ŁukaszBachman

My pleasure

That should already be the case - see attached image. This modal window is shown when appropriate "How to fix it?" button is clicked.

Hi Adam! Could you ZIP the indexing log files and send those to us? We would like to have a look at them.

Ok, great to hear! We will upload this migration guide here in case anyone else needs it.

Ok, let us know if it happens again.

Did you get the message on our support portal? Can you post your results here?

Hi Adam! We will prepare brief migration guide for you and post it here and in support portal. Process should be fairly simple and should be pretty much about moving the cases data (will be the heavy work) and few config files if you wish to preserve Intella (Connect) settings between the two machines. We will keep you posted so you can start working on it right away.

Could you try this? http://support.microsoft.com/kb/813745

Hmmm first time we are seeing this. Right now I have zero ideas why this one is presented to the end user upon starting Connect. I'll dig around...

Hi Adam! Sadly, Zimbra file formats are not officially supported by Intella and we don't have much experience with it. As I quickly learned it seems that ZDB file format is very closely related to PST (can be identical), but this is not something that should be taken for granted (I believe Zimbra developers are leaving themselves some room for changing the format in future). However, there seems to be some tools available that can theoretically convert ZDB to PSTs so perhaps they take this into account. Could you explain to us what are the tools that your clients were using and how did you extract evidence files from them? My current assumption is that your clients were using Zimbra Desktop (https://www.zimbra.com/products/zimbra-desktop/index.html) to handle their email accounts, and that product produces ZDBs and OSTs files. Then you simply renamed ZDB to PST and pushed it through Intella. Is that the case? Regardless, it looks like you can use scanpst.exe to try fixing not only PSTs and OSTs, but also ZDBs. Did you try that already? Did you try any official migration guides defining how to move from Zimbra to Outlook (if there are any)? Or perhaps other tools which specialize in that? (http://www.softspire.com/zimbra-converter/, disclaimer: DIDNT CHECK MYSELF SO USE AT YOUR OWN RISK) As to the issue with broken taggings as a result of errors while processing problematic OSTs. The best way would be to make use of Case Backup to recover to a stage where case was still working properly. If that is not possible, you could try creating a copy of this case and reindexing evidence without those broken OSTs. Reindexing should preserve taggings, if successful. There is also a "Restore annotations..." action available in Intella Desktop under the "File" menu. Please read instructions provided there carefully. If all of those options fail then please let us know and we will try to figure out some other way of helping you.

Hi Adam! We are currently working on a document which gives more details about Installing Connect on a Windows Server OSes. Would you like to see an early draft and thus become our Beta tester? When it comes to the specs itself, then reading this document is a must read: https://www.vound-software.com/resources/files/Intella%20Technical%20Guide.pdf It will point you out into the best direction when it comes to leveraging CPU, storage and RAM resources to achieve best performance while indexing and delivering cases. The server you've chosen looks OK, IMHO, but I can understand what disk setup comes in as the "default". There is a lot of options there, though, so just make sure to read the document I linked above to choose the best setup for Intella. It's best to turn of AV completely (if possible) when indexing cases, as this can decrease it's speed and lead to some items being blocked for read by Intella (as you pointed out).

Ok, thanks! I'd suggest to wait a bit for the next release of Connect, before committing to this heavily, as the fix we applied already has greatly improved rendering speed of the Location Facet.

Hhmmm, first time we see anything like this. Can you share a screenshot? Does the pop-up block the process of starting Connect?

Ok, I'm glad you were able to work around the issue and get up the speed with your work. We recently had a support ticket about Location Facet doing poorly upon initialization of a structure that contained around 2000 subfolders in it's root folder. Perhaps this is the same problem. Worst case scenario it should cause Browser to fail, but I can't see a reason that it could lead to any more severe problems with a PC, unless browser has crashed the whole system then. This particular problem with Location Facet has been fixed already and will be included in the next release. If you run into the same problem again, then please run Scanpst on this file and if it does not indicate any errors then index it in isolation. Then you can do a review in Desktop and Connect to see if either one of them has any issues with that data. If problem seems "general" then indexing logs could be helpful to us. If you think it's more about a single item, then it's original context (or less sensitive details) will be a helpful insight. In both cases, I suggest opening a ticket in our Support channel and we will analyze this as a bug.

Hard to say - we will check ourselves. Keep in mind, however, that when you create/edit a shared case in TEAM then you provide a username which is then used to determine if user is authorized. If that user won't be granted with proper case access permission, then TEAM won't be able to connect.

Ok, understood. I do suggest trying out the List View for those problematic items. Perhaps loading of those in the Items Table has caused some problems that might be avoided when looking at them in LV. Hard to say though, without logs analysis. Take your time and get back to us whenever you need.

Adam, this is case dashboard tailored to the end user (reviewer), not admin. The goal behind this is to show reviewers the case data but from totally different perspective. It is really mindblowing when you get to see this screen for the first time for the cases you have been working on. Even for us! We primarily want to allow reviewers doing two things: See nice data overview when they start working on a case (biggest contributors to the volume of data set, file type ratio, etc.) Have a fresh insights into what is going on with the case (see how tags are growing in numbers, who has been active and what they did, see how far are they in the reviewing process = a.k.a. the progress widget, etc.) Admin panel will also grow in future, but in this release we wanted to deliver the best tools to our primary group of users, which are reviewers. Your further questions answered: layout customization - we were actually thinking about giving user few layout templates to choose from and render those as blank boxes. Then, user could click on "add widget" and choose what he needs to see. In time he could further change the behavior of each widget (for instance: in tags widget you could only select tags that you wish to see so that "junk" or "irrelevant" tags are not shown) Alert Box widget is aimed to render various kinds of events requiring user attention. We will add some new types of alerts with pretty much every release. For instance, you asked about "shutdown notice" in the other post - I think it would fit here nicely. sorting tags (also requested by you in a separate post) are already on the roadmap for next release. If all goes as planned, you will see them sorted soon Email Address Facet improvements - also, planned It will require some serious changes to this component, so I don't think we will be able to squeeze that in the next release, but I recon it should come soon after. I humbly hope those changes & improvements will satisfy the needs of your organisation.

Hi Adam! As to the duplicated case, I'll investigate it on Monday. I believe that is because two case have the same CASE ID (not the case name). I believe that this could be worked around by changing case id manually in case.xml file, but I'd have to talk to my colleagues to learn if this won't have any negative impact (I think it won't). As to the other issue - seeing JavaScript console logs and case logs could help to analyze what is going on. Which version exactly are you using, by the way? 1.7.3 should load whole page of table results at once (1st request - fetch IDs, 2nd request - fetch all items metadata at once). Does this issue happens with Table View or List View? Did you try if the same happens while using the other view?

Yes, that would certainly help! It looks like one of the events got broken in events log and this is preventing it from being properly read/written. One solution for you might be to delete the old event log file, if you are willing to sacrifice all events stored there (renaming is option in case you need that later). It's called "events.log" and is stored in "audits" folder. We could make this mechanism more robust but we have other plans for replacing it entirely with more advanced auditing tool. So I'll have to look into logs to see if this is just about one event or perhaps more got broken.

Thanks Adam! What would you add/change there? We are planning to add more widgets over time and make the layout customizable. Now that is what I call fun

You have to connect by opening a shared case, not directly. So in case manager please choose: Add > Open a shared case > etc...

Adam, could you search through your logs and look for similar occurrences? [ERROR] 2014-05-22 09:26:40,650 [pool-1-thread-1] Failed to read event of type class com.vound.intella.model.events.UserLoggedInEvent, insufficient or corrupt event data It would be enough to grep for "insufficient or corrupt event data" or "Failed to read event of type class" because other parts will change with each occurrence. After that, can you send me your findings? "

Hi Adam! You are onto something. I am seeing similar issue with my local development environment and one of my cases. I will work on this now to eliminate the issue and get back to you via forum. Again thanks for reporting this!

For those of you who couldn't have been at the CEIC with us this year, we have a little treat :-) Have a look what we've been working on for past months, and busy indeed we've been. Below you'll find an early preview of new layout and case dashboard, but we also have a nice new administrative features and plenty of smaller enhancements. Please let us know what you think!

Hi Adam! Most of your suggestions have been converted to internal tasks. Can't promise which releases will they be included in (as always, matter of available time and other priorities) but I'll definitely want to have sorted tags in next release. Later we will add: admin system notices, double-clicking on facet values, "case currently not shared" messages. You mentioned that it would be good to hide not only tagged items, but also tags themselves when proper permissions are specified. This should already be the case! When implementing this I didn't want other users to see tags which they can't assign or search themselves. So if "privileged" user added a tag called "hidden", then users with limited rights shouldn't see neither this tag nor items tagged with it. Can you check if this is how it works in your case? I also had in mind hiding any sort of activity coming from specified user. That would allow for regular user not seeing any review outcome coming from "Super User". That would be lots of work, though, so I'm not sure if this would be even useful in your case? Also you wanted to connect with TEAM to a case hosted by Connect. I am not sure now if this was just about indexing additional sources and merging cases, but if your question was more about doing a parallel review with Connect and TEAM simultaneously then we have good news - this is already possible! In fact, we are often testing Connect with browsers and TEAM instances at the same time. There are some caveats to this cooperation (like TEAM not fully respecting RBAC model yet), but this shouldn't be a big problem. It won't work other way around, though, so cases shared with TEAM can be only accessed by TEAM reviewers.