Jump to content

Recommended Posts

Is it possible to export a set of tags and message/document hashes from one Intella case and import those into another case?

 

For example, I have two cases that have some shared evidence and the cases have now been merged. I would like to also merge the tags from the two cases and evidence into a single case. Is this possible?

 

Thanks,

Walt

 

-~

Link to post
Share on other sites
Guest KathleenK

Hi Walt

 

Currently, you can only export the values (names) of the Tags to a spreadsheet. There is no ability to import them to another case. The only way I can think of around this is to export the hash values for each set of tagged items. Import those hashes into your other case. Populate those values and retag.

 

As far as merging two cases into a single case, that is not possible. You would have to add the second case to the original as a new source and reindex it. However, none of your existing work on the case would be included. It would like starting over on the second case.

Link to post
Share on other sites
Guest KathleenK

Hi Walt:

  1. Select the tag for which you want to export the hashes and click search. This will populate them to the cluster map as a single cluster.
  2. Click on the cluster to display those results in the Details Pane.
  3. Highlight all items in the Details Pane (control +A). Right click and chose Export Table as a CSV.
  4. A menu will display where you can select the data to export. Select the MD5 or Message Hash. I would name the file with a reference to the tag for which it applies.
  5. In your other case (once you have added your new source), navigate to the MD5 and Message Hash Facet. Import the CSV. Highlight and click Search.
  6. This will populate all items with the same hash values. You can then tag those with your tag.

Let me know if that helps.

Link to post
Share on other sites
  • 11 months later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
×
×
  • Create New...