AdamS

I'm in the habit of selecting everything regardless of my data source for the simple reason that "I don't know what I don't know!" By that I mean what if an email contains an attachment that is a zipped chat log file, or registry file? I know it's not common but I tend to err on the side of caution. Also I had always assumed (possibly wrongly) that having an item selected that isn't ultimately needed won't add any extra time to the indexing process. My assumption was that part of the indexing process was first identifying all the types of files in the data set, then running the selected and applicable search filters as selected on the screen, if there is no internet history files identified in the first stage then the fact that I have ticked internet history on this screen is neither here nor there as there is nothing to run it against. Maybe one of the Intella people could clarify this for us?

Indeed, now that I've seen the new highlighting feature in 1.9.1 this would be perfect.

Glad to hear fuzed, it's a great little piece of software

With the senior review user when you say he can query for certain items in a batch I assume you mean from the search tab? I'm was trying to imagine a way this could be done without accessing the search tab, however you are correct this ability already exists there. On reflection I think you are right, for my Senior reviewer I simply give him access to the search tab and then give them a bit of direction on how to isolate tags from his reviewers and he can conduct/change as he sees fit from there. This would also be handy as he could run more keywords etc if need be.

Sorry Lukasz, not sure how I missed that one....maybe need stronger coffee

I also note that the 'latest' button to apply the previously used tag works as well. I'm doing some testing side by side of Connect and 'the big player' with regards to speed and ease of use. You will be happy to know that Connect is outperforming on all fronts at the moment.

Hi Lukasz, I haven't really considered how the work flow might go at this stage. The OCD part of me would want to assign all batches at the outset of the review so each reviewer knew what they had, but in some cases I will be giving my client control to allocate batches so they may very well take the approach of leaving some unallocated. Sorting by assignee will be an easy way to check that though

Hi Andrej, I think some sort of reference to the chain might be the way to go. For example, I search for my keyword which appears in the 4th email in a chain of 12, Intella displays the last email in the chain (contains all previous 11 emails) with the keyword highlighted in the usual fashion so i can scroll down and find the responsive hit. Then on the left hand menu where we already have the option to 'view parent item' or 'redact' etc, have a new link to 'show all thread emails' or similar. Clicking on this would then display all 12 emails in the same manner as if I'd clicked on 'show all children' or 'show parents' etc. With regards to the abnormal header information that may occur then I agree, a combination of the header, subject and paragraph analysis could be used, but I guess only some testing would identify how accurate that will be. It may be that for those emails the threading won't work as effectively but for the vast majority I think it will work well.

Thought I'd lump a few in a single post here as it's a bit easier.. Batch Review View Options A bit of flexibility from within the review window once the batch review is underway to allow the reviewer to filter files by type or other select parameters. For example if you have 1000 files to review your process might be to review all pictures first then move to PDF followed by Word docs. Apart from personal habits this also makes sense from the point of view that if you review files of a single type all in one go your brain doesn't have to constantly switch from excel, to picture, to word and back etc which causes a bit of brain strain, rather than all the same type so you can get into a good flow. Maybe even just 'sort by type' as we can currently with Connect or Intella which would then group them all together within the batch preview window. Doc ID visible Have the Doc ID visible when viewing the 'content' tab in the batch review under the file name or on the top of the screen somewhere prominent. Select Multiple Keyword Lists When viewing batch review you can select only a single keyword list to have highlighted in the document, would be great to be able to select multiple lists (checkbox maybe?) Ability to elevate some privileges for users Ability to view other reviewers responsive tags either collectively or individually and to make changes where needed. Essentially I'm looking at sort of a senior reviewer who can vet other reviewers work and alter if if he see's fit. I see this like an extra button available only to him on the review 'all batches' screen something like 'Responsive Review' at the end of each batch line so he can click into any batch and make changes. These changes would need to be tracked as part of the audit log, hence a completely new section rather than simply assigning and reassigning the batch. Ideally it would be selective so the elevated user can chose which responsive tags (codes) that he wants to review. Currently an elevated user can browse other users batches in read only mode but make no changes.

Self explanatory

I'm not sure if this has been suggested before, but email threading would be a huge benefit if it's possible. With the paragraph analysis and family detection already part of Intella would it be possible to have the ability to thread large email chains and only display the last email in the chain? I can see some difficulties here where multiple parties are involved and they may reply/forward at different stages so there may be multiple chains that vary slightly, but even in these cases if the threshold is set very high then we should be able to avoid excluding any of these partial duplicate chains. That way if a new chain is created part way through by someone forwarding/cc to a new member then you would essentially have 2 final emails for the chains, the first half of both final emails may be identical, but then the remaining portions would be different enough that they were identified as individual chains.

I think it would be good for a clearer work flow if there was a separate facet on the left hand menu for 'Batch Tags' to clearly separate from other tags which may have been applied as part of a case setup. For example, I had 365 keywords/terms which were run against the total data set to create a 'review data set' for my client, these keywords were run then auto tagged and deduped to make the data set for review. The resulting keywords were then grouped via Intella and I gave them all a single tag (Batch Review Set) so I could easily select them all via Connect for batching. Switch to Connect and create the batches (about 130), and the review can go ahead as normal. I then set up the coding tags via Intella and in this case that necessitated the creation of quite a few more tags to take into account the clients wishes for coding, so the end result was around 400 different tags sitting in the tag menu. Once you get to this level of tags it becomes quite difficult to quickly isolate relevant tags when it comes time to export the responsive documents after the review is complete. If the batch related tags had their own facet then this process is greatly simplified. Edit : I just realised I can quickly isolate tags by user already with the drop down menu at the bottom of tags...

It will take everything including attachments. The software is pretty user friendly and tells you which folder to point the software at depending on the type of mail database to convert. It supports about 30 odd different types so you should have no issues.

I note when reviewing via the batch review window that Connect cannot render calendar entries (.ics) in either content or preview view. We can open the item which will then show us a normal preview window and we can see the data in the raw data tab. It would be great to have the raw data tab visible in the batch review automatically as required, or alternatively better support for rendering .ics files, maybe a nice little graphical view close to how it would appear on a calendar if possible with the details (if any) from the notes section.

I'm playing around with a test case I've set up and have noted something that is of concern. I created a user type 'Batch Reviewer' and only give them access to a case and the review tab. Looks good, they can log in see all the batches but can only access those assigned to them, however they do have access to the preferences 'cog wheel' which also gives them full access to alter/delete/add coding layouts. I would suggest adding a new permission that we can grant/revoke for 'access to preferences options' so we can lock that down.

On the review screen up the top some very simple extra info would be good to have, at this stage I'm thinking something like 'Total Batches xx' 'Assigned Batches xx' and 'Unassigned Batches xx'. So at a glance the admin can see if they neglected to assign any batches. I'm sure some more info would be helpful but I'm mindful of space and trying to keep it minimal but still relevant.

Currently the only way to select a large amount of tags via the connect interface is by holding down cntrl and selecting them one at a time, not much fun when you have 365 different tags that you want to batch up. If the old windows 'shift+mouse select' was enabled this would be the best approach, allowing us to highlight large sets of tags to facilitate batching much faster. My work around for the moment is using Intella to assign all the tags to a single custodian, then from the Connect interface I can quickly select and display them all....although now that I think about it I could simply have just applied a tag 'batch lot' or something to the entire data set as well for the same effect.

It appears that the batch review users may have a ghost.. I created a new user type called 'batch reveiwer' then created a new user called 'batch reviewer' so I could test the permissions etc. I assigned a batch to 'batch reviewer' then I had a change of heart because it was annoying typing in 'batch reviewer' to log in so I deleted that user and created a new user called 'batch'. I went back an unassigned the batch to 'batch reviewer' and reassigned to 'batch', however I noted that 'batch reviewer' was still listed as an available user to assign batches to even though that user no longer exists on the user screen.

Just starting to play around with the batching/coding etc and so far am loving it. One small thing, the need to manually click 'apply' seems a bit stop/start....how about auto apply when clicking the next arrow? If you are worried people may accidentally apply a coding choice they don't want make the auto apply a manually set option somewhere perhaps.

I've had a few of these fuzed and you will need to convert the olk14 message format to something Intella can work with. I purchased email chemy for this, starting at $40 for the personal edition it's very cost efficient and worked perfectly. I'm not aware of any forensic tool that works natively with olk14 format but I could be wrong there.

I like that idea a lot Lukasz. For me I'm not too concerned about the difference between 'logged on' and 'actually reviewing' as there is no real need to have that distinction for me. Prior to 1.9.1 there were no batches so it was a bit harder, but now with the batched reviews that will be good, however there will still be some reviews where only a single user is logging in so no real need for batches. But, having said that the auto log off reminder you propose is a great idea regardless of batched or not, have it configurable for any time period we like up to say 30 mins and if no response received it auto logs the user off. That feature aside it would be great to see some of that information captured in the logs be made available in a more user friendly format, I understand it's likely to be a lower priority but it seems a logical step to me when considering the overall auditing requirements that we are often trying to meet for clients.

Hopefully this is a nice simple one. When importing OCR'd files the directory is first scanned to check for name collisions, files that can't be accessed etc, then you have to click next to start the import. Would be nice to have a little check box 'auto proceed' so that you don't have to manually wait and approve the next step. I know there is a reason for this so we have the opportunity to check if there are any problems, however having that option if we don't need/want to check would be nice. Alternatively have the little report pop up box appear at the end of the process reporting any problem files and have the option to export the problem file as a short MD5 csv or text file to allow you to identify them.

To be honest no specific idea's, Passware just came to mind as it's already used in a similar fashion with some other forensic tools (EnCase) so it made me think perhaps they are co-operative about this type of thing. I didn't consider the UI locking, so perhaps simply having the export/import option like external OCR tools would be the best approach so as not to lock the case up.

I hadn't considered that, currently my Connect server doesn't have Outlook installed on it but I think I will change that and use this method until it's native for Intella. Thanks Lukasz

And on the same subject the ability to push encrypted files directly to a cracking engine....say Passware