Tagging

[hengst2404]

I have been working/experimenting with Intella on a recent case. We had a rather large EDB file and were having trouble carving psts out of it. We ended up using Paraben's Network Examiner, which did a solid job of allowing us to carve the individual PST files out of the EDB for processing. I then took one particular PST file and threw it into Intella. When the discovery of items that potentially had attorney/client privilege, I decided to you the sorting to insure that I separated the items.

 

So first I tagged all the items with email addresses from two different law firms as Privileged. I then selected that tag, exported all the items out as a PST with no issue. When I then proceeded to tag everything that didn't have a privileged tag as Not Privileged and then did another export, this time for almost 14 gigs worth of PST. When I through the PST files into MS Outlook to make certain the privileged info was gone I saw that despite my efforts, the exported PST that was supposed to contain only NON-Privileged tagged items actually contains privileged items.

 

Now in response to a reply from Vound, I did explore the tagging options, but even selecting those properly, I continued to have issues. Now I am not certain if the pst we carved out of the edb just contains problems, certainly I actually saw a PST file in the main PST listed under the files in the intella view. When I selected that file and tag anything, it tags every single file. I ended up having to take the raw PST file, put it in MS Outlook, wait for it to index the 14gb of emails and then delete them through outlook before forwarding the PST to the investigators. I will continue to tinker with it, I just feel like I am missing some logic here that would make all of this easier.

[Guest KathleenK]

When Intella processes items, it creates a parent/child structure. For instance, if you have an email that is forwarded as an attachment, and the original email has a PDF file attached, Intella views that as three separate items:

 

 

If you are looking at the PDF, it's parent is the Forwarded Email, and it's parent email is the Email. By default, Intella only tags the item you are viewing. Under File, Preferences, Tagging, you can select to Tag the item and it's children, or the item it's parent and children. For tagging privileged items, I would select the parent and children option to get the entire context. You can also select the option to tag all exact duplicates as well. That may be of use to you.

 

Once you have tagged all of your items with your privilege tag, you can exclude those from your subsequent searches. If you want to populate all items except for the privileged items in your case, select the Location facet, highlight your source PST and click on Search. Then click on the Tag facet, highlight your privileged tag, and click the down arrow next to the search button. Select Exclude.