Jump to content


  • Posts

  • Joined

  • Last visited

Everything posted by llanowar

  1. Since processing, I have relocated my Intella sources to a new drive. Is there a way within the Intella case to point to the new new location ? or should I just copy the source files back to their original location until this case is complete?
  2. I had not read the two linked help pages at the top of this topic before posting. Is the following the best work around: proximity search 1: "Wilson contact"~2 normal include search 2: "contact list" Thanks.
  3. I would appreciate some help getting around a proximity search limitation involving a phrase and a term. An example (one I was provided to search) is: “contact list w/2 Wilson” They would like all items containing the phrase "contact list" within 2 words of the term Wilson. Seems simple enough, but I can not get my head around not being able to use nested double quotes < ""contact list" Wilson"~2 >. Suggestions? Thanks BTW: I am using Intella Pro 2.4.2
  4. I have successfully added a few sources to an Intella Pro case (E01s and folders). I am attempting to add one last E01 image and am receiving the following message in the "Select Folders" window: "Unable to retrieve folders." Note: I loaded this problematic image in another tool (XWays Forensics) and am able to see the partitions and folders tree. I tried re-imaging just the primary partition in the E01 using XWays and adding to a new Intella test case: same issue "Unable to retrieve folders." Any ideas on what may be causing this / how to fix? Thanks group.
  5. I am poking around W4 1.0.3 for the first time - using the NIST CFReDS "Data Leakage Case" data set. I am really liking what I am seeing so far. One irregularity I just ran into: In the "USB Devices" Search section, the "Items" view correctly lists the connection timestamps (even after applying an EDT timezone offset in the "Sources" tab). The irregularity occurs when switching over to the "Events" view. The connection timestamps are all off by exactly 1 hr (likely a Standard/Daylight Savings issue). In the "Events" view, the right-side "Properties" preview section lists the timestamps correctly, however, the timestamps listed in the primary window area sorted chronologically are off by exactly 1 hr. I re-indexed the entire case and selected "rebuild links" with the Timezone offset already selected to Eastern Time to no avail. (My initial indexing was set for UTC time (-0)). Keep up the great work, this tool shows great promise.
  6. I have processed a Cellebrite UFDR file (phone) with Intella v2.2.1. The manual makes it clear that instant message items will be bundled into "conversation items" if able, on a day-by-day basis (page 62). My question is: Is it possible to tag only one of the bundled message items listed in the bundled conversation? Tagging seems to only apply to the entire bundled conversation "SMS/MMS Conversation" file. One idea - perhaps I must redact all of the other/unwanted bundled text? Thanks
  7. Thanks for the reply. When I have the next opportunity, I will check the item's Raw Data tab.
  8. Dear community, I sent off a Cellebrite phone collection to be reviewed (along with the UFED Reader application). The reviewers tagged a bunch of items using Cellebrite Reader and then saved the results in a .pas (session) file. They now want me to create a load file of their tagged items. My thoughts: perhaps they can just email me their .pas session file containing their Cellebrite tags, I can load it up in Cellebrite (along with the original phone data), generate an XML report (which will hopefully contain their tagged items identified), use that XML report folder as a source in Intella, and create a load file for them. So far: They sent me the .pas file. It loaded fine and I see their tagged items in Cellebrite (all good so far). I created a Cellebrite XML report and searched the resulting XML file for their tag names - they exist in the XML file (still good). I created a new Intella v2.2.1 case, set the Cellebrite XML report folder as a source and indexed (still good and going to plan). Plan appears foiled: In Intella I do not see anything relating to their Cellebrite tags. I searched the case for their tag names = nothing. My plan seems like it won't work - Intella is not identifying the reviewers' tagged items as such after processing. Intella sees the data fine, just not the tags. <- as far as I can tell. Perhaps I will have to process the Cellebrite phone collection with Intella (ufdr as source) and have them tag from within Intella?? Is that my only / best option to get to the final goal of a load file of their items of interest? Thanks.
  9. I did resolve my issue above (sort of). I exported as a load file (including PDF versions in the images export section). The contents of the PDFs folder is what I was wanting. I just deleted the rest of the load file pieces. I will experiment with the PDF export options some more to see how I can achieve what I wanted with just a PDF export (rather than load file).
  10. I am using Intella Pro 2.2. I am attempting to export as PDF a few email messages with attachments. I selected the "Number pages" checkbox, but my resulting PDF files (3x, one per email) do not contain a page number. Each of the 3x exported PDF files' names increment correctly, based upon the number of pages within each. EX: 0001.pdf, 0006.pdf, and 0010.pdf. - But within each PDF, each page is not numbered. Is there perhaps an option I need to select on the "PDF rendering options" export page? or perhaps on the "Headers and footers" export page? Thank you.
  11. Thanks for the reply. I am using default settings for Intella 2.2. The Wizard window1 settings are just pointing to the .DAT and .OPT files. The Wizard window2 settings are default and I double checked them with the specification in this matter: Condensed spec I received: 1. fields delimited with ANSI 20 2. String values within fields should be enclosed with ANSI 254 3. First line should contain metadata headers then one line per document 4. each row must contain the same number of fields as the header row 5. Each return or new line delimited by ANSI 174. 6. Multi-values separated by a semicolon (;) - It appears the default Intella settings with format: "Concordance/Relativity" selected match the above specs I received with the load file. I do not see an encoding listed in the spec. Perhaps this is the issue. Is the encoding method listed in the .dat file somewhere? I do see the .dat file layout in the "Text preview" tab (Load file preview tab is blank, however). Would the Date/time and number formats be a problem at this early importing stage ("error while validating load file. Input length =1")? Thanks for pointing me to the Intella video.
  12. Hi group. I am attempting to import a load file source (Concordance). After step 1: pointing to the .DAT and .OPT files, and hitting step 2 (Configure Delimiters) I see at the bottom, "Error while validating load file: Input length = 1. I am not very savvy with load files and this may be beyond my capabilities to resolve - but I thought I would at least see if this particular error message may have an easy fix. I clicked "Detect encoding" and receive: "Could not detect encoding". The "Load file preview" tab is blank. The "Image preview" tab shows a page name, a image path beginning with a "." and the preview saying "Image file cannot be read: ... Paths may not be correctly configured." (same problem using absolute paths). Example: Y:\<...>\DATA\. \<load file folder name>\Images\00001.jpg I did look at the .DAT file contents briefly and the fields/delimiters look OK. Thanks.
  13. Hi group. I am performing my fist exports of tagged data with Intella and am wondering if you have any pointers/suggestions for a good naming/numbering scheme. The protocol does not specify any specifics for naming/bates stamp conventions. - just that each tiff/page needs a unique number with no gaps. One party wants a load file (with TIFFs), another party wants just PDF renderings of everything (they don't use a review platform). I suppose I could perform the export as a load file "type" (export screen 1). On the "Load file options" screen I can check both the "Include image files" (with format TIFF) and the "Also include PDF versions of images" option (for the party who only wants PDF). "File naming and numbering" screen: After some testing (and following along with the Intella Load File Ceation youtube video) I am not sure I am selecting the ideal naming/numbering scheme. Any suggestions here? Would a good scheme that works for both parties (one with a review tool/load file and one without a review tool - just looking through PDF renderings) be something like: <Unique number for each file starting at 00001>.<page number of that file> ? So, for example, a Word doc with 2 pages followed by a Word doc with 1 page would be something like: 00001.001, 00001.002, 00002.001 - not sure how this would play out with email messages and attachments. Any guidance would be welcome (favorite naming/numbering options, etc) - Thank you.
  14. Amazing! Thanks - I'll give it a whirl later today. As always, thanks for the assistance.
  15. Hi group. I am using Intella Pro 2.2. I have been asked to produce some tagged files in load file format. The protocol states a field should be included, "CONFIDENTIAL", "Y or N will be noted in this field. This field defines whether or not a document has ben designated as "Confidential."" I have researched the load file creation screens and do not see how to include this field. On the "Load file options" screen, I checked "Exclude content" with the confidential tag applied and the Placeholder text "CONFIDENTIAL." On the "Load file field chooser" screen I see no way to create a field as described in the protocol (Name: CONFIDENTIAL, Type: ??, Value: ??) <- Y if a file is tagged confidential, N if not tagged confidential. Any ideas? Thank you in advance.
  16. I have a question about creating a load file. One of the load file metadata fields I was instructed to incorporate is (per the ESI protocol doc): ATTACH_RANGE Description: Beginning and Ending Attachment numbers for parent and children. The number should be BEG_NO of the parent and END_NO for the last Child. Looking at page 190/191 of Intella manual, this seems they want RECORD_ID_GROUP_BEGIN and then RECORD_ID_GROUP_END. If so, then how would I associate two Intella types to one new custom field "ATTACH_RANGE"? Thanks.
  17. I searched for an OCR candidate procedure and ran across this older conversation (as well as the "Sample checklist for users" post). I still am wondering ... Using Intella, how best to identify the files I should OCR? Perhaps, use the Images "Type" facet and preview all of them? Preview all of the "Empty Documents" in the "Features" facet? Are the above 2 steps alone satisfactory? Any guidance on a procedure(s) to locate files needing OCR would be very welcome
  18. Thank you kindly - Adam and Alex. Makes perfect sense now.
  19. I notice that an email message has both an MD5 hash value and a message hash value. I understand, from the manual (14.1.17), the derivation of the Message Hash for email - but I am not sure why I am also seeing an MD5 hash value. I thought MD5 was only calculated for binary/loose files - how is MD5 calculated for email messages? Is the MD5 value for email messages just as valuable for email messages in determining uniqueness? Thanks.
  20. I am curious - has the feature for bates page numbering in PDF exports been added? Thanks.
  21. I found this thread from a forum search, though it is quite dated (2013). I am also interested in being able to customize the fields displayed in the report file(s) generated after exporting using the "export highlighted results". Is this still not customizable/configurable? Thank you.
  22. Thanks for the suggestion. Didn't seem to fix the issue. I moved the .opt and .dat files out of "DATA" and into "PROD004". So now, the structure is: Received_Productions\PROD0004\PROD004.dat Received_Productions\PROD0004\PROD004.opt Received_Productions\PROD0004\DATA\ <- (now empty) Received_Productions\PROD0004\IMAGES\ Received_Productions\PROD0004\NATIVES\ Received_Productions\PROD0004\TEXT\ - pretty much same as before. All looks good on "Load file preview". "Successfully validated. Found 35 columns." "Image preview" states: (with use absolute paths checked): Image file cannot be read: .\PROD004\IMAGES\IMG001\LUN0002_00001104.pdf Paths may not be correctly configured (with use absolute paths unchecked): Image file cannot be read: D:\Received_Productions\PROD0004\.\PROD004\IMAGES\IMG001\LUN0002_00001104.pdf Paths may not be correctly configured I'll keep tinkering. Thanks again for the suggestion.
  23. Hi All, I just received my first load file and walked through the user manual for importing. I seem to be facing one issue (at the moment:): The load file is comprised of 4 folders: PROD004\DATA, PROD004\IMAGES, PROD004\NATIVES, PROD004\TEXT. Step 1: Import Load File = seems to be fine (point to provided .dat and .opt) Step 2: The "Load file preview" tab states: "Successfully validated. Found 35 columns." (I see the columns and populated data) The "Image preview" tab states (for each entry/row): "Image file cannot be read: .\PROD004\IMAGES\IMG001\LUN0002_00001104.pdf Paths may not be correctly configured" - I've tried toggling the "Use absolute paths" checkbox to no avail. I guess my problem revolves around the relative path single dot (current directory). - With "Use absolute paths" unchecked, I see stated: "Image file cannot be read: D:\Received_Productions\PROD0004\DATA\.\PROD004\IMAGES\IMG001\LUN0002_00001104.pdf Paths may not be correctly configured" Do I need to move some folders around? Any suggestions? Thank you in advance.
  • Create New...