I have been working/experimenting with Intella on a recent case. We had a rather large EDB file and were having trouble carving psts out of it. We ended up using Paraben's Network Examiner, which did a solid job of allowing us to carve the individual PST files out of the EDB for processing. I then took one particular PST file and threw it into Intella. When the discovery of items that potentially had attorney/client privilege, I decided to you the sorting to insure that I separated the items.
So first I tagged all the items with email addresses from two different law firms as Privileged. I then selected that tag, exported all the items out as a PST with no issue. When I then proceeded to tag everything that didn't have a privileged tag as Not Privileged and then did another export, this time for almost 14 gigs worth of PST. When I through the PST files into MS Outlook to make certain the privileged info was gone I saw that despite my efforts, the exported PST that was supposed to contain only NON-Privileged tagged items actually contains privileged items.
Now in response to a reply from Vound, I did explore the tagging options, but even selecting those properly, I continued to have issues. Now I am not certain if the pst we carved out of the edb just contains problems, certainly I actually saw a PST file in the main PST listed under the files in the intella view. When I selected that file and tag anything, it tags every single file. I ended up having to take the raw PST file, put it in MS Outlook, wait for it to index the 14gb of emails and then delete them through outlook before forwarding the PST to the investigators. I will continue to tinker with it, I just feel like I am missing some logic here that would make all of this easier.
