webel

When creating Encase Logical Evidence files, metadata is kept in the newly created LEF from the original source forensic image. Encase has an "Is Deleted" field that reports when a file is deleted. Is there a way in Intella to display this "Is Deleted" column? What about all other fields? Intella seems to not be fully displaying all metadata fields. This is a problem. Thank you!

Currenty, Intella dedupes based on message hash. We typically work with PST's and OST's received from various custodians in a typical client organization. We run searches and export the Intella unique results to PST. When we run those Intella PST's through another application with different dedupe options, we typically find a duplicate rate of 25-50+ percent. Most of our clients are attorneys and they are interested in reviewing a particular message only once. We have found with other apps the most effective way to get to actual unique content is to compare the "to", "from", "cc", "bcc", "subject", "date/time (strip milliseconds)". Support is looking to add this capability in 1.8.4 and I wanted to ask the community if there are any other deduping options you would like to see? Thank you.