Jump to content

Items from the same family in a batch


jmacedo
 Share

Recommended Posts

Hello, everyone,

Here again with a question:

My client got 8968 documents through an specific search string. The next step is seperate it in batches with 1000 documents.

If I keep "Keep items from same family together" assigned, it just created a single batch with 8968 documents. If I unassign this option, I'm able to create a lot of batches with 1000 documents.

The question is: What is considered family in this case? Type of document (doc, word, pdf), keyword, same search string... Any other thing?

 

Thank you!

Link to comment
Share on other sites

Hi jmacedo,

 

When creating batches and using "Keep items from same family together" Intella Connect will do two things:

  1. Detect items belonging to the same family and make sure they end up in the same batch
  2. Sort items by "Family date" and make sure all batches and items inside them are sorted in a chronological order

When families are being detected Connect will traverse item's location upwards in the hierarchy tree and find family root. Any two items with the same family root end up in the same Family. When determining family root these items are ignored:

  • folders
  • email containers (like PST and such)
  • disk images
  • forensic containers
  • registry artifacts

The 2nd step with sorting guarantees to you that batches and items inside them are ordered chronologically when you are reviewing them. Ex. last item in "batch 1" is from January 31st and first item in "batch 2" is from February 1st. However, to guarantee that items are sorted properly batch size can be extended to accomodate items from other families if they happen to have a date which falls within the timeframe of a batch. This can make batches larger, but is sometimes more convenient for reviewing purposes.

 

It is up to you which option you prefer to use. If you see that a batch is too large I suggest start investigation with identifying item's family roots and take it from there.

  • Like 1
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
 Share

×
×
  • Create New...