Jerry_W

Another alternative may be a proximity search "bradly jones" ~2

Chris, Thanks for your suggestion. Your method would partially achieve the result required. I usually add a column to my spread sheet to include a hyper-link to the relevant file and I was hoping I might be able to have multiple hyper-links pointing to the same target file. I am trying to see if I can get everything on one spread sheet with one data set.

Having selected the results I require and then de-duplicated them, I can export the highlighted results in original format with a csv report. Am I right in thinking that the original source location will only report one instance of the particular file. Is there any way that I can export the de-duplicated original format of the file (thus reducing the amount of data exported and reviewing to be done) but produce a report which shows all of the locations on which the particular file resides. On the current job I have around 50,000 files from 10 sources, which de-duplicates down to around 3,000. It seems onerous expecting the investigator to keep reviewing the same file, but it may be of evidential value that a suspect file is on one or more of the computers. I know ideally they could do that within Intella, but that isn't practical at this time. The only way I can think of is exporting the individual csv reports from each source and somehow merging them. Any thoughts gratefully received. The version is Intella Team v7 by the way. Thanks

Going back to one of my earlier requests, I am still finding it difficult to find a solution for excluding specific data from some users. I don't know whether this is a trend or my bad luck but I am having a lot of cases that require independent review for legal professional privilege material. Such material is successfully tagged by the reviewer but then by its nature needs to be kept from view of investigating officers. Is there any way that when setting up a tag there is facility to add a password to be able to view material that is so tagged? This would be particularly helpful for this LPP material but also for any identified indecent material perhaps. I am sure there are others.

Igor, Thanks for your time. I thought I was reading it correctly, but the consequences were a bit dire if I wasn't!

I am just trying to sort out a bit of housekeeping and would appreciate if someone could corroborate my understanding of the backups folder. I have set up an internal SATA drive on the manager workstation. I have set up a folder on that drive for all case backups and within preferences set that folder as the generic backup folder from the manager and reviewer workstations. My query is, as the cases and reviewers change does that folder location need to change or do sub-folders need to be added for each case. My reading of the manual is that all case backups are stored at that location. I just want to clarify that when a backup is successful it removes previous backups of that case only, not all backups, ie the folder can only hold one backup. Thanks Jerry W

Hi Phil, Would tagging them together not achieve what you want? Jerry W

A request from one of our users is in relation to the thumbnail view. I have found within the Preferences section there is the ability to filter based on the size of the original file. The request is to be able to increase/decrease the number of thumbnails shown at any one time thus increasing/decreasing the size of thumbnail displayed. This can be particularly helpful as pictures can often be found in large batches so that system icons can be previewed en masse but more inspection may be required for photos in the Users\My Pictures folder, for example. Jerry W

Thanks Adam, I have used that method with EnCase on a previous case. It was fairly successful but there were some issues with items coming back in that should have been filtered out. I think the files at issue were mostly emails which had a message hash but not an MD5 hash. As long as I know there isn't a single button that I am missing I can continue to try and come up with a work-round. Jerry W

To date I have been using v1.6.4. I have downloaded 1.7 for future use. The case in question was started in 1.5 then converted and continued in 1.6. For the sake of the reviewers I didn't want to upgrade at that point as they were near completion. I would be interested in best work practice for both versions, if you can help. Thanks

I am a relatively inexperienced user but I am glad to say from my experiences to date that I hope to be using Intella much more in the future. For future reference I would like some advice as to how to best achieve results from these circumstances. We have had a review team viewing material and searching via an evolving set of keywords. As they are reviewing data, based on the result of a particular keyword, they are tagging the files based on their relevance or not. At the end we have been asked to output the tagged relevant material in original and pdf format with a csv report, which is no problem. The problem comes as they also want to know what keywords are in those files. The only way my predecessor and I have been able to achieve this to date is to use a third-party tool to index and search the files in the original format folders and report as a csv. We have then used VLOOKUP in Excel to merge the results of the two csv outputs. This has worked but it is not flawless due to the sometimes differing format of file names, particular with email content. It is all done on this case but it would be helpful to me to know how to set this up best before starting in the future. Thanks in anticipation Jerry W

I have a forthcoming piece of work where the data set will initially be reviewed by an independent legal team to ascertain if any of the content is legal professional privileged (LPP). When that is finished the data set will be reviewed by the investigation team. Is there any way that the investigation team can be physically prevented from viewing the tagged LPP material inside Intella, which is the point of the exercise? I can' t see any way at the moment, other than producing a report and physically removing the material from the original data set. Any suggestions gratefully received. Thanks Jerry W