Jump to content

Bryan La Rock

Members
  • Posts

    22
  • Joined

  • Last visited

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

Bryan La Rock's Achievements

Newbie

Newbie (1/14)

0

Reputation

  1. Hi Jason, Thank you so much for your answer. My apologies for the extreme tardiness of my reply. Things got a little crazy after that post, and I never managed to get back here. Actually, I've tried the method you mentioned (see my original post). I've just tested this again using Intella Pro 2.3, and the button still does not seem to function correctly. I am given the warning prompt to confirm deletion, but nothing seems to happen whether I click "Yes" or "No. In the screenshot below, I am attempting to delete export set "Elluma-P01 - Initial Mailbox Upload": Perhaps case corruption is to blame? Have you been able to get this functionality to work on your data sets? Thank you so much, and again, sorry for the long delay! Best wishes, Bryan
  2. As an update, here is the technique I used to deal with this. I don't think this is quite ideal, but it seems to have worked reasonably well in this case: For all Top-Level Parent emails, I exported the following fields to a CSV file: DocID Subject Sent Attachments From To CC BCC Conversation Index Using Excel, I identified all emails that contained the exact same values for ALL of the fields in red above. Using a spot check, I confirmed that the resulting documents indeed appeared to all be duplicates. Note this technique does not actually compare the email bodies. A better technique would certainly consider the bodies as well. Bryan
  3. Hello! My apologies if this has already been address, but I could not find it through search. I am dealing with MST Exchange emails. The emails contain a mix of standard SMTP email address as well as Exchange X.400-style addresses. De-duplication becomes a big problem here. Emails that are otherwise identical have different message hashes when one email has the SMTP address and another email has an X-400-style address. Is there any way currently to de-duplicate these? I know that as of the latest version of Intella, you can configure Message Hash to ignore certain attributes (including headers and recipients). This should work, but I'd really like to have more fine-tuned control than this. Ideally, it would be amazing if Intella could intelligently recognize that two emails are identical even if they use a mix of SMTP and X.400-style addresses. From my experience, this issue is very common in dealing with Exchange exports. Any thoughts would be greatly appreciated. Thank you! Bryan
  4. Hello! I'm working on a privilege keyword search for a client. The client has requested that I search for emails to/from their attorney. This part is easy enough to implement. Here's the hard part: The client has requested that I exclude items in which privilege may have been waived by CCing another person. In other words, if the client communicated with their attorney but also CCed someone else, we don't want that search result to be returned. Ideally, it would be great to craft a search something like this: (from:attorney@lawfirm.com OR to:attorney@lawfirm.com) AND NOT cc:[anyone other than attorney@lawfirm.com] Of course, that's not a valid search, and I don't think that such functionality exists. The only way I think this can be done in Intella is as follows: Run the basic search: (from:attorney@lawfirm.com OR to:attorney@lawfirm.com) and select the resulting bubble Review the Email Addresses Facet and look for any CC (or possibly other) addresses OTHER THAN attorney@lawfirm.com Remove these items from the results I believe the above should work, but I'd love to know if there is a better way to do this. Thank you! Bryan
  5. Hello! Is there a way to delete (or rename) an Export Set? I have a case in which I created an Export Set with some error in it. Unfortunately, when I fixed the errors, I created a new Export Set with the same name as the bad Export Set. It is really confusing to have both of these in the same case, so I'd like to delete the bad one (or rename it). I see that there exists a button to "remove" an Export Set from the Export menu. This button doesn't seem to actually do anything, though. Perhaps this hasn't actually been implemented? Thank you! Bryan
  6. Hey Jon! Thanks for the reply. I definitely will keep my fingers crossed for this one, as it would make life a lot easier for me. Thank you again! Bryan
  7. Hi! I know that Intella has "Show Duplicates" functionality, but this only seems to work for a single item. In many case, I'd like to be able to select a group of items and then see those items and all of their duplicates. Is there any current way to do this easily in Intella? I currently use the following workaround: I select the group of items, select "Add Tags", and then use the tagging option to apply the tag duplicates. This works, but it is not convenient. It also leaves me with a tag that I frequently need to go delete afterward. Thank you so much! Bryan
  8. Hey Jon! Thanks for the suggestion. I actually did consider this (and I probably should have mentioned this in my original post). The problem is that I have a lot of other criteria in addition to the custodians for these searches. There are keyword searches and date ranges as well. Therefore, I need to keep the overall logic to "match all" as opposed to "match any". If I add multiple custodian tags, this will break the search. Ideally, it would be best if Custodian were an option in Tasks (with the ability to select one or more custodians). It would also be fantastic if Tasks allowed you to create logical groups of nested AND/OR conditions for situations like this. That being said, do you have any other suggestions? For this case, I ended up creating tags for groups of custodians. This allowed me to use the Tag option in Tasks to search multiple custodians at once. This is not a good solution, though, as it requires quite a bit of extra work to set up the custodian groups. Thanks again! Bryan
  9. Hi! I'm fairly new to automation through Tasks, but I'm making good progress so far. That being said, I can't seem to find a way to filter results by Custodian. Is this possible in Tasks? As an workaround, I created tags for each of my custodians, since I figured I could filter by Tag in Tasks. Unfortunately, this is still not quite doing the trick for me. This works well for a single custodian, but the technique fails when I need to filter with a list of custodians (since the Tag filter in Tasks only allows for one tag). I'd appreciate any suggestions for how I might get this to work. Thanks! Bryan
  10. Thanks so much, Lukasz! In my head, I had replied to this. My apologies that I apparently failed to reply in reality. This is great info and extremely helpful. I'm running an OCR job now and this is giving me the info I need. Thanks again! Bryan
  11. Thanks, Jon. I appreciate the response. Bryan
  12. Hi! I would like to auto-tag items via a keyword list--but only if those items do not contain exclusionary keywords. In other words, I want to tag all the items that contain the keywords from List A but *do not* contain the keywords from List B. I know that I can run List B and exclude the results. If I then auto-tag List A, however, all items from List A are tagged, ignoring the exclusion of List B. Does anyone know of a good way get this task done efficiently? I can do this manually by auto-tagging List A, then running List B, and removing the tags of items contained in both lists. The extra steps of this process invite human error, though, so I'd prefer not to have to do it this way. Any advice would be greatly appreciated. Thank you very much! Bryan
  13. Hi! I have two questions regarding OCR. First, is there any easy way to keep track of progress and see how many docs remain to be OCRed? I am usually OCRing via a command-line script immediately after processing (using a Task file). The command output simply says "Post-processing", so I don't know how many OCR candidates were identified. I see that files are being created in the following folder in my current case: .\tmp\ocr-service9057841158103284728. It looks like the final OCR results are being placed in the "ocr-results" folder here, so that seems to be a good number as to how many files have been OCRed thus far. I just don't know how many files are still going to be processed. Also, I notice that when OCR finishes, this "ocr-results" folder is immediately deleted. Is there any way to prevent this? I like to keep keep OCR results for future use. Sometimes, we need to ingest new data that contains a lot of duplicates of files already OCRed. It would be fantastic to just be able to import the OCR results for these rather than need to OCR them all over again. I'd appreciate any ideas for the above. Thank you! Bryan
  14. Yup! That did the trick. Thanks so much for the help!! =D Bryan
  15. Hello! I try to automate the installation of my forensic software using scripts. Is it possible to do a "silent" installation of Intella Pro? Most program installers have a command-line switch along the lines of "install.exe -silent" or "install.exe -quiet" that allow for installation without GUI intervention. I'd love it if Intella has something like this, but I couldn't find anything. Thank you! Bryan
×
×
  • Create New...