[locked] Wish list/suggestions V1

[AdamS]

Would it be possible to have a 'select/deselect all' button for the tags.

 

If I have 1000 tags on a large case quite often I have multiple tags on files. Currently if I want to remove all tags except one I get have to click in each box of the tags I want to remove. If we could simple 'select all' then take the tick out of the one we want to keep would save my little fingers from RSI

 

And while I'm discussing untaggin it appears there may be a glitch? As it generally takes 2 or 3 attempts before all the excess tags are removed. I'm not sure if there is an inbuilt limitation on the amount of tags that can be unselected at a given time maybe? To confuse me more sometimes there are clearly more tags on a file but they don't show up in the remove window, see attached pic.

 

Edit: looks like this is a viewer issue. I'm working over viewer and there were some tags done locally on the machine yesterday. So I can't see/alter the tags made outside of viewer *facepalm

[Chris]

Hi Adam,

 

I've made a note about (de)selecting all tags at once. Thanks for the tip!

[AdamS]

Thought I'd add my fields in the report to this thread and expand on it a bit.

 

The ability to add fields to the reports beyond the default Intella selected ones, ie Tags etc..

 

Also, it would be absolutely fantastic to have the option for the body of the email to be displayed in the reports as well. Ideally this would be a expand all/collapse all option at the very top of the report, along with an expand/collapse option for each email (HTML only obviously). The reason for this is pure and simple searchability.

 

If I can expand all I then effectively have a single page with the body and headers of all emails in the report and my clients can very easily search through the results to locate emails of relevance. Currently there is no way to easily search the email body's from the reports without using third party search tools. Obviously this is something Intella Connect addresses for my clients with a little more money to spend, but some of the small clients may not want/need this service but I still need to give them an effective way to search through the data I give them.

 

[Chris]

Hi Adam,

 

You are referring to the export reports (in PDF, RTF, HTML and CSV formats), right? How about using the PDF export type and using the concatenation option, does that not achieve the same?

[AdamS]

You are correct if I choose to export to PDF instead of original format I can have a single PDF document which include the body of each email.....but it is not an elegant solution. Maybe for a few emails you could work with it but for many thousands of emails it is not ideal. In addition there is no way to really work within the document by way of sorting or isoloating key area's. PDF I've always found is great for printing an emailing, but when you want to work with something the HTML or CSV (Excel) are always preferable.

 

The ability to cusomise the reports would be extrememly powerful for us to work with. Include or exclude the body based on needs, having the body as a field in the CSV report as well as the working hyperlinks to the original gives you a very powerful report which can be customised easily. I'm sure you guys have seen the Excel reports that UFED Physical Analyser software prepares, with the filters for each column of the report. That is what I'd ultimately love to see Intella capable of producing. Those Excel reports are very simple and incredibly easy to work with.

[Chris]

Thanks for the feedback, we will look into those Excel reports. I haven't myself, but some of my colleagues may have.

[AdamS]

Thanks Chris, I'm more than happy to email you an example if you like. I have a test report created from an old phone of mine which had been properly sanitized first

[Jerry_W]

A request from one of our users is in relation to the thumbnail view. I have found within the Preferences section there is the ability to filter based on the size of the original file. The request is to be able to increase/decrease the number of thumbnails shown at any one time thus increasing/decreasing the size of thumbnail displayed. This can be particularly helpful as pictures can often be found in large batches so that system icons can be previewed en masse but more inspection may be required for photos in the Users\My Pictures folder, for example.

 

Jerry W

[AdamS]

Any update on my below wish from late last year? I find myself doing this constantly and losing my place

 

Edit - Sorry, I'm working on a few jobs at the moment which are very email intensive so I'm coming up with lots of little things and rather than do one big post I'm posting as I come across them so I don't miss any. A small issue which should be easy to fix. When previewing an email it generally opens up center of screen which puts the top half in the screen where the coloured ball is, and the bottom half where the list is. When I've finished previewing I close by the red X top right. If i miss that red X and click out in blank space next to the coloured ball the focus shifts and I deselect the coloured ball which I happen to be viewing. So far not a major problem, but when I reselect the coloured ball I have gone back to the top of the list and effectively lost my place so to speak.

Could an option for "resume last view" or something similar be put in place? Either as a check box in the preferences or with a quick pop up yes/no option when you reselect the ball..

[AdamS]

Also below, any likelihood of changes/updates in the near future? My lawyer clients absolutely love timeline graphics for court and if I can give them a pretty picture with click-able links they just may crown me their undisputed emperor

On a more basic level it would be great if we could change the size of different columns in the timeline which would allow the full email address to be exposed prior to creating a graphic. Currently email addresses which also have a known name or nick name next to them are truncated and not shown in the export picture.

 

I love the timeline feature, this is a great way to show small data sets in a meaningful fashion, however I'm hoping you already have plans to take it further.

Currently exporting the graphic is a good first step, I'd love the ability to be able to create a report based on the timeline.

Ideal would be a HTML or some form of interactive report which visually appears very similar to the way the timeline looks within Intella, then have the abliity to click on the links and view the email as you can from within Intella.

 

[Chris]

Hi Adam,

 

The Previewer close operation and the suggested Timeline improvements have not been addressed yet. We may still do that in a future release - the problem is definitely not a lack of good ideas

 

You did ask "could we have an option for the email address facet filter to have "no filter"? ". This is now possible, the Email Address facet recently received a couple of new branches:

• The "All Senders and Receivers" branch combines all addresses found in the From, Sender, To, Cc and Bcc headers, i.e. all addresses regardless of their sender or recipient role.
   
• The "All Addresses" branch merges this list with all addresses found in the document and email texts. The latter are also listed separately in the "Addresses in Text" branch.

[AdamS]

Hi Chris, I noticed the new email address filters, and the dynamic 'live' filter search option down the bottom which is brilliant, love it!

 

Something I'd requested previously was the option to export selected emails in an HTML format where the body of the emails could be optionally exposed, possibly by some sort of 'expand body' option for each individual email, then also with a master 'expand all' button at the top as well.

 

The reason for this is search-ability. I can export emails as a single PDF file now and achieve that ability to search across the body, but one long PDF of 10,000 plus emails is not ideal and can cause issues trying to open such a large PDF file.

 

Currently the only way to search across the body of exported emails (apart from PDF), is to either open each email individually and then search, which is not a workable solution, or have me export the emails to a PST, which they can then import to Outlook then use Outlook's own search functions.

 

The PST option is fine to a degree but it doesn't protect the integrity of the emails once they have been imported and can cause issues if relied on for court or any disciplinary hearings and the like.

 

The only other option I can think of is some sort of 'bastardization' of the viewer concept you already have, whereby we can create an Intella load file with the emails for our client which they can then view via a special customer version of the Intella viewer software which allows nothing more than keyword, tag and export options. The Intella load file being proprietory so the clients couldn't use the viewer software to conduct their own email analysis.

 

Cellebrite have a similar type of software that is free to use so we can create a UFED dump of a phone then give that dump to a client with the viewer software and they can then view the phone data in a GUI almost identical to the full suite but with limited options.

 

This may not really be on the road map for Intella but I would really like to see something that gives our clients the ability to search effectively across any reduced data set we give them, even if this comes at a small cost, ultimately I think it will be worth it if we can add significant value to the end product for our clients.

[Primoz]

Hi Adam,

 

We will take your ideas into consideration for sure, but for now we can't make any promises if and when those functionalities will take place.

 

Currently this could be achieved with the use of Intella Connect:

The reduced data set could be exported in Original format. From the mentioned exported set new case could be created and shared with Intella Connect. That way your clients could access the case of reduced data set with the use of the browser (if they are provided with credentials).

 

Please note that ACLs are something we would like to incorporate into Intella Connect. With mentioned feature it can be possible to share only the portion of the case.

[AdamS]

Hi Primoz

 

I'm thinking Connect might be the way for me to go here too, I'll just have to be a bit creative when selling that option to my clients.

 

The current basic ACL is good with the authorizations of certain users to certain cases, I'm looking forward to the further controls as they come.

[PF1]

Don't mean to intrude on your thread AdamS, but I have encountered an issue I would like to see addressed in a future realse and thought I would post it here.

 

Per this thread (http://community.vound-software.com/index.php?/topic/98-boolean-expressions/) it has been confirmed that Intella100 can not handle boolean nested search phrases.  This is a common method of searching for me and I would love to see it added.

 

Example:

 

Find either pink or blue or yellow within 15 words of green or "light brown" or black.

 

DTSearch boolean expresison would be (pink OR blue OR yellow) w/15 (green OR "light brown" OR black) = WORKS

 

Intella boolean expression would be "(pink OR blue OR yellow) (green OR "light brown" OR black)"~15 =FAILS due to the "light blue" nested phrase (Query Syntax Error)

[AdamS]

No hijack needed PF1, I started this thread hoping anyone would post their thoughts/suggestions here so the Intella folks would have less places to look for our feedback

[forensicdan]

I received some feedback from our LAN administrators.  We have multiple cases up and going at any one time on the go and switching between cases.  Intella server (sharing) is our preferred environment and seems to be working out well.  However, have the designers considered making the server (master) as a "Service" on a machine to facilitate a true server-client relationship in a LAN environment?  Our admins would like to have it as a service instead of having to login, start-up the intella server and logout at the end of the day (security reasons).

[Andrej]

Hi forensicdan,

 

The ability to start an Intella server as Windows service is indeed on the roadmap for Intella Connect.

[AdamS]

Hi Intella

 

So after a nice long break for Xmas etc I find myself back in the thick of things and have a suggestion to add to the list.

 

When viewing the created tags there is a small + next to the tag which when clicked on shows the user that created said tag, which works beautifully when you have multiple users tagging with Connect etc, however if you have 1000 or more tags created and you have to collate some sort of list of who created each tag, this is quite a labor intensive operation. Would it be possible to have an 'expand/contract all' option at the top of the tags so we can quickly expose all this information in the first instance, and following that the ability to export to an excel or CSV this information would be an added bonus.

[DaveLUK]

Indexing Internet History

 

Hi

 

Could some consideration be given to introducing the indexing of  Internet History. I work in law enforcement and internet history is often a rich source of relevant evidence. At the moment we are exporting it out of our forensic software as a spreadsheet and then manually adding to the Intella case.

 

Chrome, IE, Firefox and Safari are the most common browsers we encounter although there are a number of others that we don't see as often such as Opera.

 

Keep up the good work.

 

Dave

[Jerry_W]

Going back to one of my earlier requests, I am still finding it difficult to find a solution for excluding specific data from some users. I don't know whether this is a trend or my bad luck but I am having a lot of cases that require independent review for legal professional privilege material. Such material is successfully tagged by the reviewer but then by its nature needs to be kept from view of investigating officers.

 

Is there any way that when setting up a tag there is facility to add a password to be able to view material that is so tagged? This would be particularly helpful for this LPP material but also for any identified indecent material perhaps. I am sure there are others.

 

 

[DaveLUK]

Going back to one of my earlier requests, I am still finding it difficult to find a solution for excluding specific data from some users. I don't know whether this is a trend or my bad luck but I am having a lot of cases that require independent review for legal professional privilege material. Such material is successfully tagged by the reviewer but then by its nature needs to be kept from view of investigating officers.

 

Is there any way that when setting up a tag there is facility to add a password to be able to view material that is so tagged? This would be particularly helpful for this LPP material but also for any identified indecent material perhaps. I am sure there are others.

 

This would be a really good idea. At present the only way we've found to do it is outside of Intella - ie create new logical image files with the LPP excluded and then create a new Intella case using these.

[arjohn]

I'm happy to say that the ability to hide specific items based on tags is scheduled for inclusion in Intella Connect 1.7.3, which should be available in the second half of March.

[AdamS]

I know I've mentioned this before but it's becoming are very common theme when giving my clients copies of emails.

 

Could the default 'native' export option for Intella be changed to .msg rather than .eml?

 

Or at the very least an option to export to .msg?

 

.msg would seem to be a more compatible format considering the majority of people in the corporate world use Outlook.

[Chris]

I can see why it can be useful, so it remains strongly on our wishlist (though with many other items).

 

If in a specific task exporting to MSG is a must, would exporting to a PST and then extracting the individual MSG files with a third party tool be an option?