tufelkinder Posted November 28, 2012 Report Share Posted November 28, 2012 Is it possible to export a set of tags and message/document hashes from one Intella case and import those into another case? For example, I have two cases that have some shared evidence and the cases have now been merged. I would like to also merge the tags from the two cases and evidence into a single case. Is this possible? Thanks, Walt -~ Link to comment Share on other sites More sharing options...
Guest KathleenK Posted November 28, 2012 Report Share Posted November 28, 2012 Hi Walt Currently, you can only export the values (names) of the Tags to a spreadsheet. There is no ability to import them to another case. The only way I can think of around this is to export the hash values for each set of tagged items. Import those hashes into your other case. Populate those values and retag. As far as merging two cases into a single case, that is not possible. You would have to add the second case to the original as a new source and reindex it. However, none of your existing work on the case would be included. It would like starting over on the second case. Link to comment Share on other sites More sharing options...
tufelkinder Posted November 28, 2012 Author Report Share Posted November 28, 2012 I'm fine with starting over and reindexing as a completely new case, except for the process of recreating all of the tags (around 2,100 between the two cases). What do you mean "import those hashes into your other case?" How is this process done? Thanks, Walt -~ Link to comment Share on other sites More sharing options...
Guest KathleenK Posted November 29, 2012 Report Share Posted November 29, 2012 Hi Walt: Select the tag for which you want to export the hashes and click search. This will populate them to the cluster map as a single cluster. Click on the cluster to display those results in the Details Pane. Highlight all items in the Details Pane (control +A). Right click and chose Export Table as a CSV. A menu will display where you can select the data to export. Select the MD5 or Message Hash. I would name the file with a reference to the tag for which it applies. In your other case (once you have added your new source), navigate to the MD5 and Message Hash Facet. Import the CSV. Highlight and click Search. This will populate all items with the same hash values. You can then tag those with your tag. Let me know if that helps. Link to comment Share on other sites More sharing options...
tufelkinder Posted December 4, 2012 Author Report Share Posted December 4, 2012 While this isn't the most efficient way imaginable, it is REALLY useful to have this feature. I was able to recreate a couple thousand tags in just a couple of hours using this method. Thanks Kathleen! Walt -~ Link to comment Share on other sites More sharing options...
AdamS Posted December 5, 2012 Report Share Posted December 5, 2012 This could actually work very well when working cross tools too. I use different tools for different jobs but having the ability to import a hashset from Xways forensics into Intella is immensely helpful. Great stuff. Link to comment Share on other sites More sharing options...
Pardhasaradhi Posted November 22, 2013 Report Share Posted November 22, 2013 HiIam trying using 1.7 , i have exported tags from one index and trying to import the tags in the backup copy where some more files are added to index but it is giving below error An invalid XML Charecter (Unicode:0XB) was found in the element of content of the document Looking for a work around Thanks Link to comment Share on other sites More sharing options...
Primoz Posted November 25, 2013 Report Share Posted November 25, 2013 Hi Pardhasaradhi, The error you get is unfortunately not enough for us to tell what exactly went wrong. We suggest you to open up a new ticket on our support system as we will need log files and work report that is causing you a troubles to help you with this. Link to comment Share on other sites More sharing options...
Recommended Posts