Reporting De-duplicated Results

[Jerry_W]

Having selected the results I require and then de-duplicated them, I can export the highlighted results in original format with a csv report. Am I right in thinking that the original source location will only report one instance of the particular file.

 

Is there any way that I can export the de-duplicated original format of the file (thus reducing the amount of data exported and reviewing to be done) but produce a report which shows all of the locations on which the particular file resides. On the current job I have around 50,000 files from 10 sources, which de-duplicates down to around 3,000. It seems onerous expecting the investigator to keep reviewing the same file, but it may be of evidential value that a suspect file is on one or more of the computers. 

 

I know ideally they could do that within Intella, but that isn't practical at this time. The only way I can think of is exporting the individual csv reports from each source and somehow merging them.

 

Any thoughts gratefully received. The version is Intella Team v7 by the way.

 

Thanks

[Chris]

Hello Jerry,

 

I would recommend the following:

• Export the deduplicated set as a CSV, as you already do.
• Set the table back to non-deduplicating mode.
• Add the Duplicates column and sort by it.
• Tag all items that have two or more duplicates.
• Let the table show all these items (i.e. equal to your original set but with the unique items removed).
• Add the MD5 and Message Hash columns.
• Sort by these columns (use CTRL-clicking).
• Export the table to CSV.

You then have a second CSV file containing all items with duplicates, with their locations adjacent.

 

Would that work?

[Jerry_W]

Chris,

 

Thanks for your suggestion. Your method would partially achieve the result required. I usually add a column to my spread sheet to include a hyper-link to the relevant file and I was hoping I might be able to have multiple hyper-links pointing to the same target file. I am trying to see if I can get everything on one spread sheet with one data set.