AdamS

Looks very nice, something I've been eagerly awaiting

The keyword list is very useful to use and somewhat easier (I've found) than trying to compile the AND OR search strings which I always seem to mess up. Excluding footers will be fantastic and something that will immediately increase the accuracy of any keyword searches.

Hi Lukasz, the improved email thread reviewing you mention above, is this referring to being able to select a single email, then quickly determine if there are any forward, CC or BCC that relate to the same email? One minor improvement I'd love to see for Connect is the ability to restrict certain users from downloading content (exporting) without restricting their ability to review pictures etc. This is a bandwidth control issue more than anything, as I don't want my clients to set up an export of 100,000 emails and attachments which would effectively bottleneck my server bandwidth for many hours. More to follow.

Thanks Lukasz, I have access, but note there was no link for the 32bit version of connect, only the x64. I generally use the x64 but would be handy to have both just in case a future windows update or other conflict makes the x64 unstable.

Would be great if you could put a sticky up the top with the latest version details, same as you have for Intella Also, I can't see the connect update installers when I log in to the update site, could someone please check my profile access.

The list looks great, I would add under the simple stats area total number of emails (deduped and non). I would also agree with dougee and add that the more customization can be worked in the better, as our needs are going to change depending on the focus of each job. When you say 'reviewer' related stats are you talking about the reviewer users that make up part of the TEAM license usage, or is this based on the user account of the computer? I only ask as when I open a case there is no way to really tell who is working on the case as all changes are written against the name that was used when the case was set up. If you are looking at including some of these auditing type capabilities then it might be a good idea to have a window prompt at every Intella start up, simply asking for a user name. This needn't be an authorized user situation (although it could be expanded to that later if needed) but just to give us a chance to quickly type in our name so the audit trail will accurately reflect who is doing what.

First bit of customer driven feedback, sadly it's not a technical issue. The ability to limit a user account access based on time and/or date. Let's say we want to give our user Bill access to a particular case but only for 40 hours of actual log in time (hence the need to log both log on and log off events), or we only want Bill to be able to access the case until the 10th of October. This is more from a sales perspective as it gives us some options for clients who may want to access the data only for a few hours at a time but over a long period, as opposed to clients who are time critical (lawyers) and may be able to have multiple people over a relatively short period of time.

Jerry I think that would be a great feature to add to the wishlist The ability to load up a case, exclude certain items, then create a new case which can be saved off and that contains all the relevant data so that it can be loaded up into Intella and then be examined as if it's a complete case. This would satisfy any forensic soundness questions and be a much better method than what we currently have to do when excluding LLP material. Is this on the roadmap for Intella?

Thanks Lukasz, and is IP address of computer connecting something that can be included in the Activity stream and any logs? I'm hopefully going live on this with two clients in the next week so I'll no doubt have some client based feedback coming through soon as well.

Surely you've heard that one before? (Problem In Chair, Not In Computer), also known as PEBCAC error (Problem Exists Between Chair And Computer)

A couple more Log out / disconnect activity doesn't appear to be logged in the activity stream It would be nice to have the IP address logged in the activity stream as well as the user name (would assist in identifying if log in credentials are being shared around Some auditing capabilities would be good too, but I imagine much lower priority: Ability to produce a 'by user' report detailing date/times of log in or log off events Total time spent reviewing/tagging etc List of documents reviewed/tagged

I create a user "bob" and assign him a password. Bob then gives those credentials to half his office to help him review the 10,000 emails. They all log in at the same time, my computer freezes up and my network slows to a crawl because 20 people are all accessing at the same time. I can certainly access a shared case on my internal network from several different computers at the same time with the same user credentials. From an access control point of view I don't want this to be able to happen, single user, single credentials. I have no problem with other people using the credentials to assist, however we need to be able to control the amount of actual connections to my computer otherwise we are going to have bandwidth and performance issues. Hence if Connect will only allow a single instance of each username to connect at the same time then we have greater access control.

Thanks Lukasz, it does indeed function as described, this was a PICNIC error. The only difference was that I was trying to search within a set of tagged items, my problem was that I picked a small set to test on and the search word I was using simply didn't appear in any of the tagged emails, so when I "included" the tag the number in the ball didn't change. If I pick a word that actually exists somewhere in the tagged items then I have it working as required.

I'm not sure if I'm missing a step here, I seem to have problems getting my head around search sometimes. I log into a connect case and I'm trying to isolate emails within a tag list that have a keyword. I select the tag I'm interested in from the 'type' list, highlight and select include. then enter the keyword and search. I end up with the total list of keywords, ie not just from within the tags that I've selected to include. The same happens if I reverse and include the keyword then search by the tag.

I'm assuming some of these will already be in the pipeline for the next release but I'm just starting to offer this to clients so thought I'd get in early with suggestions. Ability to dictate which users can access which cases (in case user puts in wrong port number they may inadvertently be able to access another case which is being shared at the same time). Ability to set time limit by date for user accounts to be active (assists overall control issues) Lock accounts so only one instance can be used at a time (stops multiple users all logging in at the same time with same credentials) Lock down on the ability to download data (ie set review and tag only) Add query or help capability. ie if a user is reviewing a particular file or email the ability to tag that file for a query, then type in a question which will auto generate an email to a predefined email address with a reference number and enough information to ID the file the question is about. Not only would this feature save our time answering phone calls for sometimes basic questions, it would allow an audit trail of support for a particular case, and it would also allow clients in different time zones to ensure the question can get to where it needs to go. I'm sure there will be more to come.

Jerry this is something I've been talking about with regards to keywords and having custom fields for the reports. http://community.vound-software.com/index.php?/topic/87-add-fields-to-reports/ My short term solution has been to make use of the custom naming convention and have the files named to show the keywords (000001 Tags = keyword.eml), you can have numerous other things in the name but to avoid LFN problems I try and keep it as short as possible. That way the unique number identifies every email with the keywords easily visible. The reports will give all the other relevant details to assist with further review.

Not as it stands at the moment. The only way I could think of doing this would involve another piece of software, namely Xways forensics. For example: Obtain disc image in normal fashion, import data into Intella for LLP review, have all the LLP data tagged Create hash set with Intella of LLP material only and export hash set Import hash set into Xways forensics, load up original disc image Run has comparison to locate all identified LLP material, exclude and completely remove these items from the snapshot (if you are unfamiliar with Xways then this will make no sense to you) Then you can create a new data set from the resulting files for setting up a new Intella case, basically export exactly what you did initially and exclude the LLP data which you have hidden and removed already. Xways also has the ability to make 'skeleton' disc images which would also work but there are some complications you will come across particularly if some of the LLP files reside inside archives such as PST's. In those cases you may have to create new PST's after the LLP material has been removed. Forensically that will be a nightmare but as long as all the individual files are hashed you will be able to show they are true copies.....but either way it's a headache. You could achieve the same thing with EnCase or FTK, I don't know the steps as I haven't used them in some time but I'm sure you can import the hash set, ID the LLP files, and then simply extract out all the other files for your "Intella data set" which should now be LLP free.

Nice one, thanks Lukasz I'll have a go at that shortly

Thanks Lukasz, you are correct in that I was referring to the column which lists the URL's, the heading is "Native", I was mistakenly thinking these were hyperlinks as they detail the path to the file stored in the 'original folder' which is created as part of the report process. The only way I knew of turning that into a hyperlink to the file was to right click on each file individually, select hyperlink and then manually navigate to the file. I'm not overly skilled at Excel so when I have a few minutes I'll see if I can use that process to create a new hyperlink column. Could I just use the existing URL column and add a prefix to each line? I'm looking for a semi automated process where I create one prefix or one formula, then copy and apply to an entire column.

I did notice on a recent job that playing around with the order of applying certain information can have a drastic effect on how quickly the results are shown. For example if I selected the location and types and used the "include" option, then went to keywords and highlighted all and hit "search" then depending on the amount of keywords it sometimes froze or took a very long time. However if used the 'include' option for all the keywords and the types, then used location as the search option the results were available much faster, almost instantly in some of the smaller keyword lists. This may not be something that will always happen but for whatever reason this is what happened to me. I made a thread about something very similar a few days back here http://community.vound-software.com/index.php?/topic/86-freezing-issue/

Thanks Chris, much appreciated

Thanks Chris, I'm more than happy to email you an example if you like. I have a test report created from an old phone of mine which had been properly sanitized first

You are correct if I choose to export to PDF instead of original format I can have a single PDF document which include the body of each email.....but it is not an elegant solution. Maybe for a few emails you could work with it but for many thousands of emails it is not ideal. In addition there is no way to really work within the document by way of sorting or isoloating key area's. PDF I've always found is great for printing an emailing, but when you want to work with something the HTML or CSV (Excel) are always preferable. The ability to cusomise the reports would be extrememly powerful for us to work with. Include or exclude the body based on needs, having the body as a field in the CSV report as well as the working hyperlinks to the original gives you a very powerful report which can be customised easily. I'm sure you guys have seen the Excel reports that UFED Physical Analyser software prepares, with the filters for each column of the report. That is what I'd ultimately love to see Intella capable of producing. Those Excel reports are very simple and incredibly easy to work with.

No I'm talking about when you "export highlighted results" then go in to the report format, more specifically the HTML reports that are generated. The only way I can figure out to get the tags displayed is to use the custom naming feature of the report and use %tags. This is okay when there is only one or two tags for a file, but if there are 10 then it could become unweildy very quickly. If there was an option to add fields to the report itself then the tags could appear independant of the file name. For example currently when I export emails these are the fields displayed: Link to original format ****** Subject Source outlook.ost (3) Location Item ID 298902 Type message/rfc822 MD5 385173ad3de5dfb23938e017a553e376 Message Hash 1fe08b6a699ded5857604eb1a583b453 Content created Aug 9, 2013 10:32:57 AM WST Sent Aug 9, 2013 10:32:56 AM WST Received Aug 9, 2013 10:32:57 AM WST From ***** To, Cc, Bcc ****** I've blanked out a couple of fields here, but what I'm getting at is the abiliyt to cusomize this to some extent and add in tags or comments as required....or can I already do that and I'm looking in the wrong place? Also while I'm on reports, hyperlinks aren't working when exporting reports to CSV, not sure if I'm missing a tick in the box here either but CSV is a nice way to do up reports, easy to search and alter display order but having to manually enter hyperlinks is just not pheasable.

Thought I'd add my fields in the report to this thread and expand on it a bit. The ability to add fields to the reports beyond the default Intella selected ones, ie Tags etc.. Also, it would be absolutely fantastic to have the option for the body of the email to be displayed in the reports as well. Ideally this would be a expand all/collapse all option at the very top of the report, along with an expand/collapse option for each email (HTML only obviously). The reason for this is pure and simple searchability. If I can expand all I then effectively have a single page with the body and headers of all emails in the report and my clients can very easily search through the results to locate emails of relevance. Currently there is no way to easily search the email body's from the reports without using third party search tools. Obviously this is something Intella Connect addresses for my clients with a little more money to spend, but some of the small clients may not want/need this service but I still need to give them an effective way to search through the data I give them.