Chris

Hello Tyson, Thank you for your suggestion, we always welcome those. The default set of date attributes that are being searched have been chosen so that it matches best with the most common use cases that we witness with our customers - which can vary wildly. To educate users that not all fields are searched by default, we decided to show the full list of date fields in the Date facet, rather than in a more hidden place. Changing the defaults may upset users who have grown accustomed to how it works now. An indicator for the number of date fields that are being searched (e.g. a line reading "using 2 out of 12 fields") could be an option though.

Hello Adam, Yes, this makes perfect sense!

It appears to me that Adam's workflow is indeed the best solution for making sure that the Relevant and Non-Relevant sets don't overlap: only tag duplicates but not families during review, and use a combination of Show top-level parent and Show Children to determine the family items of one of these sets at a later point in time. Doing this Show Parent + Show Children procedure on both the Relevant and Non-Relevant sets will still result in them overlapping though. I think that "Relevant beats Non-Relevant", so you can use the Cluster Map to see the overlap between these two tags and remove the Non-Relevant tag from those items that have both tags.

Hello all, Above are two feature improvements that make a lot of sense to me: showing the cumulative size of selected items in the table and exporting the timeline to something that can be viewed and manipulated in a web browser. Both ideas made it into the ticket system (where we keep track of our development tasks) a long time ago. The only reason they are not there yet is time: we simply have a very long list of great additions we could make and we need to make hard choices. We apologize for the long wait. Please know that chances of ideas getting implemented increase considerably when more people ask for it. The cumulative size procedure has been asked for by several users and has now been planned for the 1.9 release, which is scheduled for early summer. Note though that that is an expectation, not a promise! For the exported timeline we don't have any concrete plans yet, but as said that can change when more people ask for this.

Thanks Adam, both ideas make sense to me! I'm making a note of it.

Hello Mark, I think this question is best handled by a support ticket, so that we can talk privately about your setup. Please also provide screenshots of the error that you get.

Hello Phil, Thank you for the sample and additional info, I now fully see what you mean. We are forming plans for showing elaborate keyword statistics. so this is perfect input. At the moment I am not able yet when and how we will implement this, but please know that we do see the value of the improvements that you suggest.

Hello Jason, Yes, the number of cores will be of no difference. If you see any significant disk usage, you may consider looking at the amount of RAM (more RAM means more space for disk caching), but again I don't expect that things will improve much for single document conversions, which I suspect are CPU-bound and largely single-threaded. At the moment we are not yet working on this pre-caching, but as soon as we are, we will keep you in mind!

Hello Jason, There have indeed been some changes: since version 1.8 Word documents are no longer converted to PDF using MS Office, and since version 1.8.1 MS Office is also no longer used for spreadsheets and presentations. The conversions to PDF still take place but are now handled by components that are build into Intella Connect. This change has a lot of benefits: besides the reduced system dependencies the PDFs are of better quality, e.g. they can now show any change tracking, the mapping from spreadsheets to a paginated format looks better, etc. This change also means that we got rid of a lot of potential support issues, e.g. invoking MS Office from Connect when it is running as a Windows service is more or less impossible. It is true that the new conversion libraries are a bit slower in generating the PDFs than MS Office. We are looking into ways in which we can improve this. At the moment there is no tweaking that you can do, other than making sure you have an adequate machine - also see this post: http://community.vound-software.com/index.php?/topic/267-connect-hardware-requirements/?p=1334 One feature enhancement that we are considering and that would take away this problem entirely is by letting the case creator/admins pre-generate the PDFs. This would make the PDFs instantaneously available and also improve exporting speed. What do you think about that?

Vound is pleased to announce the official release of Intella, Intella TEAM and Intella Connect 1.8.4. Intella and Intella Connect 1.8.4 are available from the Downloads section in the Vound Support Portal, after logging in with your email address and password. Please read the release notes before installing or upgrading to ensure you do not affect any active cases. Users with a 1.7 license need to use the Dongle Manager to update their dongle to the 1.8 license. Highlights Tags can now be ordered in a tag hierarchy. Improved tagging speed with a factor 2-3. Tags can now be applied using a keyword list. Improved OCR importing speed, typically over ten times faster. Improved PDF and load file exporting speed, up to two times faster. Added interactive load file validation when adding load files to a case. Various stability fixes. ... and many more. For full details and upgrade notes see the Intella and Intella Connect release notes.

Hello Phil, Thank you for this detailed and thorough description. I have been playing for some ideas on keyword search statistics for some time now and your list lets me refine and generalize that. I would love to see some samples! When you type a reply, there is a "More Reply Options" that takes you to a more advanced editor that allows for attaching files beneath the reply text. Do you see these buttons? If not, I will take this up with the admins, perhaps it's a message board configuration issue...

FYI, Abbyy 4 support will be included in Intella 1.8.4, which should become available next week.

Hello Adam, In our test data, obtained from a variety of sources, we see this happen quite often. Note that it could also be the sender of the email that is causing this, not necessary the Outlook instance on the receiving side. When in doubt, check the Headers and Raw Data tabs, as it shows on a lower level what has been extracted from Outlook. You can use it to distinguish between "Intella can't parse the value" vs. "the PST does not hold the value".

The procedure would be to query for all and folders, selecting all results and deduplicating the results table. Unfortunately you have to select these folders for every individual PST file in the Location tree; there is no category in the Features facet (yet) that leads you to all recovered or orphaned items.

Hi Adam, That is correct, Connect will then be able to handle indexing by itself.

Vound is pleased to announce the official release of Intella, Intella TEAM and Intella Connect 1.8.3. Intella and Intella Connect 1.8.3 are available from the Downloads section in the Vound Support Portal, after logging in with your email address and password. Please read the release notes before installing or upgrading to ensure you do not affect any active cases. Users with a 1.7 license need to use the Dongle Manager to update their dongle to the 1.8 license. Highlights Ability to natively view HTML email messages and export them to PDF. Added command-line support for creating cases, indexing evidence files and running various tasks. Many improvements to cellphone report indexing. Added a Chat Account facet. Performance improvements for viewing large documents and concurrent access. Extended the permission scheme with several admin permissions (Intella Connect only). ... and many more. For full details and upgrade notes see the Intella and Intella Connect release notes.

Hello Mark, Such improvements are indeed on our roadmap. Once we have defined a form of "reviewer work package", such statistics are a natural addition.

Can you elaborate on what stripping the milliseconds achieves? I can understand comparing date attributes and allowing for some minor variances, but the Date header is sent by the sending side and should be transmitted as-is to the receiving side. I.e., we're not comparing Date and Received headers here. Also all mail formats that we support store the SMTP headers in full; the Date is not recreated from some database-internal value. Therefore, a different Date header looks to me as a strong indication that something/someone has altered the message during transmission or in storage.

Hello all, Thank you all for your insights! Some ideas I am taking from this: It is certainly possible to make the message hash algorithm configurable, e.g. as a list of "ingredients" that you can choose from: From/Sender/To/Cc/Bcc/Date/Subject/body/attachments. This would probably be our first step towards better deduplication. We can allow for optionally reducing the precision of the date. It's interesting to see that some want to leave the body out while others want to base it only on the body - I have heard both variants before. Someone also once suggested to me to only use the Message-ID header for the hashing. I like the idea of Smart Search using the new paragraph search functionality. Below the surface paragraph analysis essentially calculates a hash for each paragraph. These go into a database, enabling quick searching for other occurrences of that paragraph in the case. Smart Search could look at documents with the same set of paragraphs (= same hashes), ordered by how many paragraphs are in common, or even apply a tf.idf-like weighing mechanism: a paragraph that occurs less often (e.g. the core topic discussed in an email thread) is more likely to be important than paragraphs occurring more often (e.g. email signatures). Using Smart Search and/or Show Conversation to partition the case into logical subsets could indeed reduce the workload. This is not entirely trivial. I believe that Show Conversation essentially turns the case into buckets (each email is part of at most one conversation, or is part of the "others" category), but Smart Search produces many overlapping sets: a smart search on item A may produce item B, item B may produce item C, but item A does not necessarily produce C as well. This makes using Smart Search for partitioning the case upfront tricky - but not impossible.

Hello Mark, Very interesting idea! The current deduplication should take out the duplicates of the individual mails, but it's unpredictable which occurrences of those mails are selected. That can indeed be improved.

Hello all, From our side, I can say that we are using a software library for PST/OST access that from the ground up has been developed by forensic experts and for the purpose of forensic analysis. I suspect the way it works will be very similar to ScanPST, in that it scans the entire file for messages, incl. messages that are not linked from any indices, to improve the chance of reporting 100% of the messages when the file is corrupt. Though ScanPST has the benefit of being the Outlook vendor's own tool, it is designed for email recovery, not forensic analysis. I can imagine (never tested this myself) that this could give issues with e.g. PST-specific metadata like email creation dates. What are your experiences with that? I will ask our developer most knowledgeable on this subject matter to comment on our code, e.g. explain the exact difference between recovered and orphaned mails, but he's on leave now. Be the way, I can think of two ways why ScanPST would increase the file size: PST files grow in chunks, so perhaps ScanPST allocated a lot more space and may only have used a little of it. I have been told that a PST/OST file contains several indices for fast access to the mails. Perhaps some of these were missing in the corrupt file and were rebuild from the others or from the entire list of emails. In both cases the PST can be significantly bigger without Intella or ScanPST reporting any more messages.

Hello Jason, Thank you for your request. I completely understand your need for this. I will pass it on to the Connect developer team. FYI, we are already working on several new permissions: An "admin" permission, so a specific user can be given admin rights. This way there is no need to share the admin account among people and the admin actions can be logged in a better way, for auditing purposes. A "case manager" permission, so you can control who can create and manage cases without giving them the option to control the entire system. Any ideas for other permissions are most welcome!

Hello Simon, No, the information that Intella uses for its Features facet is obtained from its databases. This audit CSV file is only an extra place where it is stored - for easy auditing purposes. I can see how the ability to clear this information makes sense for an admin, so I will make a note of it.

Hello Mark, We have seen the same bottlenecks and are already working on a number of improvements for Intella Connect 1.8.3. There will be improvements in loading items with large texts (e.g. multi-MB CSV files and larger). Their length in general is a consideration and when hit highlighting needs to be performed on the document text, this only adds to the cost. Note that hit highlighting is not only used in the Previewer but also in the List view. Furthermore we are improving Connect's performance on serving concurrent users: if a reviewer views such "costly" items, other reviewers can see a drop in performance too, even if they are viewing non-costly items. We strive to improve the performance experienced by these other reviewers. There is one setting in Intella Connect 1.8.2 that you can already use now to improve performance: if you use the List view but don't mind loosing hit highlighting here, you can click on the Settings button in this view and select not to see any hit highlighting here (see the attached images). When opening the item, the document text will still have its hits highlighted, i.e. this only affects the results listing.

As you can see in another sticky thread, I have just put Intella 1.8.2 online. This release has a number of features that I know people in this thread and on this forum have asked for: See the number of selected items in the Table, List and Thumbnails views (no cumulative data size yet though). "Check / uncheck all" button in the Add Tags and Remove Tags dialogs. Auto-complete in the Add Tags dialog: type in part of the name of the tag and the list of existing tags gets filtered to those that start with the entered text. When a keyword list contains an invalid query, report the problematic line(s). More tagging enhancements are being worked on (we're looking into hierarchical tags, custodian-related functionality, etc.) but they were not ready for prime time yet. If you have some ideas for tagging improvements, now is the time to share them!