Items from the same family in a batch

[jmacedo]

Hello, everyone,

Here again with a question:

My client got 8968 documents through an specific search string. The next step is seperate it in batches with 1000 documents.

If I keep "Keep items from same family together" assigned, it just created a single batch with 8968 documents. If I unassign this option, I'm able to create a lot of batches with 1000 documents.

The question is: What is considered family in this case? Type of document (doc, word, pdf), keyword, same search string... Any other thing?

 

Thank you!

[ŁukaszBachman]

Hi jmacedo,

 

When creating batches and using "Keep items from same family together" Intella Connect will do two things:

1. Detect items belonging to the same family and make sure they end up in the same batch
2. Sort items by "Family date" and make sure all batches and items inside them are sorted in a chronological order

When families are being detected Connect will traverse item's location upwards in the hierarchy tree and find family root. Any two items with the same family root end up in the same Family. When determining family root these items are ignored:

• folders
• email containers (like PST and such)
• disk images
• forensic containers
• registry artifacts

The 2nd step with sorting guarantees to you that batches and items inside them are ordered chronologically when you are reviewing them. Ex. last item in "batch 1" is from January 31st and first item in "batch 2" is from February 1st. However, to guarantee that items are sorted properly batch size can be extended to accomodate items from other families if they happen to have a date which falls within the timeframe of a batch. This can make batches larger, but is sometimes more convenient for reviewing purposes.

 

It is up to you which option you prefer to use. If you see that a batch is too large I suggest start investigation with identifying item's family roots and take it from there.

[jmacedo]

Thank you!