seem to actually do anything, though. Perhaps this hasn't actually been implemented? Thank you! Bryan
-
Show Duplicates for Multiple Items
Bryan La Rock replied to Bryan La Rock's topic in Intella 10/100/250/Pro
Hey Jon! Thanks for the reply. I definitely will keep my fingers crossed for this one, as it would make life a lot easier for me. Thank you again! Bryan- 2 replies
-
- duplicates
- md5
-
(and 1 more)
Tagged with:
-
Hi! I know that Intella has "Show Duplicates" functionality, but this only seems to work for a single item. In many case, I'd like to be able to select a group of items and then see those items and all of their duplicates. Is there any current way to do this easily in Intella? I currently use the following workaround: I select the group of items, select "Add Tags", and then use the tagging option to apply the tag duplicates. This works, but it is not convenient. It also leaves me with a tag that I frequently need to go delete afterward. Thank you so much! Bryan
- 2 replies
-
- duplicates
- md5
-
(and 1 more)
Tagged with:
-
Using Tasks for Automated Processes
Bryan La Rock replied to jon.pearse's topic in General Technical Information
Hey Jon! Thanks for the suggestion. I actually did consider this (and I probably should have mentioned this in my original post). The problem is that I have a lot of other criteria in addition to the custodians for these searches. There are keyword searches and date ranges as well. Therefore, I need to keep the overall logic to "match all" as opposed to "match any". If I add multiple custodian tags, this will break the search. Ideally, it would be best if Custodian were an option in Tasks (with the ability to select one or more custodians). It would also be fantastic if Tasks allowed you to create logical groups of nested AND/OR conditions for situations like this. That being said, do you have any other suggestions? For this case, I ended up creating tags for groups of custodians. This allowed me to use the Tag option in Tasks to search multiple custodians at once. This is not a good solution, though, as it requires quite a bit of extra work to set up the custodian groups. Thanks again! Bryan -
Using Tasks for Automated Processes
Bryan La Rock replied to jon.pearse's topic in General Technical Information
Hi! I'm fairly new to automation through Tasks, but I'm making good progress so far. That being said, I can't seem to find a way to filter results by Custodian. Is this possible in Tasks? As an workaround, I created tags for each of my custodians, since I figured I could filter by Tag in Tasks. Unfortunately, this is still not quite doing the trick for me. This works well for a single custodian, but the technique fails when I need to filter with a list of custodians (since the Tag filter in Tasks only allows for one tag). I'd appreciate any suggestions for how I might get this to work. Thanks! Bryan -
Thanks so much, Lukasz! In my head, I had replied to this. My apologies that I apparently failed to reply in reality. This is great info and extremely helpful. I'm running an OCR job now and this is giving me the info I need. Thanks again! Bryan
- 2 replies
-
- ocr
- command-line
- (and 4 more)
-
Thanks, Jon. I appreciate the response. Bryan
-
Hi! I would like to auto-tag items via a keyword list--but only if those items do not contain exclusionary keywords. In other words, I want to tag all the items that contain the keywords from List A but *do not* contain the keywords from List B. I know that I can run List B and exclude the results. If I then auto-tag List A, however, all items from List A are tagged, ignoring the exclusion of List B. Does anyone know of a good way get this task done efficiently? I can do this manually by auto-tagging List A, then running List B, and removing the tags of items contained in both lists. The extra steps of this process invite human error, though, so I'd prefer not to have to do it this way. Any advice would be greatly appreciated. Thank you very much! Bryan
-
Hi! I have two questions regarding OCR. First, is there any easy way to keep track of progress and see how many docs remain to be OCRed? I am usually OCRing via a command-line script immediately after processing (using a Task file). The command output simply says "Post-processing", so I don't know how many OCR candidates were identified. I see that files are being created in the following folder in my current case: .\tmp\ocr-service9057841158103284728. It looks like the final OCR results are being placed in the "ocr-results" folder here, so that seems to be a good number as to how many files have been OCRed thus far. I just don't know how many files are still going to be processed. Also, I notice that when OCR finishes, this "ocr-results" folder is immediately deleted. Is there any way to prevent this? I like to keep keep OCR results for future use. Sometimes, we need to ingest new data that contains a lot of duplicates of files already OCRed. It would be fantastic to just be able to import the OCR results for these rather than need to OCR them all over again. I'd appreciate any ideas for the above. Thank you! Bryan
- 2 replies
-
- ocr
- command-line
- (and 4 more)
-
Silent / Quiet / Scripted program installation
Bryan La Rock replied to Bryan La Rock's topic in Intella 10/100/250/Pro
Yup! That did the trick. Thanks so much for the help!! =D Bryan -
Hello! I try to automate the installation of my forensic software using scripts. Is it possible to do a "silent" installation of Intella Pro? Most program installers have a command-line switch along the lines of "install.exe -silent" or "install.exe -quiet" that allow for installation without GUI intervention. I'd love it if Intella has something like this, but I couldn't find anything. Thank you! Bryan