Jump to content

ŁukaszBachman

Administrators
  • Posts

    353
  • Joined

  • Last visited

  • Days Won

    18

Everything posted by ŁukaszBachman

  1. Hi jmacedo, When creating batches and using "Keep items from same family together" Intella Connect will do two things: Detect items belonging to the same family and make sure they end up in the same batch Sort items by "Family date" and make sure all batches and items inside them are sorted in a chronological order When families are being detected Connect will traverse item's location upwards in the hierarchy tree and find family root. Any two items with the same family root end up in the same Family. When determining family root these items are ignored: folders email containers (like PST and such) disk images forensic containers registry artifacts The 2nd step with sorting guarantees to you that batches and items inside them are ordered chronologically when you are reviewing them. Ex. last item in "batch 1" is from January 31st and first item in "batch 2" is from February 1st. However, to guarantee that items are sorted properly batch size can be extended to accomodate items from other families if they happen to have a date which falls within the timeframe of a batch. This can make batches larger, but is sometimes more convenient for reviewing purposes. It is up to you which option you prefer to use. If you see that a batch is too large I suggest start investigation with identifying item's family roots and take it from there.
  2. Hi jmacedo, Accurate time tracking spent on a review is currently not possible, however we have this feature request on our radar and we may add it in one of future releases. Closing/opening/signing in/signing out events are tracked by Intella and are available in event logs (Intella) and activities stream (Intella Connect).
  3. @Adam, looks like you were able to change your photo after all. Good it worked for you in the end. I also tried it and it seems to be OK now.
  4. Hi KTD3287, can you elaborate on your latest question?
  5. Yes, that's closer to solution that I would have in my mind. I am just wondering if we should be separating this entirely (so coding wouldn't use tags at all, it would rather be more similar to assigning custodians) which implies that changing tags in Previewer won't affect coding decision (and vice versa). Or maybe simply offer an alternative where "Coding Tags" facet would list those tags which are also used in Coding Layouts (for easier querying). Both have ins and outs. What do you think?
  6. One should be careful when setting up batches this way - batch will not filter out privileged items but rather it will not load at all. One should make sure not to put restricted items into batches before it's handed out for a review.
  7. Hi Adam, Please forgive me, but this looks complicated. I had to go back and re-read the entire post few times and I think I still fail to see what exactly we are solving here. I understand that mixing standard tags and the ones used for coding can be problematic and we could figure out something to address this better. But the proposed 'Review Code Tags' seems to try to pack everything (joining batches, reviewing, filtering by tags, filtering by users) in one UI that mimics standard review UI. Isn't that mixing ideas of Quality Assurance and exporting together? Surely it wouldn't be allowed for all users, but nevertheless that feature would require a lot of expert knowledge to be used correctly. Can you help me to get to the bottom of this by making a step backward and explaining the original issues with exporting? It seems to me that you are doing a QA here too, but I'd like to know more about it.
  8. Hi Adam! We already had plans for allowing to sort batches by creation and completion dates (separately). I suspect that this should be added in a near future (next or subsequent version). You have a good idea with the "archived folder" here. I'll think if "folders" could actually become more useful way of organizing batches rather than a list. If not, I'll make sure to address the need of making archived batches disappear from the main view. I suspect both improvements will be applied in the same version. Thanks for good suggestions!
  9. Hi Adam! Thanks for your feedback. This feature has already been on our radar for quite some time, but we haven't implemented it yet. I'll add your feedback to out internal records so that it doesn't get lost. Are there any other extensions you could think off that would be handy?
  10. Hi Fuzed, Have you seen before the Intella Connect user manual, section "9. Setting up HTTPS"? This has been recently added to the documentation and shows how take existing certificate and build new Keystore out of it, but it also gives some important insights on how this works in general. When dealing with Keystores it's important to know that each Keystore can have 0 or more private-public key pairs. It seems that your Keystore is missing the private key, but I'm not sure why. Have you been creating a new Keystore or did you try to update the certificate in existing Keystore? The crucial part is - your Keystore must contain the private-public keys pair that was used generate the CSR. Let me know if this helps a bit.
  11. Hi Emily, It's true that batches are locked from editing once completed, but you still have some options to change the coding. Those depends on how many items are required to be updated. If it's just a handful of items from the batch, then I suggest you simply open those items in Previewer and modify tags manually. Since each coding field is mapped to a tag, then changing a tag will essentially change which option from a coding field is applied. It's very easy to alter any mistakes that way. On the other hand if entire batch requires review, then you can do the following: Search for items in that batch using "Query for items" button (results will show in main search UI). Remove all tags that are a part of the coding layout from those items. Select all items and choose "Create batches" from right-click menu. Select the same coding layout as originally used and create the batch. You will now have a batch with status "New" and you can review it from scratch. Essential step here is step 2, as without clearing the tags previously applied our batch creation mechanism would set the status to 100% complete right after batch is created. I hope that helps.
  12. Hi Adam! Indeed it's not exactly a trivial feature to add. We have such feature on our long-term road map, but before we get to that point in time, maybe you would have some luck with the "Index new data" feature? You could try "Stopping" your indexing process and when the time is right make use of the aforementioned option. It should scan all sources in search of new evidence items and process the ones which haven't been processed yet. Depending on the nature of the source and where you have stopped the original indexing task it can take less time than full re-indexing of the entire case. Of course it would be good to give it a try on some test cases and compare the outcome.
  13. Hi Ken, We are uncertain yet. The thing about those features is that they all need additional room in the UI. We have some larger plans about UI rearrangements in the main Search UI, so that would have to be addressed first. I'm hoping that we will start working on this in next major release, but the roadmap for it hasn't been decided upon yet. If you were to chose just one of the three features, which one would you pick?
  14. Hi Ken! Those feature are not yet implemented in Intella Connect (basic version of Histogram has been added to the Insight Dashboard in Connect 2.0). All of them are high on our priorities list though.
  15. Hi Adam, We do have something like that in our plans. It just needs to wait until we find some time to implement more enhancements in the Review UI.
  16. Yes, Connect behaves the same in this regard. However note that adding more crawlers does not mean that you will immediately see all cores being occupied while reviewing your case. This mechanism is used only in few certain processes, like Jon pointed out in this article.
  17. Hi jcoyne, Yes, cases should be automatically unshared gracefully when you shut down the IntellaConnect service.
  18. Hi Rob, I completely agree. We have plans to make this UI more flexible (with collapsible panels: Facets, Cluster Map, etc.) and fully resizable (user could choose how many space is assigned to each component). This is not a quick fix, though, so it will require some time to get it right. However we'll do our best to offer some incremental improvements in future versions of Intella Connect.
  19. Generally speaking error code 500 means that something unexpected has happened. I must say contacting support is not usually needed. Very often it's enough to open case logs and see if the exception logged there is not something that user can work out himself. Sometimes it's something as simple as temporary I/O error happening on USB or network disks. In that case refreshing web browser tab might help immediately. If however this happens every time it's best to open a ticket in our support portal.
  20. Hi heffner, AdamS, I tried to understand some comments that you made but I'm struggling to understand what it is you want to achieve. Let me draw a simple test scenario here and please tell me when my reasoning is not matching your expectations. Let's say that my case is composed of a single data source which is a folder with a set of loose PDFs, like: D:\evidence\sample1.pdf -> Item with ID 2 D:\evidence\sample2.pdf -> Item with ID 4 Both contain scanned invoices, so I want to OCR them so they become searchable. I index my case and I end up with few items in my case (5 if I'm counting right). So I export my two PDFs (item #2 & item 4) to another folder and use external OCR to get their corresponding textual content in separate TXT files. Then I make use of "Import OCRed text" feature (NOT indexing the TXT files!) and end up with the same number of items in my case, but #2 and #4 have been appended with additional text content visible and searchable. Few things to notice here: Original evidence files (PDFs) have not been modified OCRed text is appended to the existing text of those items. My PDFs did not have any text in them before (scanned invoices) so everything that got OCRed will become a new content of these items (otherwise previous & extracted text would be merged together). No additional items are added in my case, so we still end up with 5 items in it. @heffner, let me address the two disadvantages you brought up > Opening an "original" PDF will not include the text data from the OCR process I'm not sure what do you mean by "Opening" here. Opening in Intella? If so then you will surely see OCRed text in Previewer. It's also searchable, so it seems to me that you ought to have anything that you need. Indeed the original PDFs in D:\evidence folder have not been modified, but I doubt that any software used in legal cases would do that. > Reindexing the Case means loosing all imported OCR texts Yes, that is correct. It's how we designed this process for a mix of technical and non-technical reasons. Is that something that becomes a serious challenge for you? Please note that Tags are surviving reindexing of cases, so if you ever find yourself in a situation that you need to reindex a case containing OCRed items, you can make use of them to achieve consistent results. @AdamS, I couldn't understand your remarks about duplicates. Going back to my example, if you had 2 PDFs in evidence folder, then after importing OCRed text then you still have two. No additional items are created. Therefore there are no multiple representations of the same item. If you would index OCRed TXT documents, or even PDFs with OCRed text that might be produced by an OCR software, then hashes won't likely match because the binary contents of these files are different. I wasn't sure what your intention was here, hence my humble ask for clarification. Thanks, Łukasz
  21. Hi! We are planning to have this improved as much as possible in 1.9.2 (which is around the corner). This of course is purely about improved rendering of calendar entries. No work has been done in this area yet, though, so the final outcome will depend on the complexity of data and if there is some nice unified layout that covers most formats. Feel free to share your ideas about this if you want us to consider those during the design process.
  22. Appreciated Adam! I'm hoping others will find this useful.
  23. We are expecting it to be announced in a few weeks, but no concrete date yet.
  24. Hi jcoyne! The situation you are describing were sometimes happening in previous versions of Intella Connect when user had been inactive for roughly 2 hours. Refreshing of results was always helping to make the review queue navigable again. That has been greatly improved in Intella Connect 1.9.2. Can you let me know which version are you using? It shouldn't have anything to do of what happens to items during this time. When you are reviewing items using Previewer the review queue stays fixed as soon as you open first item. At this point in time items are already organized in a review queue which respects sorting and filtering applied in the main search UI. Intella Connect will no longer modify this queue.
×
×
  • Create New...