Database evidence size report

[Brad Ott]

Is there a way to get a report of all the cases and total evidense size of each? I have 700 databases but want a report of each.

[Brian K]

No, there is no such functionality. You could write a script however to read all case files and generate such a report. The total size of evidence in a single case is available in the case.xml file.

[Brad Ott]

Thanks. That maybe helpful, never thought to look there. 

[Jacques B]

On 5/21/2024 at 2:53 PM, Brad Ott said:

Is there a way to get a report of all the cases and total evidense size of each? I have 700 databases but want a report of each.

That's an interesting question so it got me thinking how it could be done with PowerShell. With some help from ChatGPT to get me going, I wrote the attached PowerShell script. Just remove the .txt extension to run it.

It starts searching recursively for case.xml from the folder you are located in. So run it from the root of your cases folder. You could change that by prompting for a folder to start at. Or hardcode it for your use. And it also currently outputs to a fixed filename: case_report.csv

You could also edit the script to add a date/time in the file name to make it unique each time you run it. Or allow you to provide an output file name.

And you could edit it to extract more info. I did note that if I tried to extract the created date as well, it stopped producing it as a single line per file. I didn't bother trying to correct it, and reverted to only one date.

It converts from bytes to GB by dividing by 1024 three times (KB, MB, GB). You could change that if you want.

I'm sure it could be cleaned up a bit more. But for now, it's a minimum viable product that should produce the output you want.

 

list_cases.ps1.txt

[admin]

Hi Jacques,

Thanks for doing this. We checked it, and it works well. 

Great work... 

[Jacques B]

 

I decided to tweak the script and add a few comments in it. The script also now prompts you via a GUI to select the root case folder for your Intella case files. And it now saves the output report to: "Case Report (dd_MMM_YYYY-HH_mm_ss).csv".

This will avoid name collisions (vs previous script with a static file name), and it will allow you to keep historical reports and see when they were run based on their file name.

It would actually be a useful feature to build into Intella Connect - the ability to create such a report from within the GUI rather than needing to rely on an external script.

Same as earlier, remove the .txt from the file name so that it's recognized as a PowerShell script. You can then run it with PowerShell, or PowerShell ISE.

I also renamed the script so that it's more indicative of what it does.

I do note that when you open the report as a text file, it looks fine. If you open it in Excel, it puts all columns into a single one. So there is room for improvement. But it's still an improvement over the initial version. I'll play around with trying to fix it so it better loads into Excel.

Intella Cases Report.ps1.txt

[Jacques B]

OK, that wasn't as hard as I thought (thanks Google :)).

Here's the updated version that now properly outputs it to a CSV. To open it in Excel, you need to start with a blank spreadsheet, click on Data, then choose the option to load a CSV file (on the left, "From Text/CSV").

It will present you with another window where you can transform the data if needed (shouldn't be necessary in this case). Click on Load, and voilà.

Thanks to @Brad Ott for raising this question, as it prompted me to come up with a solution that I can see being very useful in the future to help identify aging cases that might need to be archived off the server, and to identify our storage usage/needs over time.

Intella Cases Report.ps1.txt

[Brian K]

 

Nice work. Thank you for sharing this. 

[Jacques B]

As a follow up, in some environments your ability to run scripts in PowerShell may be limited. If you run the script and see the PowerShell window flash on screen and nothing happens, it's likely because the execution policy needs to be changed. You can launch PowerShell ISE, drag/drop the script into it and hit the green "Play" button to execute the script. This way you'll see any error output from the script in the ISE environment (rather than a quick flash on screen). If you are in a corporate environment, you may need IT to assist you with allowing a PowerShell script to run on your computer.

To change the policy, you need to launch PowerShell, and then type the following command and hit ENTER:

Set-ExecutionPolicy -Scope currentuser

The will then present a prompt to you. Enter the following and hit ENTER:

Unrestricted

This will allow you to run the script, but you'll be prompted each time whether you want to allow it to run. This works fine. But if you want to be able to run that script (or others you have) without needing to approve it each time, you can do that by typing the following command in PowerShell and hit ENTER:

Unblock-File

You will now see a prompt.

Path[0]:

Enter the full path to the script. No need to use quotes even if you have spaces in your path. Quotes actually caused it to fail in my case, but typing the path (or copying/pasting and then adding \Filename) worked.

When you hit ENTER, you will see the prompt change as follows.

Path[1]

If you have another script you want to be able to run without getting a security prompt, enter it here. You will see an incremental # for each prompt so that you can enter additional PowerShell scripts that you want to always allow. When done, hit ENTER on a blank prompt. If it works, you won't get any error.

[Brad Ott]

Thanks for the script. Very helpful.