Alex

Hi Adam, I recommend to open a support ticket for this issue.

Hi, > Is there a way to import a table containing various MD5 hash values and use it to match messages or attachments in an Intella case? You can import MD5 hash list into the "MD5 and Message Hash" facet panel for search. Please refer to the section 13.1.13 "MD5 and Message Hash" of Intella User Manual. > One is labeled "MD5 Hash" and the other is labeled "Message Hash." What is the difference, since both MD5 values ostensibly pertain to the same message? MD5 hash captures every detail of the message (including source-specific technical information) that is often not too useful for finding duplicate items. For instance, it is not uncommon if two copies of the same message get different MD5s if retrieved from different PST files. In contrast, Message Hashes are calculated only from message body and substantial headers, thus allowing loose message copies to be found. See the same section of the User Manual for detailed explanation between those types of hashes.

Hello, I recommend to submit a support ticket on http://support.vound-software.com. Our engineers would investigate this issue and provide a solution as soon as possible. Please attach a copy of 'cases.xml' file from '%APPDATA%\Intella' folder and the latest log file from 'logs' subfolder to the ticket. Thank you!

Hello Adam, 'resign' will not be detected within 'resignation', unless a wildcard search 'resign*' is used. It's always worked this way.

Hello Adam, Since 1.8.3 version, the format of keyword list files was changed to CSV (comma-separated values). A side effect of this transition is impossibility of using comma characters in KW list queries. This will be fixed in the next Intella version. As a workaround for the current version, we recommend to remove commas from queries. Comma characters are meaningless for search, so they can be dropped out without any effect on the results.

Hello Adam, Can you please take a look at the top of your indexing log file and check for some diagnostic information? The interesting lines are: "Detected RAM: ..." "Max heap size: ..." "Detected ... CPU cores" "Using ... crawlers based on system parameters" "Using ... MB memory per crawler based on system parameters" Update: Also, if you changed anything in intella.l4j.ini file, please show it as well.

Possible explanation is that the message contains a "rich-text" part with missing or incorrect charset specification. Depending on situation, the plain-text or rich-text version of the email is displayed. The "Contents" tab of Intella previewer always shows a plain-text message version, while the "Preview" shows a rich-text part, if it is available. MS Outlook also prefers the rich-text part to show by default (this can be changed in the Trust Center Settings). Exporting to EML or PST tries to preserve as much original message details as possible, so this is likely a problem of the specific original message.

Hi, In the past, we received numerous complains about confusing results caused by incorrect syntax of queries from real-world keyword lists files. So, in the new release, we added a preemptive sanity check which validates every single query read from a keyword list. Unfortunately, it turns out that this validation procedure misses the case of queries with wildcard characters in leading position. This will be fixed in the next Intella release which is just a couple of weeks away. We are sorry for inconvenience.

Hi, These warnings may indicate a variety of problems: Corrupted source files Non-standard extensions to file formats and other format irregularities File format is too old and not supported You can try to fix old format issues by converting the problematic files to a newer format with their native applications. MS Office formats are supported for Office 97 (8.0) version and above. "In-Reply-To header" message indicates missing single metadata entry: this should not indicate any loss of message text content.

Hi, This indicates that the JPEG library used by Intella was unable to parse metadata from this image item due to anomalies of the image format. Probably, the original image file was corrupted or produced by a tool not fully compliant to the JPEG spec.

Hello Rishabha, Exporting time is mostly spent for original format and PDF/image rendering, so disabling it speeds things up a lot. If this is not an option, reducing image resolution may also help, though at the cost of degraded printing quality. Unfortunately, I cannot think of a specific disk (Optimization folder) configuration that would make the process faster

Hello Adam, I guess, by ICW you mean IWR (Intella Work Report) files. This should work for work reports produced by Intella 1.6.4 and later (all 1.7.x) versions. Please try. To find the matching items between cases, MD5 hashes are used in the work reports. So, as long as MD5 values of items are the same (item content and metadata is unchanged), the tags will be relevant. Please index your sources with the final release. Cases indexed in beta releases are unlikely to be compatible with any other version.

Hello Adam, For the first two examples, a regular expression might work: /[0-9]{3}\-?[0-9]{3}/ This won't work for the third case, however, as it includes a token delimiter (space), So the final query should combine that with a phrase pattern: /[0-9]{3}\-?[0-9]{3}/ OR "[0-9]{3} [0-9]{3}"

Hi Adam, Proximity search doesn't work on characters level. Perhaps, you might use phrase or proximity search with wildcards to find instances of "total" and the word next to it: "total *" - any word "total $*" - any word beginning with "$" (e.g. "total $1000") "total $???" - any word of 3 characters beginning with "$" (e.g. "total $999") "total $???"~2 - same as above but possibly separated by another word (e.g. "total USD $999") and so on. Unfortunately, there is no functionality to export the results in a form that would preserve the word hits.

Hi I would recommend to take a look at the Smart Search feature of Intella. If at least one relevant document is known, the Smart Search can assist you to identify which documents are potentially relevant as well. Unlike duplicates identification, the Smart Search ignores document format and minor textual differences, returning documents that share only significant keywords with the sample. Repeating this procedure for more documents found (and perhaps, combining it with other search tools, like proximity or wildcard search), it should be possible to to identify the entire set of relevant documents. This however will not work for non-searchable PDFs - they should be OCRed beforehand. HTH

Hi You can try regular expression search, like /[0-9]{9}/ -> "digits from 0 to 9 repeated 9 times" But please be aware that RegEx search support is still experimental in Intella.

Hello Phil, This is an effect of a special way the email addresses are treated in keyword search. They are indexed as individual search units, so for any keyword found within an email address, the "hit" is the entire address, not that separate word. This is a default behavior, not specific to phrase or proximity searches. I'm afraid that this is not possible to change this in the current versions.

Phil, The Java vulnerabilities are about possibility of writing a malicious code that may circumvent the Java security model to get an unauthorized access to the system. This mostly concerns the applets executed in a web-browser using Java plug-in. As it was pointed out in the comments to the KrebsOnSecurity article, it is enough to disable the Java plug-in in the browser to be on the safe side. This does not mean any security risk for the users of regular trusted applications built on the Java platform. The Java Runtime Environment distributed as a part of the Intella installer does not contain Java plug-in, so installing Intella does not compromise your system security by no means.

Hi, Nested phrases are not permitted by query syntax, so using "pink ribbon" within a proximity expression (which is also a phrase query) will result in a syntax error. You can make "pink ribbon" a separate phrase query and consider the results in intersection with the proximity query.

Hi, This query should work: "(red OR blue OR green) (orange OR pink OR yellow)"~10 Please note that hit highlighting is not supported for this type of queries yet.

Hello Adam, Intella 1.6.4 considers a separate special character (like "+") a syntax error. This contraint will be removed in the future versions by ignoring those single characters in queries. Note that Intella uses "AND" connection by default, so using "+" syntax is not necessary. The queries "john +david" and "john david" are equivalent (meaning "all documents with both words: 'john' and 'david'"), so you can remove "+" signs from queries in your list.

Hello Jason, To annotate documents in Intella you can use tags, flagging marks and comments attached to items in the database. The "Link annotation tool" button on the Preview tab is related to PDF preview functionality only. This is irrelevant to Intella annotation functionality and will be removed in future versions. Redacting documents can be done with appropriate external applications. It is recommended to reindex the Intella case after any changes were made in original documents.