Jump to content

Search the Community

Showing results for tags 'de-duplication'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


  • W4
    • W4 - Forensic Triage
    • Wishlist Forum W4
  • Intella
    • Intella 10, 100, 250, Pro and TEAM
    • Wishlist Forum Intella
  • Intella Connect
    • Intella Connect/Node
    • Wishlist Forum Connect
  • Talking Tech with Vound
    • Webinars

Find results in...

Find results that contain...

Date Created

  • Start


Last Updated

  • Start


Filter by number of...


  • Start





Website URL







Found 2 results

  1. Hello! My apologies if this has already been address, but I could not find it through search. I am dealing with MST Exchange emails. The emails contain a mix of standard SMTP email address as well as Exchange X.400-style addresses. De-duplication becomes a big problem here. Emails that are otherwise identical have different message hashes when one email has the SMTP address and another email has an X-400-style address. Is there any way currently to de-duplicate these? I know that as of the latest version of Intella, you can configure Message Hash to ignore certain attributes (including headers and recipients). This should work, but I'd really like to have more fine-tuned control than this. Ideally, it would be amazing if Intella could intelligently recognize that two emails are identical even if they use a mix of SMTP and X.400-style addresses. From my experience, this issue is very common in dealing with Exchange exports. Any thoughts would be greatly appreciated. Thank you! Bryan
  2. Having selected the results I require and then de-duplicated them, I can export the highlighted results in original format with a csv report. Am I right in thinking that the original source location will only report one instance of the particular file. Is there any way that I can export the de-duplicated original format of the file (thus reducing the amount of data exported and reviewing to be done) but produce a report which shows all of the locations on which the particular file resides. On the current job I have around 50,000 files from 10 sources, which de-duplicates down to around 3,000. It seems onerous expecting the investigator to keep reviewing the same file, but it may be of evidential value that a suspect file is on one or more of the computers. I know ideally they could do that within Intella, but that isn't practical at this time. The only way I can think of is exporting the individual csv reports from each source and somehow merging them. Any thoughts gratefully received. The version is Intella Team v7 by the way. Thanks
  • Create New...