AdamS

I have vague memories of asking about this before, but couldn't find any posts on it. The Auto Tag functionality is great, but it casts a wide net and you don't appear to be able to influence it at all. It would be fantastic if we could have some options when using this feature, such as: Unique Tags only - by this I mean the option to have only a single tag apply to each item, this will avoid the same item having multiple tags and possibly getting reviewed many times. I assume this would work on a 'first hit applies' basis Filters apply - it appears this Auto tag when used in conjunction with a keyword list will always search across everything. You can affect the search parameters using the 'options' menu under the main search bar, but you can't use facets to limit what the list is applied to. Example use a keyword list to search and auto tag only emails, or word docs.

Ahh okay I see how this works now, I was under the impression that I needed Step 1 and Step 2 before I was allowed to select Step 3. If I simply delete Step 1 and 2 it looks like I can just setup the ones I want as stand alone. Thanks Jon

Another small wish is for alphabetical display order within all sections of the "identities" tab. What I mean here is if you calculate identify suggestions the resulting list is in random order rather than alphabetical, likewise when you create an entity and click on 'suggestions' for the email addresses these are all random as well. It will make it visually less headache causing and far more importantly it will be easier to look through and find/select relevant entries. Further wish involving the "Identities" tab, which I'm loving by the way. The ability to isolate an Identities email addresses based on if they were the sender or the receiver, so basically select Identity A and then click "Sender" somewhere and have all emails where they were the sender be isolated.

I can see the OCR option there but there is no way to do other tasks which I would consider fairly common on most jobs, ie: Export encrypted items Generate Thumbnails Content Analysis Email Threading So perhaps if they could be added to the tasks would be my wish

The insight tab is fantastic, what I'd love the ability to do is build a list of tasks, then only have to execute once and walk away for a few hours. I"m referring to the OCR, generate thumbnails, email threading etc.. The ability to be able to tick any/all of the processes you want to run, then click "GO" would be a great time saver.

The second option there would only take a few mins so shouldn't impact cost too much. Good luck

fuzed is the access issue super time sensitive? You could accomplish what you need but creating a new case and indexing only those three folders. To avoid having multiple cases with the same source though you would first have to create copies of the source data. You could then have a new case with only these files available. Any tags/comments etc that a user applies can then be imported into the original case by way of MD5 lists. Edit: Alternative option Fuzed which I just tested and it may be suitable for you in this case: 1-->Create a new user type called 'Batch Admin' or something similar 2-->Under Roles and Privileges give this user pretty much all the privileges available except 'manage all cases' and 'manage a case' then authorize that user for the case in question 3--> Log in with this new admin account and select the sources you want your new user to be able to review, then create a batch (or batches with those files) 4--> Log out, then back in to Connect as your admin to access case management 5--> Create a second new user type called 'restricted review' or similar 6--> Give this restricted viewer the following privileges only; "can access a case", "can send and receive instant messages" and "Main UI: can use review" 7--> Create your new user, then set the authorization for the case and make sure the new user name is added as a restricted viewer type 8--> Lastly log back in as your Batch Admin, allocate those batches to the new user. When they log in they will only have the Review Tab and they will only see the batches that you have created and allocated to them. The downside here is there are some limitations on what they can do as they don't have the 'Search' tab and all the fruit that comes with that, but for basic review and tagging then this may do the job for you.

I may have strayed from the original goal here, the end goal was to be able to export files and have this date type used as a file name. This would allow us to export files from different cases/custodians, have them all in the same folder and sort chronologically instantly based on the file name. The only way I could see to accomplish this easily was to create a custom column which we could then use as the file name when exporting the files. You mention that the format setting is only telling Intella how to Parse the data, my confusion is stemming from the fact that the preview window is showing the data displayed in the format that I am wanting, see pic. In terms of changing preferences the only options listed are all based on Countries, so I'm not able to accomplish the desired effect there. At the moment we are using Bulkrename software to accomplish what we need, and to be fair it doesn't add too much time on to the task, I just thought there might be an easier way to accomplish this. It would seem a logical step to me to have Intella be able to display dates in a format that we choose for custom columns, this will give some flexibility to have alternate date/time formats shown without having to effect case wide changes under the preferences.

It's definitely something to do with the syntax I'm using to try and get the date displayed how we need. I ran the re-index again with the 'Sent' date in the format you suggested Igor and left another column in the format I want for received items. The Sent column has worked and is displaying the date/time however the other is not displaying anything. Below is an excerpt of the exceptions report, all items with my syntax show the exact same error. 9 a67394d757442b3adf698ea3646434da Email Archives 89037 Email Message Email Archives/eDiscovery Request 01-09.06.2017-1304PM.pst/Top of Personal Folders Meta data Unprocessable data Could not parse date/time: Wed Sep 06 13:04:08 AWST 2017. Column: Uni Date RECEIVED Igor did you try with my syntax? I'm going to try on another data source to see if it's unique to this data set. And can now confirm still have the same issues on a different data source. Doesn't like my syntax even though the preview shows it working.

So re-indexing with my preferred view failed, I'm attempting again with your suggested format Igor, although even if successful will not produce the data in the format required. Once this process is finished I'll forward the exception report.

Fuzed I've come across this with some government contract work that I do from time to time. The easiest solution is to install 1.7.x and use that to view the data. You can have different versions of Intella running side by side without any issues. Alternatively you may be able to upgrade the case in steps, a little time consuming but install multiple versions of intella on the machine (1.7, 1.8, 1.9 ect) then upgrade the case one version at a time until it's up to current. Not sure if that's possible but it might be an alternative work around.

Thanks Igor, I will try that new date format today and see if it works. Although when I was altering the time/date format the preview section was displaying correctly which led me to think I'd got it right. Possibly something else I did that I can't recall, but in any case I will try your format and see how that goes. Edit: okay just looking at the date format you have suggested this will give me (according to the preview) 'Thu Feb 22 09:22:15 AWST 2018' However, the format I'm looking for here is '20180222 09:22:15 AWST' so I will use YYYYMMdd HH:mm:ss zzz' which shows in the preview as '20180222 09:24:21 AWST' which is exactly what we need. The reason for this format is that we can throw together many different documents from different sources and easily sort chronologically. Previously I used something slightly different which didn't work but I'll try again and see what happens.

So I ran a re-index on a case with two custom columns and neither have worked as expected, xml data from one is below. Have I missed something? I did alter the way the date presented when compiling the settings but the preview was showing as expected. <?xml version="1.0" encoding="UTF-8" standalone="true"?> -<customColumnConfiguration> <version>1</version> -<column> <id>16001</id> <name>Uni Date SENT</name> <type>LocalDate</type> <description>Universal Date Format</description> <inUse>false</inUse> -<rule> <sourceField>0x0f0a</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> -<rule> <sourceField>PR_CLIENT_SUBMIT_TIME</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> -<rule> <sourceField>PR_CREATION_TIME</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> -<rule> <sourceField>OriginalModTime</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> <joinTextValues>false</joinTextValues> <separator> </separator> </column> -<column> <id>16002</id> <name>Uni Date RECEIVED</name> <type>LocalDate</type> <description>Universal Date Format</description> <inUse>false</inUse> -<rule> <sourceField>DeliveredDate</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> -<rule> <sourceField>PR_MESSAGE_DELIVERY_TIME</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> -<rule> <sourceField>0x0f02</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> <joinTextValues>false</joinTextValues> <separator> </separator> </column> </customColumnConfiguration>

Okay, played around a bit and have half answered my own question and thought I'd share....then ask another question. I can create custom columns prior to indexing by simply cancelling the 'add source' window that automatically opens up when created a new case. The only catch here is that you need to have prior knowledge of the fields you wish to draw data from. For example what I was trying to achieve with the dates above can be done by creating a custom column that draws from the 'PR_CLIENT_SUBMIT_TIME' field, then manipulating the way dates are displayed. Okay, so far so good. The first issue is that the field 'PR_CLIENT_SUBMIT_TIME' doesn't appear in every email, so it's clear that intella when determining the sent/received dates of emails draws this data from a number of different places, which requires some foreknowledge of all the possible fields which contain sent/received information. At a quick check on this current data source of have the following in relation to 'sent' times PR_CLIENT_SUBMIT_TIME PR_MESSAGE_DELIVERY_TIME 0x0f02 0x0f0a PR_CREATION_TIME OriginalModTime RouteTimes This source has a mix of PST and NSF archives. I'm looking at creating a number of templates which can be imported prior to indexing, but to be effective I need an exhaustive list of the fields within RAW data and what the field is displaying. So my new question, presumably you (Intella) have one, but I'm also assuming this is IP which you painstakingly compiled yourselves. Is there a source somewhere you could point me which contains this data?

I have a functional question which I'm hoping to get answered. I'm curious as to the need for re-indexing when creating custom columns. As with all things that seem simple in my mind I'm sure there is a reason for it, but this question could possibly morph into a feature request depending on how it is accomplished. My basic understanding of Intella is that the indexing process creates a database file which has pretty much all the information we see in displayed nicely in the GUI. Every piece of readable data has already been included in the database, so when we are creating custom columns there is no new information introduced to the database, we are creating a new link or relationship. How this question has arisen for me is for a colleague who wanted to change the naming convention when exporting some items to a universal date, so for today rather than the Australian version of 20/02/2018 he wants 20180220. This can't be accomplished with the current naming options as they are based on the columns available. I can't make any changes to the date/time format in preferences as they are all based on Country. Is it possible within the framework of Intella to have custom columns run on some sort of background 'refresh' rather than a full index? Or alternatively how about the ability to define custom columns before indexing?

Jon what about a saved search? Would a saved search become visible to other users the same way a tag would?

Yes, precisely something like that. http://community.vound-software.com/index.php?/topic/175-wish-listsuggestions-v2/page-4&do=findComment&comment=1467 See my post at the top of this page which give my thoughts on how it may be accomplished.

Just had my first play with building identities in the new tab, very nice. Small request in that regard, an "Identities" check box in the column display selector so we can see which items correspond to the created Identity. I suspect this would need a re-index if I understand correctly, but I was thinking there must be a way to do this without indexing by using Document ID's perhaps? Also any comments on simplifying ways of isolating emails which only involve specific users? This is something that I have to do on every single job without exception and the current process is quite laborious. What I mean here is that if I want emails which ONLY involve person A and person B, I have to manually search then scroll through and identify emails which contain other recipients. On a large case this can add many hours to what should be a simple process in my mind. I first requested this back in 2015 and periodically since, but haven't really had any indication if it's possible or likely to be implemented. If not let me know and I'll stop asking

Or simply use the facet 'type' filter to highlight emails, then click search, this will show you all emails (and only emails). If you are wanting to search within emails then rather than click the 'search' button use the triangle next to search and select 'include'. This will mean the searches you run will be within emails only. Just be aware that if you use the include option for a second filter (ie date range) then the searches will apply only to the most recent include filter that you have applied.....at least it used to be that way, not sure if things have changed with the latest version. I tend to build my complex searches a step at a time to ensure I know exactly what is happening. For example, if I want to search for emails between specific people over a specific date range I will do it this way: 1 - Use 'type' facet to isolate only emails-->Tag all these emails something like 'Setup-Emails' 2 - Clear the screen then select the new tag 'setup emails'-->use the date range facet to select the required date range and use the 'include' facet filter 3 - Apply a tag to the emails within the date range 'emails date' 4 - Clear the screen and then select the new 'emails date' tag items. You should now be looking at only emails within the specified date range 5 - Now I would use the main search field and under options select 'To' or 'From' or 'CC', whatever was specific to what I need and enter the email address I'm interested in. 6 - I would then tag up the resulting emails as something like 'emails TO john FROM michael' 7 - Rinse and repeat for all the relevant emails. 8 - Finally if I want to see the emails from John TO Michael I simply select the two tags that relate, then the intersecting coloured ball will show me my relevant emails. There are much faster ways to accomplish that type of search by using regular expressions or even AND/OR options, I have found though that the simpler the search query is, the less likely you are to miss something relevant.

I've not used the XML reports before, but the UFDR report indexes well with Intella. I'll be in a position tomorrow where I can produce an XML and UFDR from the same phone and run them side by side for a comparison. The UFDR reports seem to get all the data you need but there are a few items that aren't displayed by default, you have to go dig a little for them, see my other post in the wishlist section http://community.vound-software.com/index.php?/topic/175-wish-listsuggestions-v2/?p=2278

A long standing wish (and to be honest the only thing that irks me about this great tool), the ability to add multiple source items when setting up the case. Adding 10 source items from different locations is laborious and it should be a very simple process. I can see one of two ways that would work: At the source selection screen have a box or screen where you can add the source items or locations one at a time, buttons at the bottom that say 'add more' or 'finished' allow easy navigation. Once you click 'finished' then you go through and select all the processing options you want. Other way is have the ability to select multiple source locations by holding cntrl down and clicking, same way you can in windows explorer. Having the complete the entire processing selection for each item, then selecting 'no' for indexing now and then starting again makes my head hurt

Finally able to get back here and contribute again. Loving the latest version 2.1 so far, great to see some customization and the addition of identities I think is fantastic. Just a couple of functional wishes specific to processing UFDR files, which it does admirably I might add. It appears Intella is parsing all the available information, but some items are not being detailed seperately despite the fact they are indeed present. The below is not exhaustive just some initial idea's: Bluetooth Devices URL for web history Voicemail All the data is there and I can create the custom columns for the URL's with no problem, I just feel that it would make sense that Intella should parse that info automatically given it's web history. The other info for Bluetooth and Voicemail is there, but you have to manually dig down into the file system to locate them. I think it would make sense to have UFDR files be identified at the source indexing stage so you add them specifically rather than just a file, and at that point you could have a number of check boxes to create those custom columns from the outset. Would that be workable? It would save us having to create these custom columns after the fact and reindexing.

There is definitely some underlying other issue here as I've regularly exported out huge data sets (300GB +) and never had any take longer that 7 hours or so. In terms of case size you mentioned 80GB as the source, so how much tagged data are you exporting size wise? I may be stating something you already know, but if you are able to do something with you hard drive configurations you can get huge speed improvements. By that I mean 1 drive for original source data, a different drive for the resulting case data and a third drive to use for optimization. Again when exporting data it's always going to be quicker if the exported data is going to a new drive that is not in use for anything else...but not always possible I know. My process in this case would be: Export tagged items by tag (you end up with a single folder for each tagged item) if relatively few tags OR If too many tags for that approach export all as a single data set THEN Export MD5 lists for each tag Review in other location sets up new case and indexes data In the case of individual folders per tag they can immediately start review OR Use the MD5 list to auto search and tag files to duplicate the tags, then begin review. Of course by far the simplest method would be to use Connect and setup a remote review for the second site, this would involve no exporting or retagging and the LPP stuff would be excluded...but of course it does involve purchasing a Connect license Side issue, I tried to update my photo for my profile and it appears that the ability to upload a photo is broken

If you have a spare $40 or so you can get Email Chemy. Very handy little tool for converting email types, I used it regularly to deal with Outlook for Mac files.

OST's always seem to cause issues one way or another. Do you have any tools to convert the OST to a PST? Kernel and Systools both have excellent software for this that is quite cheap. I use them both regularly when I have an issue like this.