philrodo Posted August 18, 2015 Report Share Posted August 18, 2015 I recently sent a bunch of PSTs to a law firm that included emails that returned search hits. The PSTs were uploaded to a review platform and reviewed by the attorneys. They marked a few emails that had to be returned to the other party. Eventually, I got some of the logs from the review platform that included the emails that were returned and had to be deleted from the servers where they were stored. The only way I could track down these messages on the mail server, was to follow the file path. I noticed that the file path included the "_files" after each folder. For example, the user had created a "Save" folder which was exported to the PST as "Save_files." I thought that the "_files" string was added by the review platform, but when I opened the PSTs I found that Intella had added that string to the actual folder name for every folder that was exported. This is something I had not noticed before in all the years I've used Intella, as I usually don't open the PSTs after I create them with Intella. What is the rationale for adding the "_files" string after each folder name? This is basically altering the file metadata and could cause some issues with the preservation of the evidence if the production is challenged by the opposing party. I'm attaching a screen clipping of the folder structure inside the PST that was created after exporting the emails from Intella (I've blurred out some of the identifying information). Please let me know. Thanks. Best regards, Phil Link to comment Share on other sites More sharing options...
AdamS Posted August 19, 2015 Report Share Posted August 19, 2015 Phil what software are you using to open the PST file after you have created it? I couldn't duplicate precisely what you have shown there but I did have the _files appended to the root archive only, by that I mean the OST file I used as a test had the _files appended to the end in the new PST I created from a selection of the emails. Otherwise all other folders (inbox, outbox, sent etc) appeared normal. The pic below is as previewed in Outlook but even using Kernal PST viewer still shows the same. Link to comment Share on other sites More sharing options...
philrodo Posted August 19, 2015 Author Report Share Posted August 19, 2015 Adam Thanks for following up and for trying to replicate the issue. I used Outlook to open the PST. The emails were collected from Yahoo using Thunderbird which saved them to Mbox format. All the folders that had the "_files" string appended to the folder name had been created by the user (i.e., they were not the standard Inbox and Sent folders that come with a Yahoo webmail account). I checked the Thunderbird file structure and the "_files" string does not appear in the saved files. Actually, each folder that the user created to organize his files was downloaded as a separate Mbox file. So only when I used Intella to export the responsive emails to PST was the "_files" string added to the folders, which indicates that Intella must be adding that text. The question is why is this text added and could this be a bug? I can see no justification for changing the file metadata and altering the file path when we're trying to preserve the evidence in the same way we received it. I hope someone from Vound looks into this and responds. Thanks again. Best regards, Phil Link to comment Share on other sites More sharing options...
philrodo Posted August 19, 2015 Author Report Share Posted August 19, 2015 One other thought. In Adam's attempt to replicate the issue, the "_files" string was appended to the OST level, which in the case of an OST is the container file. Since my case dealt with Mboxes and each folder created by the user was treated as a separate Mbox container, perhaps this explains why the "_files" string is appended to the name of each folder (i.e., each Mbox file). In my case, the "_files" string was also being added to certain file attachments, like Zip files. In other words the file path for the contents of a Zip file attachment was expressed as "...\FolderName_files\email.msg\ZipFileName_files\file1" This is from memory, but I'm pretty sure this is close and I'm pretty certain that the Zip files had the "_files" text added to the Zip file name. This reinforces the notion that whenever Intella encounters a "container" (e.g., OST/PST, Mbox, Zip, etc.) it appears to append the "_files" text to the container name. Regardless, I don't see why the "_files" string should be appended anywhere, particularly as it alters the original file path that must be preserved as it was collected. Link to comment Share on other sites More sharing options...
Andrej Posted August 19, 2015 Report Share Posted August 19, 2015 Hello Phil and Adam, The "_files" suffix is being added in order to avoid file name clashes when exporting container and it's children. For example when exporting 4 files, one zip file called "Documents.zip" and 3 documents (DOCX), which are contained in the zip file, Intella will create "Documents.zip_files" folder and "Documents.zip" file in the export folder. Those 3 documents from zip file will be placed into "Documents.zip_files" folder. It is however not necessary to add this suffix when exporting to PST, so we will change this behaviour for PST exports in the next release. This issue is indeed larger with Mbox files than PST/OST, as every original folder is usually represented as a separate Mbox file. Link to comment Share on other sites More sharing options...
Recommended Posts