PF1

So, I used a personal gmail account to test out the API driven GMail collection method (OAuth token) and it worked, with one VERY notable exception. None of the folders (I know, they are 'tags' in GMail) came through. What I got was one giant bucket of emails with no indication as to where the message came from within the email account such as Starred, Important, Trash, Inbox, any of my custom tags, etc. Is there something I am missing? The API method was incredibly fast (compared to using Thunderbird) and I would LOVE to be able to use it, but I need to have the folder/tag heirarchy...

OK, I understand the reasoning behind the inclusion of the various items, but since I use Intella exclusively (for now) for email and use other programs to handle registry and internet history and others, is there a configuration file that I can edit to set the default checked and unchecked boxes? When I am adding 15-20 different sources to a case, it's 15-20 more steps to un-check/check the ones I want, and I can't seem to get my selections to 'stick' between sources, even in the same case (ie I un-check 'registry' items for source #1, but upon adding source #2 'registry' is checked again).

I feel like this begs the question "if none of these selections have an impact on performance, why are they UNselectable?" I mean, I have no way to know if an email has an attached chat log and the log that in turn has an embedded zip file. That's WHY I am using a tool like Intella to process the email! I just don't see the point of having this configurable if the best course of action is always to run it with all items selected.

Adam, I hope you are right, (and I have not tested with and without all options to see if it affects my processing times) but my experience with other forensics/indexing tools is that the more it's looking for, the longer it takes even if it does not find anything. I hope someone form Vound can let us know. Being an EnCase user, It's instinctive for me to reduce ALL indexing tasks as much as possible for speed!

I am really liking the direction Intella is moving toward in 1.9.1. I am wondering, though, if some end user configuration is possible? Particularly, I am finding that every new source I process requires me to UN-select the "Items" I rarely, if ever, will need. These include Chat messages, databases, registry, and browser history. it would be great to have Intella remember my last choices and apply them, rather than forcing me to uncheck the ones I don't want every single time.

Using 1.9, I added a folder with two PSTs belonging to a single custodian. Prior to indexing, I set the custodian name to be applied to the indexed items. Once indexing finishes (about 50 minutes) the indexing dialogue said indexing was finished and Intella was applying the custodian info. After an hour and 45 minutes with the only sign of activity the growing RAM reservation in Task Manager and a VERY small amount of writes to the index files, I stopped the process with the "Stop" button and Intella hung for about 30 minutes before crashing and providing an error. Unfortunately, I did not save the error as I needed to move on. I then re-opened Intella, selected ALL the items I had just added, and applied the custodian name. This completed in about 2 minutes. Figuring this was an odd occurrence, I tried again on a different custodian. Exact same results. One hour to index, once complete I let the "apply custodian" run for almost two full hours before stopping it, allowing Intella to crash, reopening and then manually applying the custodian facet (which again took about two minutes total). For the remainder of the many PSTs I need to index, I am not applying custodian info during indexing, but am manually applying the facet post indexing. Anyone else having issues with the Auto-Apply of custodian info? What log files can I look at to see what the problem was?

I appreciate the offer, but don't have much "test" time lately! I will wait for the official release, thanks.

This looks interesting Christiaan. In the graphic, you show three names (green columns) and referr to them as "custodians." Where is this "custodian" information being pulled from? I don't recall being able to assign a custodian name to indexed items (although that would be fantastic!).

AdamS, agreed, that is currently how I am doing this but with the larger scale cases, this becomes very tedious. Also, another feature request that would be nice would be the ability to import a set of tag names from a text/csv file. I find myself making the same tags over and over on different matters, and it would be great to be able to simply import them rather that re-create them over and over again.

Once again, wondering if we are ever going to be able to calcualte the total size of a data set based on selections within Intella? This has been a request since 2012, and I was told a few years ago that this was being bumped up in the request process, but this is still (IMO) a key feature that is not present. I don't even neccessarily need "on the fly" calculations, just the ability to either highlight or checkmark a group of items and then calculate the total output size of the selected items. I am willing to beg or grovel if needed! This would make my life SO much easier....

OK, thanks. Much appreciated.

I searched and didn't find anything definitive... What is the best way to archive cases from Intella when they are completed? I need to remove the data from the Intella index folder to make room for new cases. I am planning on: 1. Export case file to .ICF 2. Place case data (compressed) in an archive folder along with exported .ICF 3. Place archive folder on a backup drive along with all other similar Intella archives Archive Folder1 -Case1.ICF -Case1_Data.7z Archive Folder2 -Case2.ICF -Case2_Data.7z Etc.. Any suggestions or better ways to archive?

All of the above Christiaan. One of the many uses I use Intella for is Early Case Assessment. Being able to easily determine the resulting data set size from a set of search criteria often guides my clients in choosing keyterms and other search criteria. Since many times, the results get hosted by a different vendor who bills on a 'per MB/GB' basis in Relativity or similar, if a client is debating how to phrase a keyterm and one choice leads to a much larger output set, that would be very helpful to know. While I would love some kind of immediate 'on the fly' calculation, if it's easier, an option to calculate the total size of a given selection (highlighted items, flagged items, etc.) would probably suffice as long as Intella was not actually exporting the items to a temp location in order to make the calculation. Others may have better/ examples of the usefulness for this but this would be my initial thought.

Has this been implemented in 1.8.1? I Have not downloaded yet.

Ouch. Looks I am back to Thunderbird for IMAP. Thanks for the update.

Thanks for the reply AdamS, I will take a look at F-Response and see if it works for me.

AdamS, curious which F-Response product you used. Tactical, Consultant, Enterprise? Would you consider F-Response IMAP Collection -> Intella better than Thunderbird IMAP Collection -> Intella?

Thanks Christiaan! Exactly what I was looking for.

I may be missing an obvious method for accomplishing this, but I can't seem to find it in my notes or on the forum... I have a run a keyword list search (not combined) and would like to show my client the number of results per keyword. The "Searches" pane at the top right of the cluster map contains this exact info inthe format I need it. How can I export this "results" list indicating [keyword___#hits] to txt or csv or similar? Currently the best I can do is a screen grab of the listing, which only works if the keyword list is able to be contained within the height of my screen. Is it possible to simply export the number of results? Using the following image as an example, I would like a CSV with: Bulk Mail,481 the,10428 and,9288 with,11394

Interesting to know about Aid4Mail. I have used their MBOX converter in the past. My Intella maintenance agreement is coming due and I would hate to have to think about spending another $1500 for Aid4mail for something Intella is supposed to do... I will have to see what else it can handle in terms of searching, etc. I would love to see a little more interaction in these forums from intella. The process to try to get tech support is daunting at best, and probably not the right venue for these types of issues...

Two years ago Adam asked for the ability to see the total size of a selected set of items and Chris said he would enter a feature request. This would be VERY useful but I don't see where this has been integrated. Currently I have to export out the items as a CSV and perform the calucaltion myself, which is very time consuming when dealing with tens of thousands of items. Is there any way to get a total size (not item count) of selected items?

AdamS, I am actually using the second example you posted, but many of my matters involve 500+ key terms, so eliminating any element of manual parsing is the whole reason I am using the indexed tools like Intella. I use DTSearch as well, and it can handle extensive nested queries, complex searching, etc but does not inherently have the output features of Intella.

WIsh list - Nested Phrases. Plain and simple, I NEED to be able to nest phrases and expression in search queries. I need to able to proximity search a [phrase and a word] or a [phrase and a phrase]. I.E.: ("credit card") w/5 (statement OR invoice) This is a simplified example, but I often have 20 terms on either side of the proximity argument. I do this regularly in DTSearch and it works fine, but I when indexing, searching and creating export batches it is overly compicated to have to use two different tools to index and search the same data.

Since I need this for a case I am working on right now with fairly tight deadlines, after not hearing back here I submitted a ticket to support and received an email saying that search syntax quesitons will not be handled by support. Guys, I have to tell you that the documentation inthe manual is so lacking regarding advanced search queries that it is not acceptable to deflect advanced query building quesitons to a forum with no gurantee of a respnse, let alone a timely response. Perhaps having chat support is the way to go here. alternately, a sub forum that is contiually staffed during business hours with someone able to advise on syntax. In addition, I would love to see an advanced search builder whitepaper by Vound, since the search syntaxes are significantly different from the standard DTSearch queries. Nesting is the main issue I seem to have, and when no explanaiton is offered in the manual, I am simply left to wonder if this is possible as I have a hard time getting answers from anyone. As much as I love what Intella can do, I feel like this is a glaring issue that has been raised enought times to indicate to Vound that further documentation and discussion is required. My support plan is coming up for renewal and I want to be sure I am getting support for issues other than "Intella does not open"... /Rant

I will be testing a set of keyterms once my indexing is complete but since Intella seems to have it's own rules regarding search terms, I need to figure out how to search for certain items. I have a list of several hundred keyterms that all need to be searched as OR terms, so I was planning on using a keyword list. Some of the terms are proximity searches, which normally wouldn't be an issue except that these proximity searches include exact phrases. What I am trying to figure out is how in Intella do I search for: "real estate" within 5 words of "investment" "real estate" within 5 words of "investment opportunity" The phrases within quotes need to be exactly as shown. I don't want hits for [real w/5 investment] in example 1 or ["real opportunity"] in example 2. If this is simple, I am all ears. The lack of ability to nest phrases is hanging me up here... Intella seems to use quotes for both exact phrases and grouping for proximity searches.