Jump to content

Reporting De-duplicated Results


Jerry_W

Recommended Posts

Having selected the results I require and then de-duplicated them, I can export the highlighted results in original format with a csv report. Am I right in thinking that the original source location will only report one instance of the particular file.

 

Is there any way that I can export the de-duplicated original format of the file (thus reducing the amount of data exported and reviewing to be done) but produce a report which shows all of the locations on which the particular file resides. On the current job I have around 50,000 files from 10 sources, which de-duplicates down to around 3,000. It seems onerous expecting the investigator to keep reviewing the same file, but it may be of evidential value that a suspect file is on one or more of the computers. 

 

I know ideally they could do that within Intella, but that isn't practical at this time. The only way I can think of is exporting the individual csv reports from each source and somehow merging them.

 

Any thoughts gratefully received. The version is Intella Team v7 by the way.

 

Thanks

Link to comment
Share on other sites

Hello Jerry,

 

I would recommend the following:

  • Export the deduplicated set as a CSV, as you already do.
  • Set the table back to non-deduplicating mode.
  • Add the Duplicates column and sort by it.
  • Tag all items that have two or more duplicates.
  • Let the table show all these items (i.e. equal to your original set but with the unique items removed).
  • Add the MD5 and Message Hash columns.
  • Sort by these columns (use CTRL-clicking).
  • Export the table to CSV.

You then have a second CSV file containing all items with duplicates, with their locations adjacent.

 

Would that work?

Link to comment
Share on other sites

Chris,

 

Thanks for your suggestion. Your method would partially achieve the result required. I usually add a column to my spread sheet to include a hyper-link to the relevant file and I was hoping I might be able to have multiple hyper-links pointing to the same target file. I am trying to see if I can get everything on one spread sheet with one data set.

Link to comment
Share on other sites

×
×
  • Create New...