AdamS
-
Posts
601 -
Joined
-
Last visited
-
Days Won
23
Posts posted by AdamS
-
-
You can make registry changes to fix Outlook 2003-2007 to view .eml files (link below), however this might not be ideal when it comes to helping clients view files you provide them unless they are quite tech savvy.
https://www.msoutlook.info/question/354
Outlook 2010 has native support for .eml so there should be no issues there if your clients use that version.
Also Microsoft provided a hotfix for this issue for Outlook 2007 (link below) which is probably a better solution as it's official, however the hotfix is essentially an automated registry fix.
https://support.microsoft.com/en-us/kb/956693
Otherwise Thunderbird Mail client can view .eml with no problems.
Below is another solution that works
http://www.blog.creativform.com/import-eml-files-to-microsoft-outlook/
And finally instead of exporting the items as individual .eml files you can export them as a PST, import that PST into Outlook on your analysis machine, then use Outlook to export/save as .msg files to give to your client.
A little bit round-a-bout but it works if you feel you must give your clients .msg for ease of use.
I'm sure there are plenty of other solutions but those are the methods I tend to use.
-
I have a client who is wanting some fairly complex searches run and at the moment this is causing me some issues.
I'll give you an example, below is what they've asked for
"job method" OR "risk assessment" AND client OR power OR corporation -withing 100 characters of 1280 OR placename OR car 7, 8 or 9
I have broken the search down thusly
"job method OR "risk assessment"
Then
Client OR power OR corporation
Then
ignore the within 100 characters
Then
1280 OR placename OR "car 7"~1 OR "car 8"~2 OR "car 9"~3
Then using the venn diagram I select the ball that intersects all 3 searches and that is my final result.
That is one of the simpler searches they are asking for but the main problem is the proximity search they want which I cant do under those search terms.
This led me to start looking a little more , seriously at regex, however the link provided in the help manual to look into Regex that Intella supports is a dead link.
Any good resources I should be looking at for some guidance here?
-
I created up a dozen batches which contained some common files, I noted that once a file had been coded as part of one batch, any subsequent batches that contained the same file were automatically 'tagged' as reviewed (green tick).
I then moved the case to a new computer and created some new batches, however now where there are files common to both old and new batches the green tick to indicate it's been previously reviewed is no longer present.
The tags which have been applied by the coding choices are visible.
Any thoughts on why this might be the case?
-
I know you said you've had it working on Windows 10 before but I just wanted to comment that I've had some issues with Windows 10 doing random things with forensic software of various types. Nothing I could ever pin down to a particular suite as it was very random, but the general instability led me to go back to Win7 which seems to be a lot more stable.
For me, I won't be touching Win10 again until all the vendors have signed off on their software being fully compatible.
-
When reviewing batches in content view Connect will truncate to 30,000 characters, which is fine, however if I click here to 'untruncate' then do a keyword search and apply that search, Connect will truncate the document again which can give false search results.
The yellow box alerting us to the fact it's truncated appears so we know, but some of my clients are missing this and finding it a little frustrating that they have to untruncate again after each search or each change of view.
-
Thanks Jon, yes it makes sense and that was the approach I was taking. I'm lucky in this instance that one of the words in the phrase I need is quite unique.
Possibility for the roadmap maybe to allow nested phrase proximity searches?
Or alternatively if there is anyone on here who is a regex guru may wish to chime in
-
Even after reading Jon's very good post I'm still not sure on something, maybe I missed it.
Breaking down the complex search I still can't figure out how to use the proximity function when dealing with a phrase?
eg I want to find "beat" within 50 words of "here it comes". Using Jon's keyword method I search for both individually, then tag the overlapping so I have only documents which have both, however from here I'm still facing the same issue with not being able to apply a proximity search on a phrase.
-
I have a rather complex search which I'm not getting to work quite right so thought I'd come here for assistance.
Essentially this is what I'm trying to do, any instances of:
(approv* or verific*) and design, which appear withing 100 words of several other keywords.
"(approv* OR verific*) AND design AND (keyword1 OR keyword2 OR keyword3)" ~100
The above didn't work so I'm not sure if I can build the query I need this way or if I need to explode my head and try regex.
Any help appreciated.
Edit: interestingly if I remove the ~100 then the search query as it's structured will work. There's obviously some relationship issues here when trying to tell Intella what that word limit actually applies to.
Edit again: sorry, I just found the sticky by Jon which breaks it down nicely for me and I have figured out where my issues are.
-
I have a fairly large case running and when trying to select around 9.5 million items Connect seems to bug out. Chrome out right crashes and Firefox keeps giving stop script errors for a while then it too crashes.
Only seems to happen when I try to select them all, can happily display them.
Not a bit issue really as I can select smaller data sets and the problems goes away, just thought I'd mention it.
-
I'm looking to replace my venerable Connect servers with some new hardware and wondering if there is any read advantage to the Dual Xeon CPU's?
I'm found some reasonably priced nice single CPU servers (2nd slot available for upgrade if wanted/needed) and wondering if it's really worth the cost to bother for a pure Connect server.
-
-
For this I'm meaning where we would preview batches, it would be fantastic to have a small free text box down the bottom right hand corner of the window which acts exactly as the comments tab does when you preview an individual item (denotes date, time and user who makes the comment).
Currently we can achieve this by 'previewing' the document from the left hand menu, then using the Comment tab as normal, however for a smoother review it would be preferable to have this comment field visible on the same screen to avoid extra time switching between windows etc.
-
This one is very client specific so I'm not sure how many other users would find this handy, however my one specific client loves having the tree view as part of PDF exports so I find myself spending quite a bit of time taking screen shots then editing PDF files to include that...so....hence my selfish wish.
-
fuzed, I've also got about 10 cases running at any given time and have never seen what you describe, however I use a little software tool called Bvckup2 which replicates my Intella case folder to a network share on a secondary server.
The software is very cheap only $40 for a pro license and it basically monitors the folder and backs up any changes. I set mine to an hourly backup so I can easily (and quickly)go back if something goes wrong.
In addition I use Veeam Endpoint backup to do local full/incremental backups (free software).
I've learnt the hard way so now I have multiple backups running at alternating times to ensure I never get caught again.
-
ah yes that makes sense, i didn't think about changes being retrospectavely applied. Agreed preview window would be the way to go.
-
I have something confusing going on.
I have some empty PDF documents which show no data in the Contents tab (as expected) and confirmed when opening in external viewer the content can't be searched, however keyword searches within Intella appear to be correctly identifying words on the page.
In some cases the file name has the keyword in it, but in most cases the file name is a random number and I can't see any meta data with the keyword in it.
I did note that the parent item contained one of the keywords but my tagging preferences were set to only tag the responsive item not the children.
Possibly the tagging behaviour is not working as expected for Auto Tag functions?
-
That worked great thanks Lukasz, one small thing though if it would be possible to 'edit' and existing profile that might prove handy when it comes to configuring and trying different profiles.
-
This is in the Preview tab......however I think I see where you are going with this.
I'll export the files from Intella and see if the quality loss replicates or if it's simply a preview rendering issue, as I understand from your previous advice that the rendering of PDF's in preview mode is not a simple matter.
Edit: Confirmed, this is a preview issue only, when I export or view in native application there is no loss of quality.
-
Currently the only way to view an attachment to an email via the new review tab is by opening up a preview of the email then you can view the attachments.
Would be nice to have the attachments (child items) to any given file be visible simply by scrolling down much the way they are when a report preview is created.
Further it appears there is no obvious sign that there is an attachment to an email from what I can see, however I'm using the Enron data set to test this so not sure if this will effect anything differently.
-
I'm seeing some weird Chrome glitch and wondering if anyone else has experienced this.
When previewing PDF documents the text from OCR'd documents sometimes appears garbled, however the content view clearly shows the text correctly.
This only occurs in Chrome not Firefox or IE (edge), Chrome version is 50.0.2661.94 m
I've attached a pic from the Content and Preview view below to show what's happening, also clearing the Chrome cache had no effect.
-
I'm hoping there may be a way to simplify the redaction functionality.
For example, I have 50 PDF invoice files which have been indexed which I'm looking to redact a few of them.
Once I switch to the redact option it automatically includes a cover sheet and all embedded children items in this redact view.
It would be helpful if the option to hide/remove the cover sheet and child items from this view leaving us with just the preview window to work with, as 99% of the time this is all we want to see to replicate what the finished redacted document will look like.
-
I'm running some tests at the moment on ingesting large amounts of PDF invoices to assist with an internal matter and I'm noting quite a loss of quality from the original PDF doc to what is shown in Intella.
The original has solid text and clearly visible print, however after indexing there is quite a bit of fading and text is grainy..ish...
I've attached a couple of small pics to demonstrate. The quality loss is by no means drastic and the resulting file can still be read, but I'm thinking what might happen if I export these PDF docs for OCR, then import the results what my overall quality loss may be?
-
Possibly so you can ingest a data source which contains multiple file types (ie a disc image) and be selective about what you want to index.
If you only want to index registry artifacts for example having this choice means you don't have to first use a different tool to locate and extract the registry files to be indexed. You could then go back an index for different file types as required and if needed.
That's probably a bad example but I'm thinking that may be the reasoning behind.
-
So if emails are selected but chat logs are not selected you could potentially have the following scenario:
An email has a chat log attachment, and the chat log has an embedded zip file which was sent between parties.
Intella will index the email, but as chat logs are not selected it will not index the embedded zip file and any of it's contents?
So to avoid missing any embedded/nested files it's probably a good idea to select all items at this screen where there is any doubt about possible hidden files, unless you are indexing files which you are sure have no embedded content of any kind.
Reviewed status not staying between batches
in Archived threads
Posted
Hi Lukasz, yes none of the fields were 'required' you are correct.