EDiscovery_Reviewer_Guide Summation Reviewer Guide

2016-04-25

: Pdf Summation Reviewer Guide Summation_Reviewer_Guide 03 2016

Open the PDF directly: View PDF PDF.
Page Count: 383 [warning: Documents this large are best viewed by clicking the View PDF Link!]

| 1
Draft
AccessData
AD eDiscovery®
Reviewer Guide
AccessData Legal and Contact Information | 2
AccessData Legal and Contact Information
Document date: April 25, 2016
Legal Information
©2016 AccessData Group, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
AccessData Group, Inc. makes no representations or warranties with respect to the contents or use of this
documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any
particular purpose. Further, AccessData Group, Inc. reserves the right to revise this publication and to make
changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.
Further, AccessData Group, Inc. makes no representations or warranties with respect to any software, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, AccessData Group, Inc. reserves the right to make changes to any and all parts of AccessData
software, at any time, without any obligation to notify any person or entity of such changes.
You may not export or re-export this product in violation of any applicable laws or regulations including, without
limitation, U.S. export regulations or the laws of the country in which you reside.
AccessData Group, Inc.
588 West 400 South Suite 350
Lindon, UT 84042
USA
AccessData Trademarks and Copyright Information
The following are either registered trademarks or trademarks of AccessData Group, Inc. All other trademarks are
the property of their respective owners.
AccessData® DNA® PRTK®
AccessData Certified Examiner® (ACE®) Forensic Toolkit® (FTK®) Registry Viewer®
AD Summation® Mobile Phone Examiner Plus® Summation®
Discovery Cracker® MPE+ Velocitor™ SilentRunner®
Distributed Network Attack® Password Recovery Toolkit®
AccessData Legal and Contact Information | 3
A trademark symbol (®, ™, etc.) denotes an AccessData Group, Inc. trademark. With few exceptions, and
unless otherwise notated, all third-party product names are spelled and capitalized the same way the owner
spells and capitalizes its product name. Third-party trademarks and copyrights are the property of the trademark
and copyright holders. AccessData claims no responsibility for the function or performance of third-party
products.
Third party acknowledgements:
-FreeBSD ® Copyright 1992-2011. The FreeBSD Project.
-AFF® and AFFLIB® Copyright® 2005, 2006, 2007, 2008 Simson L. Garfinkel and Basis Technology
Corp. All rights reserved.
-Copyright © 2005 - 2009 Ayende Rahien
BSD License: Copyright (c) 2009-2011, Andriy Syrov. All rights reserved. Redistribution and use in source and
binary forms, with or without modification, are permitted provided that the following conditions are met:
Redistributions of source code must retain the above copyright notice, this list of conditions and the following
disclaimer; Redistributions in binary form must reproduce the above copyright notice, this list of conditions and
the following disclaimer in the documentation and/or other materials provided with the distribution; Neither the
name of Andriy Syrov nor the names of its contributors may be used to endorse or promote products derived
from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE
COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
WordNet License
This license is available as the file LICENSE in any downloaded version of WordNet.
WordNet 3.0 license: (Download)
WordNet Release 3.0 This software and database is being provided to you, the LICENSEE, by Princeton
University under the following license. By obtaining, using and/or copying this software and database, you agree
that you have read, understood, and will comply with these terms and conditions.: Permission to use, copy,
modify and distribute this software and database and its documentation for any purpose and without fee or
royalty is hereby granted, provided that you agree to comply with the following copyright notice and statements,
including the disclaimer, and that the same appear on ALL copies of the software, database and documentation,
including modifications that you make for internal use or for distribution. WordNet 3.0 Copyright 2006 by
Princeton University. All rights reserved. THIS SOFTWARE AND DATABASE IS PROVIDED "AS IS" AND
PRINCETON UNIVERSITY MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY
WAY OF EXAMPLE, BUT NOT LIMITATION, PRINCETON UNIVERSITY MAKES NO REPRESENTATIONS OR
WARRANTIES OF MERCHANT- ABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE
USE OF THE LICENSED SOFTWARE, DATABASE OR DOCUMENTATION WILL NOT INFRINGE ANY THIRD
PARTY PATENTS, COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS. The name of Princeton University or
AccessData Legal and Contact Information | 4
Princeton may not be used in advertising or publicity pertaining to distribution of the software and/or database.
Title to copyright in this software, database and any associated documentation shall at all times remain with
Princeton University and LICENSEE agrees to preserve same.
Documentation Conventions
In AccessData documentation, a number of text variations are used to indicate meanings or actions. For
example, a greater-than symbol (>) is used to separate actions within a step. Where an entry must be typed in
using the keyboard, the variable data is set apart using [variable_data] format. Steps that require the user to
click on a button or icon are indicated by Bolded text. This Italic font indicates a label or non-interactive item in
the user interface.
A trademark symbol (®, ™, etc.) denotes an AccessData Group, Inc. trademark. Unless otherwise notated, all
third-party product names are spelled and capitalized the same way the owner spells and capitalizes its product
name. Third-party trademarks and copyrights are the property of the trademark and copyright holders.
AccessData claims no responsibility for the function or performance of third-party products.
Registration
The AccessData product registration is done at AccessData after a purchase is made, and before the product is
shipped. The licenses are bound to either a USB security device, or a Virtual CmStick, according to your
purchase.
Subscriptions
AccessData provides a one-year licensing subscription with all new product purchases. The subscription allows
you to access technical support, and to download and install the latest releases for your licensed products during
the active license period.
Following the initial licensing period, a subscription renewal is required annually for continued support and for
updating your products. You can renew your subscriptions through your AccessData Sales Representative.
Use License Manager to view your current registration information, to check for product updates and to
download the latest product versions, where they are available for download. You can also visit our web site,
www.accessdata.com anytime to find the latest releases of our products.
For more information, see Managing Licenses in your product manual or on the AccessData website.
AccessData Contact Information
Your AccessData Sales Representative is your main contact with AccessData. Also, listed below are the general
AccessData telephone number and mailing address, and telephone numbers for contacting individual
departments
AccessData Legal and Contact Information | 5
Mailing Address and General Phone Numbers
You can contact AccessData in the following ways:
Technical Support
Technical support is available on all currently licensed AccessData solutions.
You can contact AccessData Customer and Technical Support in the following ways:
AccessData Support Portal
You can access the Chat, Knowledge Base, Discussion Boards, White Papers and more through the
AccessData Support Portal:
https://support.accessdata.com
E-Mail Support:
support@accessdata.com
Telephone:
Americas/Asia-Pacific:
800-658-5199 (North America)
Support Hours: Mon-Fri, 7:00 AM – 6:00 PM (MST), except corporate holidays.
NOTE: Emergency support is available on weekends:
Saturday and Sunday 8:00am – 6:00pm MST via support@accessdata.com
AccessData Mailing Address, Hours, and Department Phone Numbers
Corporate Headquarters: AccessData Group, Inc.
588 West 400 South Suite 350
Lindon, UT 84042 USA
Voice: 801.377.5410; Fax: 801.377.5426
General Corporate Hours: Monday through Friday, 8:00 AM – 5:00 PM (MST)
AccessData is closed on US Federal Holidays
State and Local
Law Enforcement Sales:
Voice: 800.574.5199, option 1; Fax: 801.765.4370
Email: Sales@AccessData.com
Federal Sales: Voice: 800.574.5199, option 2; Fax: 801.765.4370
Email: Sales@AccessData.com
Corporate Sales: Voice: 801.377.5410, option 3; Fax: 801.765.4370
Email: Sales@AccessData.com
Training: Voice: 801.377.5410, option 6; Fax: 801.765.4370
Email: Training@AccessData.com
Accounting: Voice: 801.377.5410, option 4
AccessData Legal and Contact Information | 6
Documentation
Please email AccessData regarding any typos, inaccuracies, or other problems you find with the documentation:
documentation@accessdata.com
Professional Services
The AccessData Professional Services staff comes with a varied and extensive background in digital
investigations including law enforcement, counter-intelligence, and corporate security. Their collective
experience in working with both government and commercial entities, as well as in providing expert testimony,
enables them to provide a full range of computer forensic and eDiscovery services.
At this time, Professional Services provides support for sales, installation, training, and utilization of Summation,
FTK, FTK Pro, Enterprise, eDiscovery, Lab and the entire Resolution One platform. They can help you resolve
any questions or problems you may have regarding these solutions.
Contact Information for Professional Services
Contact AccessData Professional Services in the following ways:
AccessData Professional Services Contact Information
Contact Method Number or Address
Phone North America Toll Free: 800-489-5199, option 7
International: +1.801.377.5410, option 7
Email services@accessdata.com
Contents | 7
Contents
AccessData Legal and Contact Information
. . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Contents
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Part 1: Introducing eDiscovery
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
Chapter 1: Introducing eDiscovery
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
About eDiscovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
About This Reviewer Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
Chapter 2: Getting Started
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
About the AccessData Web Console . . . . . . . . . . . . . . . . . . . . . . . . . . .20
Web Console Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20
About User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21
User Account Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21
Opening the AccessData Web Console . . . . . . . . . . . . . . . . . . . . . . . . .21
Installing the Browser Components . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Installing Components through the Browser . . . . . . . . . . . . . . . . . . . . .23
Installing Browser Components Manually . . . . . . . . . . . . . . . . . . . . . .25
Introducing the Web Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
The Project List Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28
User Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31
Changing Your Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32
Using Elements of the Web Console . . . . . . . . . . . . . . . . . . . . . . . . . . .33
Maximizing the Web Console Viewing Area . . . . . . . . . . . . . . . . . . . . .33
About Content in Lists and Grids . . . . . . . . . . . . . . . . . . . . . . . . . . .33
Part 2: Reviewing Project Data
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39
Chapter 3: Introduction to Project Review
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
About Project Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40
Workflow for Reviewing Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40
About Date and Time Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41
About How Time Zones Are Set . . . . . . . . . . . . . . . . . . . . . . . . . . . .41
Configuring the Date Format Used in Review . . . . . . . . . . . . . . . . . . . .41
Contents | 8
Configuring the Date Format Used in Production Sets and Export Sets . . . . .45
Chapter 4: Project Review Page
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Introducing the Project Review Page . . . . . . . . . . . . . . . . . . . . . . . . . . .46
Project Review Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46
Project Bar. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .47
Review Page Panels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48
Chapter 5: Customizing the Project Review Layout
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Working with Panels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50
Hiding and Showing Panels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50
Collapsing and Showing Panels . . . . . . . . . . . . . . . . . . . . . . . . . . . .51
Moving Panels. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51
Moving Panels to a New Window . . . . . . . . . . . . . . . . . . . . . . . . . . .52
Working with Layouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
Selecting a Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
Resetting Layouts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
Saving Layouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
Managing Saved Custom Layouts . . . . . . . . . . . . . . . . . . . . . . . . . .54
Chapter 6: Viewing Data
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Viewing Data in Panels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55
Using the Item List Panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57
Viewing Documents in the Item List Panel . . . . . . . . . . . . . . . . . . . . . .58
Using Item List Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59
About the Amount of Data Displayed in Fields. . . . . . . . . . . . . . . . . . . .63
Using Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64
Performing Actions from the Item List. . . . . . . . . . . . . . . . . . . . . . . . .69
Using the Project Explorer Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .72
The Explore Tab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73
The Navigation Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74
Using Document Viewing Panels. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .76
Using the Natural Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .76
Using the Image Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80
Using the Text Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .81
Using the KFF Details and Detail Information Panels . . . . . . . . . . . . . . . .82
Using Document Data Panels. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83
The Activity Panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83
The Related Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84
The Production Panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .85
The Notes and Transcript Notes Panels . . . . . . . . . . . . . . . . . . . . . . .86
The Conversation Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .86
The Family Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .88
The Linked Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90
Contents | 9
Adding a Link from the Linked Panel . . . . . . . . . . . . . . . . . . . . . . . . .91
Viewing Timeline Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .92
Viewing Graphics and Videos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .94
Chapter 7: Deleting Documents
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Deleting a Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95
Part 3: Searching Data
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .97
Chapter 8: Introduction to Searching Data
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
About Searching Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .98
Search Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .99
Chapter 9: Running Searches
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Running a Quick Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Selecting the Data that you Want to Search In. . . . . . . . . . . . . . . . . . . 101
Using Search Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Building Search Phrases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Using Search Operators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Using Boolean Logic Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Using ? and * Wildcards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Searching Numbers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Searching for Virtual Columns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Running a Subset Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Returning to a Previous Search . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Searching in the Natural Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Using Global Replace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Committing a Global Replace Job. . . . . . . . . . . . . . . . . . . . . . . . . . 110
Using Dates and Times in Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Using Dates and Times in Searches . . . . . . . . . . . . . . . . . . . . . . . . 111
How Time Zone Settings Affect Searches . . . . . . . . . . . . . . . . . . . . . 111
Viewing the Display Time Zone . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Using the Search Excerpt Report. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Using Search Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
About Search Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Generating and Downloading a Search Report . . . . . . . . . . . . . . . . . . 115
About the Search Report Details . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Chapter 10: Running Advanced Searches
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
Running an Advanced Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
Advanced Search Operators. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Advanced Search Operators Exceptions . . . . . . . . . . . . . . . . . . . . . . 120
Contents | 10
Understanding Advanced Variations . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Using the Term Browser to Create Search Strings . . . . . . . . . . . . . . . . . . 122
Importing Index Search Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Chapter 11: Using the Search Tab
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
The Search Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
Running Recent Searches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Clearing Search Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Saving a Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Sharing a Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Chapter 12: Using Filters to Cull Data
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Filtering Data in Case Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
About Filtering Data with Facets. . . . . . . . . . . . . . . . . . . . . . . . . . . 128
The Facets Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
Available Facet Categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Examples of How Facets Work . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
Using Facets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
Caching Filter Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
Filtering by Column in the Item List Panel . . . . . . . . . . . . . . . . . . . . . . . 143
Clearing Column Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
Object Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
Part 4: Using Visualization
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .146
Chapter 13: Using Visualization
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Culling Data with Visualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Files Visualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Emails Visualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Chapter 14: Using Visualization Social Analyzer
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
About Social Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
Accessing Social Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Social Analyzer Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Analyzing Email Domains in Visualization . . . . . . . . . . . . . . . . . . . . . 158
Analyzing Individual Emails in Visualization . . . . . . . . . . . . . . . . . . . . 158
Chapter 15: Using Visualization Heatmap
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Chapter 16: Using Visualization Geolocation
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
About Geolocation Visualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
Geolocation Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
Contents | 11
Geolocation Workflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
General Geolocation Requirements. . . . . . . . . . . . . . . . . . . . . . . . . 163
Viewing Geolocation EXIF Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Using Geolocation Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
The Geolocation Map Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
Using the Geolocation Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
Filtering Items in the Geolocation Grid . . . . . . . . . . . . . . . . . . . . . . . 168
Using Geolocation Columns in the Item List . . . . . . . . . . . . . . . . . . . . . . 169
Using Geolocation Column Templates . . . . . . . . . . . . . . . . . . . . . . . 170
Using Geolocation Facets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
Using Geolocation Visualization to View Security Data . . . . . . . . . . . . . . . 171
Prerequisites for Using Geolocation Visualization to View Security Data . . . . 171
Configuring the Geolocation Location Configuration File . . . . . . . . . . . . . 171
Viewing Geolocation IP Locations Data . . . . . . . . . . . . . . . . . . . . . . 173
Using the Geolocation Network Information Grid . . . . . . . . . . . . . . . . . 174
Geolocation Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Part 5: Using Litigation and eDiscovery Tools
. . . . . . . . . . . . . . . . . . . . . .175
Chapter 17: Working with Transcripts and Exhibits
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Working with Transcripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Formatting Transcripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
The Transcript Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Viewing Transcripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Annotating Transcripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Searching in Transcripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Displaying Selected Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Displaying Selected Highlights. . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Opening Multiple Transcripts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Generating Reports on Multiple Transcripts . . . . . . . . . . . . . . . . . . . . 185
Working with Video Transcripts . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
Culling Transcripts and Exhibits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Using the Explorer Panel to Cull Transcripts and Exhibits . . . . . . . . . . . . 188
Using Object Type Facets to Cull Transcripts and Exhibits. . . . . . . . . . . . 188
The Exhibits Panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Viewing Exhibits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Chapter 18: Imaging Documents
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Converting a Document to an Image . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Viewing Image Page Counts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Image on the Fly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Contents | 12
Chapter 19: Using Tags and the Case Organizer
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
The Tags Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Using Labels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
Applying and Removing Labels . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
Viewing Documents with Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Viewing Documents with a Label Applied . . . . . . . . . . . . . . . . . . . . . 202
Viewing Documents with an Issue Coded . . . . . . . . . . . . . . . . . . . . . 202
Viewing Documents with a Category Coded . . . . . . . . . . . . . . . . . . . . 202
Using the Case Organizer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
About Case Organizer Categories and Organization . . . . . . . . . . . . . . . 204
Creating, Associating, and Viewing Case Organizer Objects . . . . . . . . . . 206
Managing Case Organizer Object Properties . . . . . . . . . . . . . . . . . . . 210
Viewing the Source Document of a Case Organizer Note . . . . . . . . . . . . 212
Creating Project Files Reports. . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
Using the Case Organizer Columns . . . . . . . . . . . . . . . . . . . . . . . . 218
Chapter 20: Coding Documents
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
The Review Sets Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
The Review Batches Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Checking In/Out a Review Set. . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
Coding in the Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Editable Fields. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Using the Coding Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
The Coding Panel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
Coding Single Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Coding Multiple Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
Predictive Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Understanding Predictive Coding . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Instructing Predictive Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Obtaining a Confidence Score. . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Applying Predictive Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Performing Quality Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Chapter 21: Annotating and Unitizing Evidence
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
Prerequisites for Annotating and Unitizing Files . . . . . . . . . . . . . . . . . . . 235
About Generating SWF Files for Annotating or Unitizing . . . . . . . . . . . . . 235
Configuring Maximum PDF Size for SWF Creation . . . . . . . . . . . . . . . . 236
Accessing SWF Files for Annotating or Unitizing . . . . . . . . . . . . . . . . . 236
Annotating Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
About Annotating Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Prerequisites for Annotating . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
About Annotating Tools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Profiles and Markup Sets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
Contents | 13
Using Annotation Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
Viewing the Source Document of a Case Organizer Note . . . . . . . . . . . . 241
Adding a Highlight. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
Adding a Link . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Adding a Redaction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
Unitizing Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
Chapter 22: Bulk Printing
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Bulk Printing Multiple Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Network Bulk Printing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Local Bulk Printing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
General Print Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Bulk Print Dialog Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Viewing Print Statuses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Viewing Print Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Chapter 23: Managing Review Sets
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
Creating a Review Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
Deleting Review Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Renaming a Review Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
Manage Permissions for Review Sets. . . . . . . . . . . . . . . . . . . . . . . . . . 255
Part 6: Exporting Data
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .256
Chapter 24: Introduction to Exporting Data
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
About Exporting Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
About Excluding Data in Production Sets and Export Sets . . . . . . . . . . . . 259
Export Tab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Production Set History Tab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Export Set History Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Exporting Export Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Using The Browser Briefcase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
About the Browser Briefcase. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
Exporting to a Browser Briefcase . . . . . . . . . . . . . . . . . . . . . . . . . . 266
Viewing and Using the Browser Briefcase . . . . . . . . . . . . . . . . . . . . . 268
Sharing the Browser Briefcase . . . . . . . . . . . . . . . . . . . . . . . . . . . 268
Chapter 25: Creating Production Sets
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
About Creating Production Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
Points to Consider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
Process for Creating Production Sets . . . . . . . . . . . . . . . . . . . . . . . . . 269
Production Set General Options. . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Production Set Files to Include Options . . . . . . . . . . . . . . . . . . . . . . 272
Contents | 14
Columns to Include . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276
Volume Document Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276
Production Set Image Branding Options . . . . . . . . . . . . . . . . . . . . . . 283
Additional Production Set Options. . . . . . . . . . . . . . . . . . . . . . . . . . 286
Chapter 26: Exporting Production Sets
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
Exporting a Production Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
Export Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Chapter 27: Creating Export Sets
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
About Creating Export Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
Creating an AD1 Export . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
AD1 Export General Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
Creating a Native Export . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
Native Export General Options . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
Native Export Files to Include . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
Export Volume Document Options . . . . . . . . . . . . . . . . . . . . . . . . . 299
Export Excel Rendering Options . . . . . . . . . . . . . . . . . . . . . . . . . . 301
Export Word Rendering Options. . . . . . . . . . . . . . . . . . . . . . . . . . . 303
Creating a Load File Export . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
Load File General Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
Load File Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
Load File Files to Include Options. . . . . . . . . . . . . . . . . . . . . . . . . . 308
Part 7: Reference
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
Chapter 28: Getting Started with KFF (Known File Filter)
. . . . . . . . . . . . . . . . . . . . . . . . . . 312
About KFF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312
Introduction to the KFF Architecture . . . . . . . . . . . . . . . . . . . . . . . . 313
Components of KFF Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313
How KFF Works. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
About the KFF Server and Geolocation . . . . . . . . . . . . . . . . . . . . . . . . . 317
Installing the KFF Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318
About Installing the KFF Server . . . . . . . . . . . . . . . . . . . . . . . . . . . 318
About KFF Server Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318
Process for Installing KFF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319
Downloading the Latest KFF Installation Files . . . . . . . . . . . . . . . . . . . 319
Installing the KFF Server Service . . . . . . . . . . . . . . . . . . . . . . . . . . 319
Configuring the Location of the KFF Server . . . . . . . . . . . . . . . . . . . . . . 320
Configuring the KFF Server Location on FTK-based Computers . . . . . . . . 320
Configuring the KFF Server Location on Summation and eDiscovery Applications
320
Migrating Legacy KFF Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321
Contents | 15
Importing KFF Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322
About Importing KFF Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322
Using the KFF Import Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323
Importing Pre-defined KFF Data Libraries . . . . . . . . . . . . . . . . . . . . . 325
Installing the Geolocation (GeoIP) Data . . . . . . . . . . . . . . . . . . . . . . 328
About CSV and Binary Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329
Uninstalling KFF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332
Installing KFF Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333
KFF Library Reference Information . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
About KFF Pre-Defined Hash Libraries. . . . . . . . . . . . . . . . . . . . . . . 334
What has Changed in Version 5.6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339
Chapter 29: Using KFF (Known File Filter)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340
About KFF and De-NIST Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 340
Process for Using KFF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
Configuring KFF Permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
Adding Hashes to the KFF Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342
About the Manage KFF Hash Sets Page . . . . . . . . . . . . . . . . . . . . . . 342
Importing KFF Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343
Manually Creating and Managing KFF Hash Sets. . . . . . . . . . . . . . . . . 345
Adding Hashes to Hash Sets Using Project Review. . . . . . . . . . . . . . . . 346
Using KFF Groups to Organize Hash Sets . . . . . . . . . . . . . . . . . . . . . . . 348
About KFF Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348
Creating a KFF Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349
Viewing the Contents of a KFF Group . . . . . . . . . . . . . . . . . . . . . . . 349
Managing KFF Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349
About the Manage KFF Groups Page . . . . . . . . . . . . . . . . . . . . . . . 350
Enabling a Project to Use KFF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352
About Enabling and Configuring KFF . . . . . . . . . . . . . . . . . . . . . . . . 352
Enabling and Configuring KFF. . . . . . . . . . . . . . . . . . . . . . . . . . . . 352
Reviewing KFF Results. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354
Viewing KFF Data Shown on the Project Details Page . . . . . . . . . . . . . . 354
About KFF Data Shown in the Review Item List . . . . . . . . . . . . . . . . . . 354
Using the KFF Information Quick Columns. . . . . . . . . . . . . . . . . . . . . 354
Using Quick Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355
Using the KFF Facets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356
Viewing Detailed KFF Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357
Re-Processing KFF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 358
Exporting KFF Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 359
About Exporting KFF Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 359
Exporting KFF Groups and Hash Sets . . . . . . . . . . . . . . . . . . . . . . . 359
Contents | 16
Chapter 30: Understanding LawDrop™
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361
About LawDrop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361
Chapter 31: Using LawDrop™
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363
Getting Started with LawDrop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363
About the LawDrop Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
Creating and Deleting Sub-Folders in LawDrop. . . . . . . . . . . . . . . . . . . . 366
Dropping and Uploading Files to LawDrop . . . . . . . . . . . . . . . . . . . . . . . 367
About Dropping and Uploading Files . . . . . . . . . . . . . . . . . . . . . . . . 367
About Dropping and Uploading Folders . . . . . . . . . . . . . . . . . . . . . . 367
Dropping Files into the File Upload Queue. . . . . . . . . . . . . . . . . . . . . 367
Uploading and Managing Files in the File Upload Queue . . . . . . . . . . . . 368
Viewing and Managing Uploaded Files . . . . . . . . . . . . . . . . . . . . . . . . . 369
Using the Item List Grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369
Moving and Copying Uploaded Items. . . . . . . . . . . . . . . . . . . . . . . . 370
Performing Actions on LawDrop Items . . . . . . . . . . . . . . . . . . . . . . . 371
Sharing Files and Folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373
About Sharing Files and Folders . . . . . . . . . . . . . . . . . . . . . . . . . . 373
Sharing Files and Folders with other Application Users. . . . . . . . . . . . . . 373
Sharing Files and Folders with External People . . . . . . . . . . . . . . . . . . 374
Unsharing Files and Folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375
Adding Evidence to Projects Using LawDrop . . . . . . . . . . . . . . . . . . . . . 376
About Adding Evidence to Projects Using LawDrop. . . . . . . . . . . . . . . . 376
Exporting Files to LawDrop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378
Viewing Exported Files in LawDrop . . . . . . . . . . . . . . . . . . . . . . . . . 378
Chapter 32: Integrating with AccessData Forensics Products
. . . . . . . . . . . . . . . . . . . . . . 379
Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380
Managing User Accounts and Permissions Between
FTK and Summation/eDiscovery . . . . . . . . . . . . . . . . . . . . . . . . . . 380
Creating and Viewing Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380
Managing Evidence in FTK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380
Reviewing Evidence in FTK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381
Reviewing FTK Data in Summation . . . . . . . . . . . . . . . . . . . . . . . . . 382
Known Issues with FTK Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . 383
| 17
Part 1
Introducing eDiscovery
This part introduces eDiscovery and includes the following chapters:
-Introducing eDiscovery (page 18)
-Getting Started (page 19)
| 18
Chapter 1
Introducing eDiscovery
About eDiscovery
eDiscovery helps you to identify and collect relevant data in-house to address electronic discovery from
beginning to end. You can run collections across the entire enterprise Network of a company. The collected
evidence can then be processed, reviewed, and exported.
The reports are enhanced by the use of keyword searches and filters to gather only relevant data that pertains to
a case. The resulting production set can then be exported into an AD1 format, or into a variety of load file
formats such as Concordance, Summation, EDRM, Introspect, and iConect.
About This Reviewer Guide
This Reviewer Guide explains how to use Project Review to analyze the data in your projects.
This guide includes the following parts:
-Getting Started (page 19)
-Reviewing Project Data (page 39)
-Searching Data (page 97)
-Using Visualization (page 146)
-Using Litigation and eDiscovery Tools (page 175)
-Exporting Data (page 256)
-Reference (page 311)
For information about administrating the AccessData eDiscovery product and projects, see the eDiscovery
Admin Guide.
For information about new features, fixed issues, and known issues, see the eDiscovery Release Notes.
You can download the Admin Guide and Release Notes from the Help/Documentation link.
See User Actions on page 31.
Getting Started Terminology | 19
Chapter 2
Getting Started
Terminology
Features and technology are shared across the multiple applications. To provide greater compatibility between
products, some terminology in the user interface and documentation has been consolidated. The following table
lists the common terminology:
Terminology Changes
Previous Term New Term
Case Project
Custodian Person
Custodians People
System Console Work Manager Console
Security Log Activity Log
Audit Log User Review Activity
Getting Started About the AccessData Web Console | 20
About the AccessData Web Console
The application displays the AccessData web-based console that you can open from any computer connected to
the network.
All users are required to enter a username and password to open the console.
What you can see and do in the application depends on your product license and the rights and permissions
granted to you by the administrator. You may have limited privileges based on the work you do.
See About User Accounts on page 21.
Note: Like many applications that you run in a browser, do not click the browser’s Back button. Use the menus
and buttons to navigate in the console.
Web Console Requirements
Software Requirements
The following are required for using the features in the web console:
-Windows-based PC running the Internet Explorer web browser:
Internet Explorer 9 or higher is required for full functionality of most features.
Internet Explorer 10 or higher is required for full functionality of all features. (Some new features use
HTML5 which requires version 10 or higher.
Note: If you have issues with the interface displaying correctly, view the application in compatibility
view for Internet Explorer.
The console may be opened using other browsers but will not be fully functional.
-Internet Explorer Browser Add-on Components
Microsoft Silverlight--Required for the console.
Adobe Flash Player--Required for imaging documents in Project Review.
-AccessData console components
AD NativeViewer--Required for viewing documents in the Alternate File Viewer in Project Review.
Includes Oracle OutsideX32.
AD Bulk Print Local--Required for printing multiple records using Bulk Printing in Project Review.
To use these features, install the associated applications on each users’ computer.
See Installing the Browser Components on page 23.
Hardware Recommendations
-Use a display resolution of 1280 x 1024 or higher.
Press F11 to display the console in full-screen mode and maximize the viewing area.
Getting Started About User Accounts | 21
About User Accounts
Each user that uses the web console must log in with a user account. Each account has a username and
password. Administrators configure the user accounts.
User accounts are granted permissions based on the tasks those users perform. For example, one account may
have permissions to create and manage projects while another account has permissions only to review files in a
project.
Your permissions determine which items you see and the actions you can perform in the web console.
There is a default Administrator account.
User Account Types
Depending on how the application is configured, your account may be either an Integrated Windows
Authentication account or a local application account.
The type of account that you have will affect a few elements in the web interface. For example, if you use an
Integrated Windows Authentication account, you cannot change your password within the console. However,
you can change your password within the console if you are using an application user account.
Opening the AccessData Web Console
You use the AccessData web console to perform application tasks.
See About the AccessData Web Console on page 20.
You can launch the console from an approved web browser on any computer that is connected to the application
server on the network.
See Web Console Requirements on page 20.
To start the console, you need to know the IP address or the host name of the computer on which the application
server is installed.
When you first access the console, you are prompted to log in. Your administrator will provide you with your
username and password.
To open the web console
1. Open Internet Explorer.
Note: Internet Explorer 7 or higher is required to use the web console for full functionality. Internet
Explorer 10 or 11 is recommended.
2. Enter the following URL in the browser’s address field:
https://<host_name>/ADG.map.Web/
where <host_name> is the host name or the IP address of the application server.
This opens the login page.
You can save this web page as a favorite.
Getting Started Opening the AccessData Web Console | 22
3. One of two login pages displays:
If you are using Integrated Windows Authentication, the following login page displays.
Integrated Windows Authentication Page
Note: If you are using Integrated Windows Authentication and are not on the domain, you will see a
Windows login prompt.
If you are not using Integrated Windows Authentication, the login page displays the product name and
version for the product license that your organization is using and provides fields for your username and
password.
Non-Integrated Windows Authentication Login
4. On the login page, enter the username and password for your account.
If you are logging in as the administrator for the very first time and have not enabled Integrated Window
Authentication, enter the pre-set default user name and password. Contact your technical support or
sales representative for login information.
5. Click Sign In.
If you are authenticated, the application console displays.
If you cannot log in, contact your administrator.
6. The first time the web console is opened on a computer, you may be prompted to install the following
plug-ins:
-Microsoft Silverlight
-Adobe Flash Player
-AD Alternate File Viewer (Native Viewer)
-AD Bulk Print Local
Download the plug-ins. When a pop-up from Internet Explorer displays asking to run or download the
executable, click Run. Complete the install wizard to finish installing the plug-in.
See Web Console Requirements on page 20.
See Installing Browser Components Manually on page 25.
Getting Started Installing the Browser Components | 23
Installing the Browser Components
To use all of the features of the web console, each computer that runs the web console must have Internet
Explorer and the following add-ons:
-Microsoft Silverlight--Required for the console.
-Adobe Flash Player--Required for imaging documents in Project Review.
-AccessData Alternate File Viewer (Native Viewer)--Required for imaging documents in Project Review.
This includes the Oracle OutsideX32 plug-in.
-AccessData Local Bulk Print--Required for printing multiple records using Bulk Printing in Project Review
Important:
Each computer that runs the console must install the required browser components. The installations
require Windows administrator rights on the computer.
Upon first login, the web console will detect if the workstation's browser does not have the required versions of
the add-ons and will prompt you to download and install the add-ons.
See Installing Components through the Browser on page 23.
See Installing Browser Components Manually on page 25.
Installing Components through the Browser
Microsoft Silverlight
To install Silverlight
1. If you need to install Silverlight, click Click now to install in the Silverlight plug-in window.
2. Click Run in the accompanying security prompts.
3. On the Install Silverlight dialog, Install Now.
When the Silverlight installer completes, on the Installation successful dialog, click Close.
Getting Started Installing the Browser Components | 24
If the web browser does not display the AD logo and then the console, refresh the browser window.
The application Main Window displays and you can install Flash Player from the plug-in installation bar.
Adobe Flash Player
To install Flash Player
1. If you need to install Flash Player, click the Flash Player icon.
2. Click Download now.
3. Click Run in the accompanying security prompts.
4. Complete the installation.
5. Refresh the browser.
Once the application is installed, you need to install the Alternate File Viewer and Local Bulk Print software. You
can find the links to download the add-ons in the dropdown in the upper right corner of the application.
AccessData Alternate File Viewer (Native Viewer)
To install the AD Alternate File Viewer (Native Viewer)
1. From the User Actions dropdown, select AD Alternate File Viewer.
2. Click RUN on the NearNativeSetup.exe prompt.
3. Click Next on the InstallShield Wizard dialog.
4. Click Next on the Custom Setup dialog.
5. Click Install on the Ready to Install the Program dialog.
6. Allow the installation to proceed and then click Finish.
7. Close the browser and re-log in.
8. Click Allow on the ADG.UI.Common.Document.Views.NearNativeControl prompt.
9. Refresh the browser.
Getting Started Installing the Browser Components | 25
AccessData Local Bulk Print
To install the Local Bulk Print add-on
1. From the User Actions dropdown, select AD Local Bulk Print.
2. Click Run at the AccessData Local Bulk Print.exe prompt in Internet Explorer.
3. In the InstallShield Wizard dialog, click Next.
4. Accept the license terms and click Next.
5. Accept the default location in the Choose Destination Location dialog and click Next.
6. Click Install on the Ready to Install the Program dialog.
7. Click Finish.
Installing Browser Components Manually
You can use EXE files to install the components outside of the browser. You can run these locally or use
software management tools to install them remotely.
Installing AD Alternate File Viewer
To install the Alternate File Viewer add-on, navigate to the following path on the server:
C:\Program Files (x86)\AccessData\MAP\NearNativeSetup.exe
To install the AD Alternate File Viewer add-on
1. Run the NearNativeSetup.MSI file.
2. Click Next on the InstallShield Wizard dialog.
3. Click Next on the Custom Setup dialog.
4. Click Install on the Ready to Install the Program dialog.
5. Allow the installation to proceed and then click Finish.
Installing the Local Bulk Print Tool
To install the Local Bulk Print tool, navigate to the following path on the server:
C:\Program Files (x86) \AccessData\MAP\AccessDataBulkPrintLocal.exe
To install the Local Bulk Print add-on
1. Run the AccessDataBulkPrintLocal.exe. The wizard should appear.
2. Click Next to begin.
3. Click Next on the Select Installation Folder dialog.
4. Click Next. After the installation is complete, click Close.
Installing Adobe Flash Player
Visit http://get.adobe.com/flashplayer/ and follow the prompts to install the flash player.
Getting Started Introducing the Web Console | 26
Introducing the Web Console
The user interface for the application is the AccessData web console. The console includes different tabs and
elements.
The items that display in the console are determined by the following:
-Your application’s license
-Your user permissions
The main elements of the application are listed in the following table. Depending on the license that you own and
the permissions that you have, you will see some or all of the following:
Component Description
Navigation bar This lets you open multiple pages in the console.
Home page The Home page lets you create, view, manage, and review projects based on the
permissions that you have. This is the default page when you open the console.
See Using the Project Management Home Page on page 149.
Getting Started Introducing the Web Console | 27
Dashboard (Available in eDiscovery or with a special Litigation Hold license.)
The Dashboard allows you to view important event information in an easy-to-read
visual interface.
See Using the Dashboard on page 334.
Data Sources The Data Sources tab lets you manage people, computers, network shares, evidence,
as well as several different connectors. This tab allows you to manage these data
sources throughout the system, not just by project.
See About Data Sources on page 110.
Lit Hold (Available in eDiscovery or with a special Litigation Hold license.)
The Lit Hold tab lets you create and manage litigation holds.
See Using Litigation Holds on page 299.
Management
(gear icon) The Management page lets administrators perform global management tasks.
See Opening the Management Page on page 45.
User Actions Actions specific to the logged-in user that affects the user’s account.
See User Actions on page 31.
Project
Review
The Project Review page lets you analyze, filter, code and label documents for a
selected project.
You access Project Review from the Home page.
See the Reviewer Guide for more information on Project Review. You can download the
Reviewer Guide from the Help/Documentation link. See User Actions on page 31.
Component Description
Getting Started The Project List Panel | 28
The Project List Panel
The Home page includes the Project List panel. The Project List panel is the default view after logging in. Users
can only view the projects for which they have created or been given permissions.
Administrators and users, given the correct permissions, can use the project list to do the following:
-Create projects.
-View a list of existing projects.
-Add evidence to a project.
-Launch Project Review.
If you are not an administrator, you will only see either the projects that you created or projects to which you
were granted permissions.
The following table lists the elements of the project list. Some items may not be visible depending on your
permissions.
Getting Started The Project List Panel | 29
Elements of the Project List
Element Description
Create New Project Click to create a new project.
See Creating a Project on page 163.
Filter Options Allows you to search and filter all of the projects in the project list. You can
filter the list based on any number of fields associated with the project,
including, but not limited to the project name.
See Filtering Content in Lists and Grids on page 36.
Filter Enabled Displayed if you have enabled a filter.
Project Name Column Lists the names of all the projects to which the logged-in user has permissions.
Action Column Allows you to add evidence to a project or enter Project Review.
Add Data
Allows you to add data to the selected project.
Project Review
Allows you to review the project using Project Review.
See the Reviewer Guide for more information on using Product Review. You
can download the Reviewer Guide from the Help/Documentation link. See
Changing Your Password on page 32.
Processing Status Column Lists the status of the projects:
Not Started - The project has been created but no evidence has been added.
Processing - Evidence has been added and is still being processed.
Completed - Evidence has been added and processed.
Note: When processing a small set of evidence, the Processing Status may
show a delay of two minutes behind the actual processing of the evidence.
You may need to refresh the list to see the current status. See Refresh below.
Size Column Lists the size of the data within the project.
Page Size drop-down Allows you to select how many projects to display in the list.
The total number of projects that you have permissions to see is displayed.
Total Lists the total number of projects displayed in the Project List.
Page Allows you to view another page of projects.
Refresh If you create a new project, or make changes to the list, you may need to
refresh the project list
Delete Select one or more projects and click Delete Project to delete them from the
Project List.
Project Property
Cloning
Clone the properties of an existing project to another project. You can apply a
single project’s properties to another project, or you can pick and choose
properties from multiple individual projects to apply to a single project.
See Using Project Properties Cloning on page 176.
Getting Started The Project List Panel | 30
Custom Properties
Add, edit, and delete custom columns that will be listed in the Project list
panel. When you create a project, this additional column will be listed in the
project creation dialog.
See Adding Custom Properties on page 156.
Export to CSV Export the Project list to a .CSV file. You can save the file and open it in a
spreadsheet program.
Columns Add or remove viewable columns in the Project List.
Element Description
Getting Started User Actions | 31
User Actions
Once in the web console, you can preform user actions that are specific to you as the logged-in user. You access
the options by clicking on the logged-in user name in the top right corner of the console.
User Actions
User Actions
Link Description
Logged-on user The username of the logged-on user is displayed; for example, administrator.
Change password Lets the logged-on user change their password.
See Changing Your Password on page 32.
Note: This function is hidden if you are using Integrated Windows
Authentication.
Help/ Documentation Lets you to access the latest version of the Release Notes and User Guide.
The files are in PDF format and are contained in a ZIP file that you can
download.
Manage My Notifications Lets you to manage the notifications that you have created and that you belong
to.
See About Managing Notifications for a Job on page 457.
You can delete notifications, export the notifications list to a CSV file, and filter
the notifications with the Filter Options.
See Filtering Content in Lists and Grids on page 36.
Download Alternate File
Viewer Lets you to download the Alternate FIle Viewer application.
See AccessData Alternate File Viewer (Native Viewer) on page 24.
Download Local Bulk
Print software Lets you to access the latest version of the Local Bulk Print software. See
AccessData Local Bulk Print on page 25.
Logout Logs you off and returns you to the login page.
Note: This function is hidden if you are using Integrated Windows
Authentication.
Getting Started User Actions | 32
Changing Your Password
Note: This function is hidden if you are using Integrated Windows Authentication. You must change your
password using Windows.
Any logged-in user can change their password. You may want to change your password for one of the following
reasons:
-You are changing a default password after you log in for the first time.
-You are changing your password on a schedule, such as quarterly.
-You are changing your password after having a password reset.
To change your own password
1. Log in using your username and current password.
See To open the web console on page 21.
2. In the upper right corner of the console, click your logged-in username.
3. Click Change Password.
Change User Password
4. In the Change User Password dialog, enter the current password and then enter and confirm the new
password in the respective fields. The following are password requirements:
-The password must be between 7 - 50 characters.
-At least one Alpha character.
-At least one non-alphanumeric character.
5. Click OK.
Getting Started Using Elements of the Web Console | 33
Using Elements of the Web Console
Maximizing the Web Console Viewing Area
You can press F11 to enable or disable the console in full-screen mode.
About Content in Lists and Grids
Many objects within the console are made up of lists and grids. Many elements in the lists and grids recur in the
panels, tabs, and panes within the interface. The following sections describe these recurring elements.
You can manage how the content is displayed in the grids.
-See Refreshing the Contents in List and Grids on page 33.
-See Managing Columns in Lists and Grids on page 34.
-See Sorting by Columns on page 33.
-See Filtering Content in Lists and Grids on page 36.
-See Changing Your Password on page 32.
Refreshing the Contents in List and Grids
There may be times when the list you are looking at is not dynamically updated. You can refresh the contents by
clicking .
Sorting by Columns
You can sort grids by most columns.
Note: You can set a default column to sort by when you create a project or in the Project Details pane. The
default is ObjectID.
To sort a grid by columns
1. Click the column head to sort by that column in an ascending order.
A sort indicator (an up or down arrow) is displayed.
2. Click it a second time to sort by descending order.
3. Click Search Options > Clear Search to return to the default column.
Sorting By Multiple Columns
In the Item List in Project Review, you can also sort by multiple columns. For example, you can do a primary sort
by file type, and then do a second sort by file size, then a third sort by accessed date.
Getting Started Using Elements of the Web Console | 34
To sort a grid by columns
1. Click the column head to sort by that column in an ascending order.
A sort indicator (an up or down arrow) is displayed.
2. Click it a second time to sort by descending order.
3. In the Item List in Project Review, to perform a secondary search on another column, hold Shift+Alt keys
and click another column.
A sort indicator is displayed for that column as well.
4. You can repeat this for multiple columns.
Moving Columns in a Grid View
You can rearrange columns in a Grid view in any order you want. Some columns have pre-set default positions.
Column widths are also sizable.
To move columns
In the Grid view, click and drag columns to the position you want them.
Managing Columns in Lists and Grids
You can select the columns that you want visible in the Grid view. Project managers can create custom columns
in the Custom Fields tab on the Home page.
See Configuring Custom Fields on page 213.
For additional information on using columns, see Using Columns in the Item List Panel in the Reviewer Guide.
To manage columns
1. In the grid, click Columns.
2. In the Manage Columns dialog, there are two lists:
-Available Columns
Lists all of the Columns that are available to display. They are listed in alphabetical order.
If the column is configured to be in the Visible Columns, it has a .
If the column is not configured to be in the Visible Columns, it has a .
If the column is a non-changeable column (for example, the Action column in the Project List), it has
a .
-Visible Columns
Lists all of the Columns that are displayed. They are listed in the order in which they appear.
Getting Started Using Elements of the Web Console | 35
Manage Columns Dialog
3. To configure columns to be visible, in the Available Columns list, click the for the column you want
visible.
4. To configure columns to not be visible, in the Visible Columns list, click the for the column you want
not visible.
5. To change the display order of the columns, in the Visible Columns list, select a column name and click
or to change the position.
6. Click OK.
Managing the Grid’s Pages
When a list or grid has many items, you can configure how many items are displayed at one time on a page. This
is helpful for customizing your view based on your display size and resolution and whether or not you want to
scroll in a list.
To configure page size
1. Below a list, click the Page Size drop-down menu.
2. Select the number of items to display in one page.
3. Use the arrows by Page n of n to view the different pages.
Getting Started Using Elements of the Web Console | 36
Filtering Content in Lists and Grids
When a list or grid has many items, you can use a filter to display a portion of the list. Depending on the data you
are viewing, you have different properties that you can filter for.
For example, when looking at the Activity Log, there could be hundreds of items. You may want to view only the
items that pertain to a certain user. You can create a filter that will only display items that include references to
the user.
For example, you could create the following filter:
Activity contains BSmith
This would include activities that pertain to the BSmith user account, such as when the account was created and
permissions for that user were configured.
You could add a second filter:
Activity contains BSmith
OR Username = BSmith
This would include the activities performed by BSmith, such as each time she logged in or created a project.
In this example, because an OR was used instead of an AND, both sets of results are displayed.
You can add as many filters as needed to see the results that you need.
To use filters
1. Above the list, click Filter Options.
This opens the filter tool.
Filter Options
2. Use the Property drop-down to select a property on which to filter.
This list will depend on the page that you are on and the data that you are viewing.
3. Use the Operator drop-down to select an operator to use.
See Filter Operators on page 37.
4. Use the Value field to enter the value on which you want to filter.
See Filter Value Options on page 38.
5. Click Apply.
The results of the filter are displayed.
Once a filter had been applied, the text Filter Enabled is displayed in the upper-right corner of the panel.
This is to remind you that a filter is applied and is affecting the list of items.
6. To further refine the results, you can add additional filters by clicking Add.
7. When adding additional filters, be careful to properly select And/Or.
If you select And, all filters must be true to display a result. If you select OR, all of the results for each
filter will be displayed.
Getting Started Using Elements of the Web Console | 37
8. After configuring your filters, click Apply.
9. To remove a single filter, click Delete.
10. To remove all filters, click Disable or Clear All.
11. To hide the filter tool, click Filter Options.
Filter Operators
The following table lists the possible operators that can be found in the filter options. The operators available
depend upon what property is selected.
Filter Operators
Operator Description
= Searches for a value that equals the property selected. This operator is available
for almost all value filtering and is the default value.
!= Searches for a value that does not equal the property selected. his operator is
available for almost all value filtering.
> Searches for a value that is greater than the property selected. This operator is
available for numerical value filtering.
<Searches for a value that is less than the property selected. This operator is
available for numerical value filtering.
>= Searches for a value that is greater than and/or equal to the property selected.
This operator is available for numerical value filtering.
<= Searches for a value that is less than and/or equal to the property selected. This
operator is available for numerical value filtering.
Contains Searches for a text string that contains the value that you have entered in the
value field. This operator is available for text string filtering.
StartsWith Searches for a text string that starts with the value that you have entered in the
value field. This operator is available for text string filtering.
EndsWith Searches for a text string that ends with a value that you have entered in the
value field. This operator is available for text string filtering.
Getting Started Using Elements of the Web Console | 38
Filter Value Options
The following table lists the possible value options that can be found in the filter options. The value options
available depend upon what property is selected.
Filter Value Options
Value Option Description
Blank field This value allows you to enter a specific item that you can search for. The
Description property is an example of a property where the value is a blank field.
Date value This value allows you to enter a specific date that you can search for. You can
enter the date in a m/d/yy format or you can pick a date from a calendar. The
Creation Date property is an example of a property where the value is entered as
a date value.
Pulldown This value allows you to select from a pulldown list of specific values. The
pulldown choices are dependent upon the property selected. The Priority
property with the choices High, Low, Normal, Urgent is an example of a property
where the value is chosen from a pulldown.
Reviewing Project Data | 39
Part 2
Reviewing Project Data
This part describes how to review project data and includes the following sections:
-Introduction to Project Review (page 40)
-Project Review Page (page 46)
-Customizing the Project Review Layout (page 50)
-Viewing Data (page 55)
-Deleting Documents (page 95)
Introduction to Project Review About Project Review | 40
Chapter 3
Introduction to Project Review
This guide is designed to aid reviewers in performing tasks in Project Review.
About Project Review
In Project Review, you can review documents, electronic data, and transcripts in a web-based console. You can
cull and filter the data in a particular project and search for specific terms. The collected evidence can then be
processed, reviewed, and exported.
The resulting production set can then be exported into an AD1 format, or into a variety of load file formats such
as Concordance, Summation, EDRM, Introspect, and iConect. You can also export native files.
Workflow for Reviewing Projects
Although there is no formal order in which you process evidence, you can use the following basic workflow as a
guide.
Basic Workflow
Step Task Link to the tasks
1 After you process a collection, you
open the resulting project in Project
Review
See Introducing the Project Review Page on page 46.
2View Data See Viewing Data in Panels on page 55.
3 Search Documents See Searching Data on page 97.
4Culling Documents See Using Filters to Cull Data on page 128.
5 Imaging Documents See Imaging Documents on page 190.
6Coding Documents See Coding Documents on page 220.
7 Annotating Documents See Annotating and Unitizing Evidence on page 235.
Introduction to Project Review About Date and Time Information | 41
About Date and Time Information
When viewing data in Review, most items have dates and times associated with them. For example, you can
see the following:
-File created, accessed, and modified dates and times.
-Email sent and received dates and times.
How dates and times are displayed can be configured.
About How Time Zones Are Set
The dates and times associated with data files in a project are stored, by default, in Coordinated Universal Time
(UTC), also known as Greenwich Mean Time (GMT). The Project Manager can configure a Display Time Zone
for the project. This will offset the times as needed and display them in the desired time zone. For example, a
project can be configured so that all times are displayed in Pacific Time Zone.
For more information, see the Normalized Time Zones topic in the Creating a Project chapter in the Admin
Guide.
Configuring the Date Format Used in Review
Each user of the web console can configure which date format is used for displaying date fields in Review. For
example, some of the date formats that you can use include the following:
-M/d/yyyy (1/31/2014)
-dd.MM.yy (31.01.14)
-yyyy-MM-dd (2014-01-31)
This only applies to how the dates are displayed in the web console; it does not affect how the dates are stored
in the database.
The date format that is displayed is controlled by the Windows region date format that is configured on one or
both of the following:
-The Windows computer (server) that is running the eDiscovery or Summation application.
-The Windows client computer (the computer that is accessing the web console through a browser)
However, some date fields behave differently and must be configured differently.
8Work with Transcripts See Viewing Transcripts on page 181.
See Annotating Transcripts on page 181.
See Viewing Exhibits on page 189.
See Searching in Transcripts on page 184.
9 Deleting Documents See Deleting Documents on page 95.
Basic Workflow
Step Task Link to the tasks
Introduction to Project Review About Date and Time Information | 42
Configuring the Date Format for File and Email Date Fields
The following dates are stored in the database and are displayed as standard dates:
-Review
File: CreatedDate, AccessedDate, LastModifiedDate, and LastUpdated
Email: SentDate and RecieivedDate
Event: EventDate
-Home page:
Project creation
Evidence processing
Job events
Each user can configure their computer's Windows date format to what they want to use. For example, one
person can use M/d/yyyy while another person uses yyyy-MM-dd.
To configure a date format, a user selects the Short date format using the Windows Control Panel > Region and
Language setting.
Note: A console user can select any available Short date format, however, the Language (Country) format on
the client computer must match the Language (Country) format selected on the Windows computer
(server) that is running Summation. Otherwise, you will get a default date format based on the server’s
settings.
For example, if the server is set to English (New Zealand) and the client is also set to English (New
Introduction to Project Review About Date and Time Information | 43
Zealand), the client can display any of the New Zealand Short date formats. However, if the server is set
to English (New Zealand) and the client is set to English (United States), the client will display the default
New Zealand format.
To configure the Windows date format
1. On the client computer that is accessing the web console, open the Control Panel > Region and
Language.
2. Select the language/country Format and Short date format that you want to use.
3. Click OK.
Configuring the Date Format for DocDate and NoteDate fields
When you enter a DocDate or a NoteDate, it is not entered into the database as a standard date value, but
rather as a text string that is masked as a date. Because of this, these two fields will not be affected by the date
format setting on the client computer. Instead, it is controlled by the date format setting on the Windows server
that is running the eDiscovery or Summation application.
Note: If you are using multiple Windows servers, the server running the AccessData Business Services
Common service determines the date format.
When entering a DocDate or a NoteDate, it will only accept a date format that is set on the application server.
DocDate and NoteDate Format Limitations
-The DocDate and NoteDate fields do not support a year-first date format, such as yyyy/MM/dd. If this
format is selected, these two date fields will display the year at the end, for example, MM/dd/yyyy.
-Slashes are always used as separators instead of dashes or dots (MM/dd/yyyy).
Changing the Date Format on the Application Server
If you want to change the date format on the application server (the computer running the eDiscovery or
Summation application), there are a few steps that you must follow in order to have the new date recognized
properly.
To configure the Windows date format
1. On the Windows computer running the application, you must log in using the Windows Administrator
account that is the “service user”.
2. Open the Control Panel > Region and Language.
3. Select the language format and date format that you want to use.
4. Click OK.
After changing the date format in Windows, you must perform a few manual steps to reset the date format in the
application.
Important:
The following process will temporarily disable the web server making the web console unavailable to
users. Make sure no one is working in the console before proceeding.
Introduction to Project Review About Date and Time Information | 44
To reset the date format in the application
1. Restart an application service by doing the following:
1a. On the Windows computer running the application, click Start > Run.
1b. Enter services.msc.
1c. Click OK.
1d. From the list of services, select AccessData Business Services Common.
1e. Click Restart Service.
1f. After the service has been restarted, close the Services management console.
2. Stop the IIS web server so that you can delete cached settings by doing the following:
2a. On the Windows computer running the application, click Start > Run.
2b. Enter cmd.
2c. Click OK.
2d. In the command prompt window, type iisreset /stop and press ENTER; type Y and then press
ENTER.
The web server is stopped.
2e. Leave this CMD prompt window open so you can re-start IIS later.
3. Delete cached application settings by doing the following:
3a. On the Windows computer running the application, browse to the following folder:
\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files.
3b. While the IIS web server is stopped, delete the adg.map.web folder.
4. Re-start the IIS web server by doing the following:
4a. In the command prompt window, type iisreset /start and press ENTER.
4b. After IIS has successfully started, close the CMD prompt window.
5. Close and re-launch the browser running the web console.
Introduction to Project Review About Date and Time Information | 45
Configuring the Date Format Used in Production Sets and Export Sets
In this version, dates that are in Production Sets and Export Sets do not follow the Windows Regional settings.
Instead, they default to the United States default format.
In order to change the date format in Production Sets and Export Sets, you must change a setting in a
configuration file by doing the following:
1. On the computer running the Summation application, open the folder where the WorkManager service
is installed.
The default location is C:\Program Files\AccessData\eDiscovery\Work Manager.
2. Edit the Infrastructure.WorkExecutionServices.Host.exe.config file.
3. Replace the following keys in the Config section:
-DefaultLoadFileDateFormat
-DefaultLoadFileTimeFormat
-DefaultLoadFileDateTimeFormat
For example, to have dates in the dd-MM-yyyy format, replace the values as follows:
<add key="DefaultLoadFileDateFormat" value="dd-MM-yyyy" />
<add key="DefaultLoadFileTimeFormat" value="" />
<add key="DefaultLoadFileDateTimeFormat" value="dd-MM-yyyy h:mm:ss" />
4. Save the config file.
5. Restart the WorkManager service.
Project Review Page Introducing the Project Review Page | 46
Chapter 4
Project Review Page
Introducing the Project Review Page
You can use the Project Review page to search, analyze, filter, code, annotate, and label evidence for a selected
project. You have access to Project Review for the projects that you have created or that you are associated
with. You can access Project Review by clicking the magnifying glass button next to the project in the Project List
panel.
To access the Project Review page
From the project list on the Home page, click next to the desired project.
See The Project List Panel on page 28.
Project Review Page
Project Review Page Introducing the Project Review Page | 47
At the top of the Project Review page is a project bar and below that are multiple panels that are customizable.
Project Bar
The project bar is at the top of the Project Review page.
Elements of the Project Bar
Element Description
Current Project The name of the current project.
Return to Project Management Click this button to return to the Home page.
Current Item ID Displays the DocID, ObjectID, or Transcript name for the item selected
in the Item List grid. You can download the current document if the Item
ID is underlined. Click the number. When the Do you want to open or
save <document> bar appears at the bottom of the menu, either click
Open or Save and save the file.
Next and Previous Buttons Click previous page or previous document button to move around in the
Item List panel.
Click next page or next document to move around in the Item List panel.
Layout Button
Expand to manipulate panels in the Project Review. Panels can be
hidden, shown, dragged, and/or docked to customize the Project
Review page for your workflow.
See Customizing the Project Review Layout on page 50.
User Name Displays the name of the currently logged in user and allows you to log
out if desired.
Project Review Page Introducing the Project Review Page | 48
Review Page Panels
The Project Review page is made up of many panels. You select which panels are visible or hidden. The panels
that you can use may depend on the license that you own and the permissions that you have.
You can select which panels to display by doing either of the following:
-Manually selecting panels.
- Using the Layout tool. You can choose pre-defined layouts that display certain panels or you can
customize a layout.
See Customizing the Project Review Layout on page 50.
To manually select panels
1. Open a project in Review.
2. Click the Layouts drop-down.
3. Click Panels.
4. Select the panels that you want to display.
The following table briefly describes each panel that is available.
Panels in the Project Review
Panel Description
Activity Lists the history of actions performed on the selected document.
See The Activity Panel on page 83.
Case Organizer
Details Lets you view and edit the details of Case Organizer objects.
See Using the Case Organizer on page 204.
Coding Use to select and edit coding layouts.
See The Coding Panel on page 226.
Confidence Displays Predictive Coding confidence scores.
See Predictive Coding on page 230.
Conversation Displays email conversation threads.
See The Conversation Panel on page 86.
Detail Information The Detail Information contains tabs that allow you to view information about the
selected record.
See Using the KFF Details and Detail Information Panels on page 82.
Exhibits Displays exhibits for the selected transcript.
See The Exhibits Panel on page 189.
Family Lists the family relationships for email documents.
See The Family Panel on page 88.
Image Displays the selected document as an image. You can perform annotations, redactions,
and make notes in this view.
See Using the Image Panel on page 80.
Project Review Page Introducing the Project Review Page | 49
Item List Lists the filtered evidence for the selected project. This panel also includes the search
bar.
See Using the Item List Panel on page 57.
Labels Lists available labels in the project to apply to evidence. Also displays the selected label
for the document currently being viewed.
See About the Labels Panel on page 200.
Linked Two types of documents are displayed in this view:
-Documents manually linked to other documents of the same project
-Documents linked to other documents during import
See The Linked Panel on page 90.
Natural This viewer displays a file’s contents as it would appear normally without having to use
the native application.
The first time you use this view, you will need to follow the prompts to install the viewer
application.
See Using the Natural Panel on page 76.
Notes Use to display the notes for the currently selected document.
See The Notes and Transcript Notes Panels on page 86.
Production Displays the history of production for the selected document.
See The Production Panel on page 85.
Project Explorer Lets you cull and configure project data.
Contains the following tabs: Facets, Explorer, Tags, Searches, and Review Sets.
See Using the Project Explorer Panel on page 72.
Review Batches Displays review batches. You can check in and check out batches from this panel.
See The Review Batches Panel on page 221.
Search Excerpts Lets you generate and view a list of search excerpts.
See Using the Search Excerpt Report on page 112.
Similar Use to see the similarity between documents within the same cluster.
See The Related Panel on page 84.
Text The Text view displays the file’s content as text.
You can configure the text view so that sentences wrap if they are longer than the
panel’s width.
You can also limit how much text is displayed by setting the Page Depth in characters.
See Using the Text Panel on page 81.
Transcript Displays transcripts for the project.
See The Transcript Panel on page 180.
Unitization Lets you unitize documents which lets you merge multiple documents together, split
single documents into multiple documents, and rearrange page order.
See Unitizing Documents on page 246.
Panels in the Project Review (Continued)
Panel Description
Customizing the Project Review Layout Working with Panels | 50
Chapter 5
Customizing the Project Review Layout
You can customize the Project Review panels for your workflow. Layouts are specific to the logged-in user.
You can save custom layouts for future use.
See Managing Saved Custom Layouts on page 54.
You can customize the layout by doing the following:
-Hiding and Showing Panels (page 50)
-Collapsing and Showing Panels (page 51)
-Moving Panels (page 51)
-Resetting Layouts (page 53)
-Saving Layouts (page 53)
-Managing Saved Custom Layouts (page 54)
Working with Panels
All data in Review is shown in various panels.
See Review Page Panels on page 48.
You can show or hide panels.
Hiding and Showing Panels
You can hide and show panels to fit your needs.
To hide a panel
To hide a panel, do one of the following:
-Click the close button (x) on the panel.
-Click Layout > Panes and uncheck the panel you want to hide.
To show a panel
Click Layout > Panes and check the panel from the list.
Customizing the Project Review Layout Working with Panels | 51
Collapsing and Showing Panels
You can collapse a panel so that it is still open, but not shown unless you hover your mouse over it. This is useful
for panels that you want to view less frequently.
To collapse a panel
1. In top-right corner of the panel, click .
The panel is collapsed and the name of the panel is displayed in a box on the left side.
If the panel was in the top half of the page, the collapsed panel name is displayed in the top-left corner.
If the panel was in the bottom half of the page, it will be displayed in the bottom-left corner.
Collapsed Panels
2. To view a collapsed panel, mouse over the panel name and the panel will be shown until you move the
mouse away from the panel.
3. To un-collapse a panel, view the panel, and in the top-right corner of the panel, click .
Moving Panels
You can move panels to different locations on the Project Review page. When you move a panel, you can
position it in one of the following ways:
To move Project Review panels
1. Click and drag the panel that you want to move.
Docking guides appear on the page.
Project Review Page with Docking Guides
Customizing the Project Review Layout Working with Panels | 52
2. Place the panel by doing one of the following:
-Floating: Leave the panel floating on top of the page.
-Docking to a location on the page: Dock the panel by dragging the panel to one of the docking
guide arrows and releasing the mouse button.
There are four page docking guides on the outside of the page.
-Docking as a tab on another panel: Drag the panel on top of another panel and onto the center of
the docking cluster and release the mouse button.
There is a cluster of four page docking guides on the panel.
Moving Panels to a New Window
You can move the Natural, Image, Text, and Transcript panels to a new window from the Project Review page.
To move panels to a new window
In the Project Review, expand the Layouts drop-down and select Move Viewers to New Window.
The Natural, Image, and Text panels open in one window with tabs at the bottom so that you can toggle
between views.
If you have other panels docked to the Natural panel frame and choose to Move Viewers to New
Window, all other panels will be hidden.
You can open a separate transcript window by choosing the mass action option View Transcripts.
You can get your panels back into the main window by choosing the Reset Panels option.
Customizing the Project Review Layout Working with Layouts | 53
Working with Layouts
Selecting a Layout
You can use default layouts and custom layouts that you have saved in Project Review. The following are the
available default layouts:
-Culling Layout: Designed to aid reviewers in culling documents by giving more screen area to the viewer
panel and Item List grid, but collapsing the Project Explorer panel so you can concentrate on the
documents you are reviewing.
-Review Layout: Designed to aid reviewers in coding documents by providing the viewer panel, coding,
and label panels along with the relationship panels: Family, Similar, Conversation, Linked, and so on.
-Search Layout: Designed to aid reviewers in searching documents by docking the Project Explorer panel
which contains the facets tab. This is the default layout that appears for first time users.
-Transcript Layout: Designed to aid reviewers in working with transcripts by providing all of the panels
related to a transcript such as the transcript viewer with the Notes, Exhibits, Linked, and Item List panels
-CIRT Layout: Designed to aid reviewers in working with KFF jobs. This layout is similar to the Search
Layout except that it also includes the Detail Information tab which lets you see more information on jobs
that include Cerberus, Threat Analysis, and KFF.
To select a layout
1. Open a project in Review.
2. Click the Layouts drop-down.
3. Click Layouts.
4. Select the layout that you want to use.
Default layouts appear above the line and custom layouts appear below the line.
Resetting Layouts
If you have hidden, collapsed, or moved panels, you can return to the original layout.
To reset a layout
Select Layout > Reset Layout.
If you have modified a custom layout, it will reset to the last saved state.
Saving Layouts
If you have customized the default layout, you can save it as a custom layout. You can save multiple layouts.
To create a second custom layout, you must first return to a default layout, modify it, and then save it. If you
make changes to a custom layout, and save it, it will save it as an update.
To save a layout
1. Customize the layout.
2. Click Layout > Save Layout.
Customizing the Project Review Layout Working with Layouts | 54
Manage Layouts Dialog
3. Enter the name of the layout and click Save.
Managing Saved Custom Layouts
You can rename and delete custom layouts that you have saved. You cannot delete the currently selected layout
using the Manage Layouts dialog.
To manage a saved custom layout
1. Select Layout > Manage Layouts.
Manage Layouts Dialog
2. To rename a layout, select the layout, and enter a new name.
3. To delete a layout, click the X next to the layout, and click OK.
4. Click Save.
Viewing Data Viewing Data in Panels | 55
Chapter 6
Viewing Data
Viewing Data in Panels
Using Project Review, you can select and examine your data in multiple ways. You can use various panels to
examine the data.
You use the Panels List to select which panels to display. The panels that you can use may depend on the
license that you own and the permissions that you have.
See Review Page Panels on page 48.
Note: Actions completed in a specific panel may affect search results in that panel. Always execute a previous
search in a panel if you have changed the scope of what you are examining in the panel. For example, if
you change the page depth of a document in the Text panel, you should execute any previous searches in
that panel after changing the page depth.
This chapter describes how to use the following panels to view data in Project Review:
Data Viewing Panels
Panel Category Panel Descriptions
Project Data Panels Lets you view and manage the data in your project.
Item List Provides a list of evidence items in your project. This list may
be filtered.
See Viewing Documents in the Item List Panel on page 58.
Project Explorer Lets you cull and configure project data.
Contains six tabs: Facets, Explorer, Tags, Searches, and
Review Sets.
See Using the Project Explorer Panel on page 72.
File Data Panels Lets you view the data about the selected document.
Document Viewing
Panels Lets you view document data.
See Using Document Viewing Panels on page 76.
-See Using the Natural Panel on page 76.
-See Using the Image Panel on page 80.
-See Using the Text Panel on page 81.
-See Using the KFF Details and Detail Information Panels
on page 82.
Viewing Data Viewing Data in Panels | 56
Note: The language identification feature only works in the following categories: documents, spreadsheets, and
email.
Activity Lists the history of actions performed on the selected
document.
See The Activity Panel on page 83.
Conversation Displays email conversation threads.
See The Conversation Panel on page 86.
Family Lists the family relationships for email documents.
See The Family Panel on page 88.
Linked Two types of documents are displayed in this view:
-Documents manually linked to other documents of the
same project
-Documents linked to other documents during import
See The Linked Panel on page 90.
Production Displays the history of the production for the selected item.
See The Production Panel on page 85.
Related Displays the similarity between documents within the same
cluster.
See The Related Panel on page 84.
Transcript Notes Use to add notes to transcripts.
See The Notes and Transcript Notes Panels on page 86.
Data Viewing Panels
Panel Category Panel Descriptions
Viewing Data Using the Item List Panel | 57
Using the Item List Panel
The Item List panel lists the filtered evidence for the selected project. This panel also includes the search bar
and the ability to perform mass actions.
Item List Panel
Elements of the Item List Panel
Element Description
Options Click to use the following options in the Item Grid:
-Cache: See Caching Filter Data on page 142.
-Columns: See Selecting Visible Columns on page 61.
-Quick Columns: See Using Quick Columns on page 62.
-Quick Filters: See Using Quick Filters on page 62.
-Visualization: See Using Visualization on page 146.
-Keep Family Together: See Using Keep Family Together on page 63.
Search field Enter search terms to perform a quick search of documents in your project. Results
appear in the Item Grid.
See Running Searches on page 100.
Go button Click to execute your quick search.
Viewing Data Using the Item List Panel | 58
Viewing Documents in the Item List Panel
The Item List panel displays documents in the project.
By default, items are displayed using the Grid view. You can use different Views.
See Using Views on page 64.
To view documents in the Item List panel
1. From the project list on the Home page, click next to the desired project to enter Project Review.
2. By default, the Item List and Project Explorer panels are displayed.
3. Do the following to determine the items displayed in the Item List:
-In the Item List panel, use the Options to use columns, Quick Filters, and Visualization.
See Elements of the Item List Panel on page 57.
-In the Project Explorer panel, use the Facets, Explore, Tags, or Review Sets tabs.
See Using the Project Explorer Panel on page 72.
Search Options Select to perform search options.
See Using Search Options on page 102.
Views The following views are available: See Using Views on page 64.
-Grid View: See Using the Grid View on page 64.
-Conversation View: See Using Conversation View on page 65.
-Thumbnail View: See Using the Thumbnail View on page 65.
-Not Cached: See Caching Filter Data on page 142.
-Summary View: See Using the Summary View on page 66.
-Timeline View: See Using the Timeline View on page 67.
The Summary and Timeline Views are now hidden by default. You can have them
displayed by changing settings in the MAP\Web.Config file:
“ShowSummaryView” value=“false” Change to “true” to display
“ShowTimelineView” value=“false” Change to “true” to display
(change to “true” to display)
Actions Select the mass action that you want to perform on the documents in the Item List.
See Performing Actions from the Item List on page 69.
Actions Go Button
(bottom of panel) Click to execute the selected mass action.
Page Size Select the number of documents you want visible in the Item List.
Page Lists the page you are on and the number of pages. Click the next arrow to see the next
page.
(Refresh) Click the refresh button to update the Item List.
Elements of the Item List Panel (Continued)
Element Description
Viewing Data Using the Item List Panel | 59
Using Item List Options
Using Columns in the Item List Panel
About Columns
You use columns to display specific data properties about evidence items.
You can sort, filter, customize, and reposition the columns of information in the Item List panel in Grid.
See About Content in Lists and Grids on page 33.
There are many pre-configured fields that you can display as columns.
Project managers can also create custom columns in the Custom Fields tab on the Home page.
See Configuring Custom Fields in the Admin Guide.
About Pre-existing Fields
There are many pre-existing fields that are available to use for columns. You can select to display any of the pre-
existing fields as columns.
See Selecting Visible Columns on page 61.
New fields are added regularly. For a list of many of the available fields for Summation, download:
https://ad-zip.s3.amazonaws.com/Summation%205.2.2%20Field%20List.xlsx
Some fields provide basic information. For example, the following general columns are displayed by default:
-DocID - Documents are given a DocID when data is added to a document group. Documents are added
to a document group either when data is imported to a project or when document groups are created
manually by a project manager. A document may not be assigned more than one DocID number.
-ObjectID - All items added to the project are given an ObjectID.
-ObjectName
-[File] Extension
-[File] Path
-[Email] From
-[Email] Subject
-[Email] To
-[Email] ReceivedDate
-LogicalSize
-AccessedDate
Some columns provide information about the file. For example:
-ActualFile
-Archive
-ArchiveType
-Attachment
Viewing Data Using the Item List Panel | 60
-BadExtension
-Decrypted
-EmailDirectAttachCount - Shows the direct email attachments to an email. It does not display children
attachments of the direct attachments.
-EMailMessage
-Encrypted
-FromEmail
-FromMSOffice
-GraphicFile
-HasTrackChanges (for Office files)
-ObjectType and ObjectSubType (see Object Types page 144)
-Person
-System
Some columns provide specific data about certain file types. For example:
-EXIF geolocation data (See Using Geolocation Columns in the Item List on page 169.)
-OLESubItem
-PSTFilePath and PSTStoreID
-Microsoft Office document metadata:
HasTrackChanges lets you to sort and filter the following documents that have Track Changes
enabled:
Word documents (This currently only applies to DOCX document formats)
Excel documents (.XSLX and .XLS documents)
HasEmbeddedComments (PPT files)
HasHiddenColumnsRows (Excel files)
HasHiddenWorkSheets (Excel files)
From file Origin properties:
LastSavedBy
RevisionNumber
CreateTime (Content created)
LastSavedTime (Date last saved)
LastPrinted
TotalEditingTime (Word and PPT)
 Adobe files metadata:
DateCreatedMetadata
DateModifiedMetadata
Some columns provide data that is obtained through processing. For example:
-OcrScore
This column provides the OCR confidence % score for each file that has been processed with OCR. This
column is sortable which helps you determine which files may need to be manually reviewed for
keywords.
Some columns display data related to certain product functions. For example:
Viewing Data Using the Item List Panel | 61
-BatesNumber
-Hash values
-ProductionDocID
-KFF
Some columns are virtual columns that do not support search, column level filtering, tagging layout fields, or
production/export fields. However, you can export them to CSV. For example:
-ImagePageCount - This column shows the total number of pages in produced images. This column is
also populated if you bulk image or import images.
Selecting Visible Columns
You can select the columns that you want visible in the Grid view.
You can also select Quick Columns to use pre-define column templates.
Only the columns and fields related to the features of your licensed product are displayed. For example, columns
related to eDiscovery product features, are not shown in Summation.
See Using Quick Columns on page 62.
To select visible columns
1. In the Item List panel in Grid view, click the Columns button and select Select
Columns.
Select Columns Dialog
2. Click the right arrow to add columns to the Grid and the left arrow to remove them from the Grid.
3. Organize the order of the columns by clicking the up and down arrows.
Viewing Data Using the Item List Panel | 62
Columns Tips
-The FilePath column has been changed to display the heading Path in the Item List. This allows the
column to display any path information, not just file paths. Searches for this value should be created by
specifying Path instead of FilePath.
Using Quick Columns
You can use Quick Columns to quickly display columns related to certain types of data. This allows you to make
relevant columns visible without having to manually select them.
The following standard pre-configured Quick Columns are available to choose from.
-Case Organizer - See Using the Case Organizer Columns on page 218.
-Document
-eDocs
-eMail
-KFF
-Notes
-Scanned Paper
-Transcripts
Depending on the license that you own, you may have more. For security related products, see the Viewing
Security Data chapter of the Admin Guide.
To apply Quick Columns
1. For a project, enter Review.
2. Click Options > Quick Columns.
3. Select the Quick Columns that you want to use.
The selected Quick Column will be designated with a check.
4. To remove a Quick Column, select it again and the check will be cleared.
Using Quick Filters
The Item List panel includes Quick Filters that you can use to quickly refine the list of evidence.
You can quickly hide or show the following types of data.
Quick Filters
Filter Description
Hide/Show Duplicates By default, the Hide Duplicates Quick Filter is set and duplicate files are hidden.
To view duplicate files, change to Show Duplicates.
Hide/Show eDiscovery
Refinement By default, the Hide eDiscovery Refinement Quick Filter is set.
Enabling this shows extra files that may not be important. For example, this
includes embedded files, such as XML, RELS, and graphics that are embedded
in office documents.
Hide/Show Folders By default, the Hide Folders Quick Filter is set and folder items are hidden. To
view folder items, change to Show Folders..
Viewing Data Using the Item List Panel | 63
Depending on the license that you own, you may have more. For security related products, see the Viewing
Security Data chapter of the Admin Guide.
Using Keep Family Together
An object in the item list may have children items that have a much different Object ID, therefore, they may not
appear together in the Item List. For example, in the Family panel, you may see an object with ObjectID 45 that
has two children with Object IDs 546 and 547.
In the Item List Options, you can turn on the Keep Family Together option and the following will occur:
-In the Item List, the children objects appear under the parent object.
-A new column, HeadOfFamilyID is displayed.
For children objects, the ObjectID of the head of family item will be displayed. The Item List will also be
sorted by this column.
-While the Keep Family Together option is on, you can only sort by the HeadOfFamilyID column.
-If you need to sort by another column, uncheck the Keep Family Together option.
About the Amount of Data Displayed in Fields
By default, the number of characters that display for a field in the Item List and Coding Panel is limited to 512
characters. Additional characters are truncated.
For the Item List only, you can modify the number of characters displayed in custom text or text-based fields
before they are truncated. You can set the value using the “FieldTruncationSize” value in the web.config file. You
can set a limit value or turn off the limit by using a value of 0. This only applies to the Item List. The Coding Panel
maintains the 512 character limit.
If fields contain large amounts of data, you may need to remove the column from grid or you can reduce the
page size to a smaller size such as 100, 50 or 20 records.
Hide/Show Ignorables By default, the Hide Ignorable Quick Filter is set and KFF Ignorable files are
hidden. To view Ignorable files, change to Show Ignorables.
See About KFF on page 312.
Quick Filters
Filter Description
Viewing Data Using the Item List Panel | 64
Using Views
You can use different pre-configured views to help you review data.
-Grid View: See Using the Grid View on page 64.
-Summary View: See Using the Summary View on page 66.
-Timeline View: See Using the Timeline View on page 67.
-Conversation View: See Using Conversation View on page 65.
-Thumbnail View: See Using the Thumbnail View on page 65.
-Not Cached
Whenever you change views, the File List is refreshed.
You can perform actions on the documents in the Item Grid.
See Performing Actions from the Item List on page 69.
Using the Grid View
The default view in the Item List panel is the grid view. Grid view is a grid that displays each document.
Grid View
Viewing Data Using the Item List Panel | 65
Using Conversation View
Conversation view displays all the conversation threads for emails.
To access the conversation view
In the Item List panel, click the Conversation View button .
Conversation View
Using the Thumbnail View
You use the Thumbnails View to see rows of thumbnail images of the graphic files or video files in your project.
See Viewing Graphics and Videos on page 94.
If your project has graphics, such as JPEG, GIF, or PNG, thumbnails of those files are automatically created
during processing.
Note: Image thumbnails are generated only when choosing the processing option: Generate Image
Thumbnails.
To view thumbnails for video files, you must first enable the Generate (Video) Thumbnails processing option
when you create a project. You can use the Thumbnail View to rapidly scan through the visual contents in a
video file, without having to launch and watch the entire video.
See Evidence Processing and Deduplication Options on page 166.
To access the Thumbnail view
In the Item List panel, click the Thumbnail View button .
When you click a thumbnail, the item is displayed in the Natural panel.
You can use the slider to change the size of the displayed thumbnail.
Viewing Data Using the Item List Panel | 66
Using the Summary View
The Summary view displays a detail of the documents.
To access Summary view
In the Item List panel, click the Summary View button .
Summary View
Viewing Data Using the Item List Panel | 67
Using the Timeline View
This view lets you view file actions and the date and time that those actions took place. You can view the
following file action information:
-File (Created, Last Modified, Last Accessed)
-Registry (Modified)
-Event Log (Event Created)
-Email (Sent and Received)
-Process (Start time)
-Queried events (see the Admin Guide)
Each action is listed on it own row in the list.
Note: You can configure the format that dates are displayed in. SeeConfiguring the Date Format Used in
Review page 41
The Timeline View is an extension of the default Grid View with special event columns data added.
The following columns are added:
-EventType - Displays the type of action (created, last accessed, and last modified)
-EventDate - Displays the date and time of the file action.
-EventData - Displays data about the item that evoked the timeline event. For example:
If the event was file-related, the name of the file is displayed.
If the event was process-related, the name of the process is displayed.
If the event was web-related, the name of the URL is displayed.
If the event was email-related, the email subject is displayed.
If the event is from an EVTX file, the event data xml is displayed.
When you open the Timeline View, any other columns that you had configured for the Grid View are maintained.
Note: The ActionDate and ActionType columns are only available in the Timeline View.
If you perform a search or filter in the Grid View, and then change to the Timeline View, only the results of the
search or filter are in the list.
Viewing Data Using the Item List Panel | 68
A difference between the normal Grid View and the Timeline View is that the Timeline View displays multiple
rows for the same item (ObjectID). Each row will have a different action type but have the same Object ID.
Depending on your data and how your list is sorted, rows for the same file may be on different pages. When you
check an item to perform an action on it, all rows related to ObjectID file are also checked.
From the Timeline View, you can do the following:
-Sort on one or more columns including the ActionDate and ActionType columns.
-Use filters on any column.
-Add columns to the view. (Any added columns persist when returning to the Grid View.)
-Perform mass actions on items in the list.
See Performing Actions from the Item List on page 69.
-Export the list to CSV.
You will get a separate row in the CSV for every Action Type.
See Exporting a List to CSV on page 70.
-You can view, filter, and sort events related to modifying registry keys
-You can view, filter, and sort log2timeline events that come from Add Evidence and Collection jobs.
To access the Timeline view
In the Item List panel, click the Timeline View button .
Viewing Data Using the Item List Panel | 69
Performing Actions from the Item List
You can perform mass actions on items in the list.
There are two drop-downs for performing actions.
-In the first Actions drop-down, you specify whether you want to perform an action on all of the objects in
the grid or only the checked objects.
-In the Action-type drop-down, you select the action that you want to perform.
Actions You Can Perform in the File List
Task Link
Add to KFF Adds the MD5Hash value of the selected item to a KFF hash set.
See Adding Hashes to Hash Sets Using Project Review on page 346.
Bulk Coding Allows you to apply issues, categories, and other field coding to the selected item.
(Default action)
See Coding Multiple Documents on page 228.
Create Report Allows you to create a report of the selected items.
See Creating Project Files Reports on page 216.
Delete Evidence Allows you to delete the selected items from the Project.
See Deleting Documents on page 95.
Export List to CSV Allows you to export the selected items to a CSV file.
See Exporting a List to CSV on page 70.
Global Replace Allows you to search and replace values in non-read only fields.
See Using Global Replace in the Searching documentation.
Using Global Replace page 109
Imaging Allows you to create an image for the selected item.
See Imaging Documents on page 190.
Label Assignment Allows you to assign or remove a label from the selected item.
See Applying and Removing Labels on page 198.
Local Bulk Print Allows you to send the selected item to a local printer.
See Local Bulk Printing on page 249.
Network Bulk Print Allows you to send the selected item to a network printer. Reviewers with the
Imaging permission can print multiple records.
See Bulk Printing on page 248.
OCR Documents Allows you to OCR the selected item.
See Using OCR on page 70.
Remove Document
Group Items Allows you to remove the document group association from the selected item.
See Deleting a Document Group in Project Review on page 233.
Remove from Case
Organizer Allows you to remove selected Case Organizer associations from the selected
item.
See Using the Case Organizer on page 204.
Viewing Data Using the Item List Panel | 70
Exporting a List to CSV
You can export the Item List to a CSV file. Any field that is available in the list can be exported to a CSV file.
Once exported, you download the exported CSV file from the Work List on the Home page.
To perform an Export to CSV action
1. Identify the files that you want to perform the action on by doing one of the following:
-In the first Action drop-down, click All.
-Check individual files, and then in the first Action drop-down, click Selected Objects.
2. In the second Action drop-down, click Export List to CSV.
3. Click Go.
To view the status of an Export to CSV job
1. Click Return to Project Management.
2. For the project, click Work Lists.
3. Under Job Type, view the ExportToCSV job.
To download the CSV file
1. On the Work List page, select the ExportToCSV job that you want to download the file for.
2. In the Filter Options pane, click Download.
3. Select to Open or Save the file.
4. If you save the file, go to your Downloads folder to access the file.
Using OCR
You can create a job to OCR documents if you did not select to have this done during processing.
About Optical Character Recognition (OCR)
Optical Character Recognition (OCR) is a feature that generates text from graphic files and then indexes the
content so the text can be searched, labeled, and so forth.
OCR currently supports English only.
Some limitations and variables of the OCR process include:
-OCR can have inconsistent results. OCR engines have error rates which means that it is possible to have
results that differ between processing jobs on the same machine with the same piece of evidence.
View Transcripts Allows you to open a transcript viewer for each selected transcript so that you can
view them side by side.
See Viewing Transcripts on page 181.
Actions You Can Perform in the File List
Task Link
Viewing Data Using the Item List Panel | 71
-OCR may incur longer processing times with some large images and, under some circumstances, not
generate any output for a given file.
-Graphical images that have no text or pictures with unaligned text can generate illegible output.
-OCR functions best on typewritten text that is cleanly scanned or similarly generated. All other picture
files can generate unreliable output.
-OCR is only a helpful tool for you to locate images with index searches, and you should not consider
OCR results as evidence without further review.
-Documents that have already been processed for OCR do not process again.
-Documents imported with the @O token cannot be processed for OCR. The Text tab displays filtered text.
OCR Options
-File Types
You can select which file types to OCR
-Filtering Options
You can select whether or not to OCR documents based on their file size and whether or not they are full
color documents.
-Multi-Language OCR
When you use the OCR action, there is a new option to select to OCR from one of 35 languages.
You can only select one language per file per job. You can re-run the job and select a different language.
-Re-OCR documents
When you use the OCR action, there is a new option to Re-OCR a document. For example, if a
document has two languages, you can OCR it in one language and then re-OCR it in the other language.
Performing an Optical Character Recognition (OCR) Action
To perform an OCR action
1. Identify the files that you want to perform the action on by doing one of the following:
-In the first Action drop-down, click All.
-Check individual files, and then in the first Action drop-down, click Selected Objects.
2. In the second Action drop-down, click OCR Documents.
3. Click Go.
About Viewing Optical Character Recognition (OCR) Jobs
After performing an OCR action you can view the the status of the OCR job.
To view the status of an OCR job
1. Click Return to Project Management.
2. For the project, click Work Lists.
3. Under Job Type, view the OCR Documents job.
Viewing Data Using the Project Explorer Panel | 72
Using the Project Explorer Panel
The Project Explorer provides tools to help you organize and cull your data.
The Project Explorer panel has the following tabs:
In the Project Exporer, you use the following icons:
Facets This is the default tab and lets you use facets to cull your data.
See Filtering Data in Case Review on page 128.
Explore This can be used to cull your data by specific sets or groups of documents.
See The Explore Tab on page 73.
Navigation
This lets you specify the scope of data viewable in the Item List panel by pivots such
as Jobs, Groups, People, Computers, Network Shares, or Mobile Devices.
(Not available in all products)
See The Navigation Tab on page 74.
Tags This lets you manage and view the different types of coding tags, Production Sets,
and Case Organizer objects.
See Using Tags and the Case Organizer on page 196.
Searches This lets you view searches that you have run and saved.
See Introduction to Searching Data on page 98.
Review Sets
This lets you manage and view Review Sets.
See Managing Review Sets on page 251.
Expand the items in the list.
Collapse the items in the list.
Reset the selections.
Viewing Data Using the Project Explorer Panel | 73
The Explore Tab
The Explore tab in the Project Explorer panel can be used to cull documents by the following items:
-Document Groups
-Exhibits
-Export Sets
-Notes
-Transcripts
Explore Tab
When you check an item in the document tree, then click the Apply icon, all documents in that category will be
included in your search query.
Note: If you check only the parent node, you will not get any documents included in the search. You must select
one or more of the child nodes (Document Groups, Transcripts, Notes, or Exhibits) in order to return
results.
Apply the selections to the Item List.
Important: You must reset each tab of the Project Explorer individually. For example, if you apply
a filter on the Explore tab, and then apply a filter on the Facets tab, you must go to each tab and
reset the selections to undo them.
Elements of the Document Tree
Element Description
Document Groups Check to include document groups in your search. Right-click to create document
groups.
Viewing Data Using the Project Explorer Panel | 74
The Navigation Tab
Use the navigation panel to specify the scope of evidence that you want to view in the Item List panel of the
Project Review. You can view evidence by specific sources of data such as Jobs, Groups, People, Computers,
Network Shares, or Mobile Devices.
Navigation Panel
Exhibits Check to include exhibits in your search.
See Working with Transcripts and Exhibits on page 176.
Exports Sets Check to include export sets in your search.
See About Creating Export Sets on page 290.
Notes Check to include notes in your search.
See The Notes and Transcript Notes Panels on page 86.
Transcripts Check to include transcripts in your search. Right-click to create transcript groups,
upload transcripts, update transcript, and upload exhibits.
See Working with Transcripts on page 176.
Elements of the Document Tree
Element Description
Viewing Data Using the Project Explorer Panel | 75
Elements of the Navigation Panel
Element Description
Navigation Tree
Button
Select this button to select the scope of evidence from among the following:
-Jobs
-Groups
-People
-Computers
-Shares
-Mobile
Jobs Button Click to select a scope of evidence from the jobs in the project.
Groups Button Click to select a scope of evidence from the groups in the project.
People Button Click to select a scope of evidence from the people in the project.
Computers Button Click to select a scope of evidence from the computers in the project.
Shares Button Click to select a scope of evidence from the network shares in the project.
Mobile Button Click to select a scope of evidence from the mobile devices in the project.
Apply Button Click to apply the scope that you selected. Results appear in the Item List panel.
Viewing Data Using Document Viewing Panels | 76
Using Document Viewing Panels
You can use various panels to view document data.
See Viewing Data in Panels on page 55.
You can use the following panels:
-See Using the Natural Panel on page 76.
-See Using the Image Panel on page 80.
-See Using the Text Panel on page 81.
-See Using the KFF Details and Detail Information Panels on page 82.
Using the Natural Panel
You can use the Natural Panel to view, annotate, and redact documents in your project.
The first time you use this, you will need to follow the prompts to install the viewer application. When Internet
Explorer displays a message that it has blocked a pop-up, select Always allow from the Options for this site
pull-down.
Viewing Data Using Document Viewing Panels | 77
To view documents in the Natural panel
1. In Project Review, select a file in the Item List panel.
2. Click the Natural tab.
If the Natural panel isn’t showing, select the panel from the Layouts drop-down.
Elements of the Natural Panel
Element Description
Standard Viewer Lets you view a AccessData-generated SWF version of the document that lets you
do the following:
-View the document as it appears in its native format
-Edit the document with annotation tools
See Using the Standard Viewer and the Alternate File Viewer on page 78.
See About Annotating Tools on page 238.
Alternate File Viewer Uses INSO viewer technology that lets you view the document as it appears in its
native format.
This format has some limitations on the data that can be displayed. In some cases
the Standard Viewer has greater functionality.
See Using the Standard Viewer and the Alternate File Viewer on page 78.
Annotate Native Click to annotate the native document. A new version of the document will be
created in SWF format. Check the progress of the image being created in the Work
List of the Home Page.
See Using the Standard Viewer and the Alternate File Viewer on page 78.
Create Image Click to create an image of the native document. An image of the document will be
created. Check the progress of the image being created in the Work List of the
Home Page.
Highlight Profile Select a predefined highlight profile to apply to the document.
Find Enter a word or phrase to find in the document. The term highlights in the panel. You
do not need to enter the whole word or phrase. You can begin to type the first few
letters of the word and the pane highlights the first word that matches the typed
letters. For example, typing “Glo” highlights the word “Global.”
To navigate from one highlight to the next, use the arrow keys.
Note: You cannot navigate highlighted terms displayed by a highlight profile.
Copy Selected
Text
Enter a word or phrase to find in the document.
Viewing Data Using Document Viewing Panels | 78
Using the Standard Viewer and the Alternate File Viewer
The Natural panel has two viewers that have different functionality:
-Standard Viewer
-Alternate File Viewer
Both of these viewers are designed to show documents as they would appear natively.
The most basic viewer is the Alternate File Viewer. This viewer uses the OutsideIn viewer technology to display
the content of a document as it would in its native application.
Note: The following file types do not display in the Alternate File Viewer: 3G2, 3GP, 7ZIP, AD1, AIF, ASF, AVI,
ASX, DBX, DD, DMG, E01, EX01, FLAC, FLV, GZIP, JAR, L01, M3U, M4A, M4V, MID, MKV, MOV, MP3,
MP4, MPA, MPG, NSF, OGG, OST, PST, RA, RAR, RM, SRT, SWF, TAR, VOB, WAV, WMA, WMV, WTV,
ZIP, and ZIPX. Also, files over 50 MB will not display. However, depending upon the options that you
select, these files will be processed.
The more advanced viewer is the Standard Viewer. This viewer lets you view an AccessData-generated SWF
version of the document that lets you do the following:
-View the document as it appears in its native format
-Edit the document with annotation tools (See About Annotating Tools on page 238.)
However, in order to view content in the Standard Viewer, a document must first be converted to a format that
can be annotated or redacted.
See About Generating SWF Files for Annotating or Unitizing on page 235.
In some cases the Standard Viewer has advanced viewing capabilities. For example, if a Word document has
Track Changes enabled, this viewer can show the formatted changes, whereas the Alternate File Viewer cannot.
AccessData converts documents into an Adobe’s SWF file format for viewing and editing. As a result, the
Standard Viewer will only display files that have been converted to SWF.
If a SWF file is not available, the contents of the file will be displayed using the Alternate File Viewer.
Standard Viewer Features
In the Standard Viewer, you can do the following:
-Use the Annotation feature.
See Annotating Evidence on page 237.
-Use the Unitization feature.
See Unitizing Documents on page 246.
-Use in-document searching
The in-document searching includes type-down capabilities and counts.
-Print the current document.
See Annotating Evidence on page 237.
Viewing Data Using Document Viewing Panels | 79
Workflow for the Standard Viewer and the Alternate File Viewer
-If the Enable Standard Viewer processing option is enabled, the Standard Viewer is the default viewer.
When you click a file in the item list, if a SWF has been generated, or if the file can have a SWF
generated, it will display in the Standard Viewer.
If the SWF file has not yet been generated, it will do so automatically.
If you click a file that does not support SWF, it will be displayed in the Alternate File Viewer instead.
-If the Enable Standard Viewer processing option is not enabled, by default, the Alternate File Viewer is
used. If you then switch to the Standard Viewer, and if a SWF can be generated, it will be converted “on-
the-fly”.
Attachment Counts
You can see attachment counts on imported Emails in the Natural panel.
Emails imported using a load file, are constructed in the Natural panel using the metadata from the load file for a
consistent Outlook type look and feel. In previous versions emails with attachments did not display that
attachments existed unless the user imported these files as EDOCS. Now, when importing these files as EMAIL
document types, the count of the attachments is now displayed in the Natural Viewer. Emails processed using
evidence processing will display the attachment name rather than the attachment count.
Standard Viewer Caching
When you view an item in the Standard Viewer, it now caches the next few items in the Item List. This makes
navigating to and viewing the next item much faster.
Note the following:
-The number of files that is cached is based on GridCacheCount value in the Map\Web.config file.
(The default is 3)
Viewing Data Using Document Viewing Panels | 80
-It only caches the next items, not the previous items.
-When using the Standard Viewer, it loads the generated SWF file for the item. This new feature caches
the SWF files. If SWF files do not already exist, a SWF is auto-generated on-the-fly and may take a few
seconds. You can make SWF files in bulk by using the Imaging action.
Using the Image Panel
The Image panel displays image documents and electronic documents that have been converted into images
from the Natural panel.
The Image panel displays the selected document as an image. You can perform annotations and make notes in
this view.
Image Panel
See About Annotating Tools on page 238.
See Unitizing Documents on page 246.
To view documents in Image view
1. In Project Review, select a file in the Item List panel.
2. Click on the Image view tab.
If the Image panel isn’t showing, select the panel from the Layouts drop-down.
Viewing Data Using Document Viewing Panels | 81
Using the Text Panel
The Text panel in Project Review displays the file’s content as text. There are two options for viewing text:
-Filtered text - This is basic text that is extracted during processing (unless you used the Quick Processing
Mode).
-OCR - This is text that is generated using OCR.
See Using OCR on page 70.
Text Panel
To view documents in Text view
1. In Project Review, select a file in the Item List panel.
2. Click on the Text view tab.
If the Text panel isn’t showing, select the panel from the Layouts drop-down.
Elements of the Text Panel
Element Description
Filtered / OCR Select to view Filtered text or OCR text.
Find Search for text in the document.
Page Depth Limit how much text is displayed by setting the Page Depth in characters.
Wrap Configure the text view so that sentences wrap if they are longer than the panel’s width
(on by default).
Viewing Data Using Document Viewing Panels | 82
Using the KFF Details and Detail Information Panels
You can show the KFF Details panel or the Detail Information panel.
-The KFF Details panel is displayed when using the Review layout.
-The Detail Information panel is displayed when using the CIRT layout.
The Detail Information contains tabs that allow you to view information about the selected record.
You can enable these panels by customizing the Project Review panels and layouts.
See Customizing the Project Review Layout on page 50.
To view KFF Detail / Detail Information
1. In Project Review, select a layout that displays the desired panel.
2. Select a file in the Item List panel.
3. Click on the KFF Detail / Detail Information view tab.
Elements of the Detail Information Panel
Element Description
Archived Details Displays the details of the file path, size, and dates associated with the record.
Cerberus Displays the Cerberus threat score for the record.
You will see data for applicable files if you selected the Enable Cerberus processing
option.
See the About Cerberus Malware Analysis chapter.
You can download the information as an HTM file by clicking Download in the bottom-
right corner.
KFF Details Displays the details of the Known File Filter for the selected record.
See Using KFF (Known File Filter) on page 340.
Evidence Source Displays the source of the evidence.
Viewing Data Using Document Data Panels | 83
Using Document Data Panels
You can use the following document data panels in Review:
-The Activity Panel page 83
-The Related Panel page 84
-The Production Panel page 85
-The Notes and Transcript Notes Panels page 86
-The Conversation Panel page 86
-The Family Panel page 88
-The Linked Panel page 90
-Exporting a List to CSV page 70
-Using OCR page 70
See Viewing Data in Panels on page 55.
The Activity Panel
The Activity panel on the Project Review page lists the history of actions performed on the selected document.
Activity Panel
Elements of the Activities Panel
Element Description
Date Column Displays the date of the action performed.
User Displays the user that performed the action.
Activity Type Displays the detailed information regarding the action performed.
Viewing Data Using Document Data Panels | 84
The Related Panel
In version 6.0, the Similar panel was renamed to the Related panel.
The Related panel in Project Review is used to show similarity between documents. This panel displays
documents that are clustered together based on their content. The similarity is determined by running Cluster
Analysis. You can perform Cluster Analysis by doing one of the following:
-When creating a project, select the Cluster Analysis processing option.
-After initial processing, on the Home page, select the project, click , and click Cluster Analysis.
Performing Cluster Analysis will take some time after normal processing is completed. For information on
performing Cluster Analysis, see the Admin Guide or Project Manager Guide.
When Cluster Analysis is run, a “K-means” algorithm is run to determine a pivot document. Other documents are
then compared to the pivot. If a document has an 80% similarity to the pivot, it will be displayed in the list in the
panel.
Related Panel
There is a DeDuplicate Type column that shows if it is Primary or Secondary.
The Clustered Distance Score column indicates whether the document is Duplicate or clustered data
(with a % score).
Items that are Duplicates are displayed at the top of the grid.
The star icon indicates the pivot document.
Viewing Data Using Document Data Panels | 85
The Production Panel
The Production panel in Project Review displays the history of production for the project. You can navigate to
produced documents via hyperlinks in the Production panel. The ProductionDocID appears as a hyperlink in the
Production panel. While viewing a source document highlighted in the Item List, you can click on the
ProductionDocID in the Production panel, and the produced document opens in a new window.
When a document is produced, it is automatically linked to the original from which it was produced. When
looking at the original document, you can see that it has been produced.
You can navigate to the produced documents via hyperlinks in the Production panel.
-The ProductionDocID appears as a hyperlink in the Production panel. While viewing a source document
highlighted in the Item List, you can click on the ProductionDocID in the Production panel, and the
produced document opens in a new window.
Elements of the Related Panel
Element Description
File list Displays the Pivot item (designated by the gold star) and other items that are similar. The
level of similarity of each item to the pivot is displayed as a percentage.
Actions You can select items and then perform the following actions on items in the list.
Label Assignment Allows you to assign or remove a label from the selected item.
See Applying and Removing Labels on page 198.
Bulk Coding Allows you to apply issues, categories, and other field coding to the
selected item.
See Coding Multiple Documents on page 228.
Compare Docs Allows you to compare the contents of two items.
Select the documents that you want to compare, select Compare Docs,
and click Go.
A new window opens and displays a report that details how the items
compare.
Go Performs the selected action on the selected items.
Viewing Data Using Document Data Panels | 86
-Also, if you display produced documents in the Item List by filtering, the Source ID of a produced
document appears as a hyperlink in the Production panel. Clicking on the Source ID opens the source
document in a new window.
Note: Export sets do not have hyperlinks in the Production panel.
Production Panel
The Notes and Transcript Notes Panels
In version 6.0, the Notes panel was renamed to the Transcript Notes Panel.
See Adding a Note to a Transcript on page 181.
In version 6.x and later, notes are now stored in the Case Organizer.
See Using the Case Organizer on page 204.
If you are using an environment that was upgraded from 5.x, your legacy notes are not converted to the Case
Organizer and can still be viewed in the legacy Notes panel. Notes can be viewed and deleted from the Notes
panel for users with the View Notes and Delete Notes permission.
The Conversation Panel
The Conversation panel in Project Review displays email conversation threads and emails from a cluster. The
Conversation panel shows any compilation of related messages that makes up a conversation. The displayed
threads are those emails that are sent and answered, or forwarded emails with the originals and any string of
threads that went back and forth for each message.
Emails are organized by cluster in the Conversation panel.
-The email clusters are displayed in a hierarchical order with the original message displayed first, followed
by subsequent messages for any email that have a conversational ID.
-There may be an email in the cluster that is from the thread which is not necessarily a part of the cluster
since they are a part of the thread.
Viewing Data Using Document Data Panels | 87
-Emails may be identified because they are in the cluster, but not a part of the thread.
-Emails listed in green text are clusters
-Emails listed in black text are threads
-The icons that are displayed for each email in the hierarchy which are as follows:
Purple arrow from right to left is reply
Green arrow from left to right is sent
You can use the Filters panel to refine the list by:
-Who the email was sent to
-Who the email is from
-Date range
Conversation Tab
Elements of the Conversation Tab
Element Description
Email Count Displays the number of emails in the thread.
Attachments Displays the number of attachments.
Time Frame Displays the time frame when the emails were sent.
Participants Displays the email address of the email participants.
Actions You can select items and then perform the following actions on items in the list.
Label Assignment Allows you to assign or remove a label from the selected
item.
See Applying and Removing Labels on page 198.
Bulk Coding Allows you to apply issues, categories, and other field
coding to the selected item.
See Coding Multiple Documents on page 228.
Compare Docs Allows you to compare the contents of two items.
Select the documents that you want to compare, select
Compare Docs, and click Go.
A new window opens and displays a report that details
how the items compare.
Viewing Data Using Document Data Panels | 88
The Family Panel
The Family panel in Project Review lists the family relationships for email documents. The Family panel shows
the email message and any attachments to the message.
The Family panel will display related documents if you select the parent or child document.
Note: If you have a zip file containing a folder, the family relationship does not contain the folder because the
folder is omitted from view.
For both the message file and the attachments, you can do the following:
-Click the item to view the item in the Natural panel.
-Perform actions:
Apply labels.
See Applying and Removing Labels on page 198.
Perform Bulk Coding.
See Coding Multiple Documents on page 228.
-Compare documents.
-Click the hyper link to open the child or parent document in a new window.
Note: In order to avoid memory issues, the family panel will limit the amount of documents retrieved to 1000.
Families will be displayed for the following types of documents: TAR, JAR, GZIP, RAR, 7ZIP, ZIP, and
ZIPX. Families will not be displayed for the following type of documents: AD1, PST, NSF, OST, E01, CSV,
and DII.
Family Panel
Go Performs the selected action on the selected items.
Elements of the Conversation Tab
Element Description
Viewing Data Using Document Data Panels | 89
Elements of the Family Panel
Element Description
DocID Displays the DocID for the documents in the same family as the selected document.
ParentDocID Displays the DocID for the parent document.
AttachDocIds Displays whether the parent document has attachments.
ObjectID Displays the ObjectID of the document or the documents in the same family as the
selected document.
ObjectName Displays the ObjectName of the document or the documents in the same family as the
selected document
Actions You can select items and then perform the following actions on items in the list.
Label Assignment Allows you to assign or remove a label from the selected item.
See Applying and Removing Labels on page 198.
Bulk Coding Allows you to apply issues, categories, and other field coding to the
selected item.
See Coding Multiple Documents on page 228.
Compare Docs Allows you to compare the contents of two items.
Select the documents that you want to compare, select Compare
Docs, and click Go.
A new window opens and displays a report that details how the
items compare.
Go Performs the selected action on the selected items.
Viewing Data Using Document Data Panels | 90
The Linked Panel
The Linked panel in Project Review displays two types of documents:
-Documents manually linked to other documents of the same project
See Adding Links to a Transcript on page 182.
See Adding a Link on page 243.
-Documents linked to other documents during import
Linked Panel
Elements of the Linked Panel
Element Description
DocID The DocID of the linked documents.
LinkObjectID The ObjectID of the linked documents.
Path The path of the linked documents.
Actions You can remove links from a document. Select the linked documents that you want to
remove.
Go Click to execute the selected action.
Page Size Select the number of documents you want visible in the Linked panel.
Page Lists the page you are on and the number of pages. Click the next arrow to see the next
page.
Refresh Click the refresh button to update the Linked panel.
Link Lets you link additional documents.
Viewing Data Using Document Data Panels | 91
Adding a Link from the Linked Panel
You can manually link other documents.
To add a link from the Linked panel
1. Select a document that you want to add a linked document to.
2. In the Linked panel, click Link.
The Add Document Link dialog appears.
Add Document Link Dialog
3. In the Search field, enter the DocID of the document you want to link to.
4. Press the tab button to activate the Go button and click Go.
5. Select the document you want to link to from the search results.
6. Click Save.
Viewing Data Viewing Timeline Data | 92
Viewing Timeline Data
You can parse and view the following types of timeline data.
-Data that is contained in CSV files that are in the Log2timeline format
-EVTX event logs
You can view the data in the Alternate File Viewer of the Item List.
The individual records from the original files will be interspersed with other data, giving you the ability to perform
more advanced timeline analysis across a very broad set of data. In addition you can leverage the visualization
engine to perform more advanced timeline based visual analysis.
To process timeline files, there is a Timeline Options processing option. This option is not enabled by default.
You can view timeline data in one of two ways:
To expand timeline files and view individual records
1. Create a new project.
2. In the Processing Options, select Expand Additional Timeline Events.
3. Include a timeline file, such as a Log2timeline CSV or EVTX file in your evidence and process it.
4. In Review, in the Item List, you can click and view the contents of original file.
5. You can also view the expanded individual records in individual rows.
Log2Timeline items have row #... in the ObjectName.
EVTX items have a event # ... in the ObjectName.
6. You can use the Timeline view to sort items by data and time.
See Using the Timeline View on page 67.
To filter timeline data
1. You can filter your data to find timeline data.
For example, you can find Log2Timeline data by using the File Category > Other Known Types facets:
-The original zip files: Log2t CSV logs
-The expanded entries: Log2t CSV log entries
You can find EVTX data by using the File Category > OS/File System Files facets:
-The original EVTX files: Windows EVTX Events
-The expanded entries: Windows EVTX Event
View the original
files, such as the
CSV or EVTX
In the Item List, you can see the original files. When you select a file, you can view the
information that is contained in each file in the File Content pane.
Expand file data out
as individual
records
When you expand timeline files, each record is extracted. As a result, in the Item List,
each record is shown as its own item.
If you expand Log2Timeline files into separate records, you can also use columns
to view each field.
See the table Log2timeline CSV fields (page 93)
Viewing Data Viewing Timeline Data | 93
To add Log2Timeline-related columns in the Item List
1. In Review, click Options > Columns.
2. Add one or more Log2T columns.
3. Click OK.
Log2timeline CSV fields
Log2t Desc A description field, this is where most of the information is stored. This field is the full
description of the field, the interpreted results or the content of the actual log line..
Log2t Extra Additional information parsed is joined together and put here. This 'extra' field may
contain various information that further describe the event. Some input modules contain
additional information about events, such as further divide the event into source IP's,
etc. These fields may not fit directly into any other field in the CSV file and are thus
combined into this 'extra' field.
Log2t Filename The full path of the filename that contained the entry. In most input modules this is the
name of the logfile or file being parsed, but in some cases it is a value extracted from it,
in the instance of $MFT this field is populated as the name of the file in question, not the
$MFT itself.
Log2t Format The name of the input module that was used to parse the file. If this is a log2timeline
input module that produced the output it should be of the format Log2t::input::NAME
where name is the name of the module. However other tools that produce l2t_csv
output may put their name here.
Log2t Host The hostname associated with the entry, if one is available.
Log2t Inode The inode number of the file being parsed, or in the case of $MFT parsing and possibly
some other input modules the inode number of each file inside the $MFT file.
Log2t MACB The MACB or legacy meaning of the fields, mostly for compatibility with the mactime
format.
Log2t Notes Some input modules insert additional information in the form of a note, which comes
here. This might be some hints on analysis, indications that might be useful, etc. This
field might also contain URL's that point to additional information, such as information
about the meaning of events inside the EventLog, etc.
Log2t Short The short description of the entry, usually contains less text than the full description
field. This is created to assist with tools that try to visualize the event. In those output
the short description is used as the default text, and further information or the full
description can be seen by either hovering over the text or clicking on further details
about the event.
Log2t Source The short name for the source. This may be something like LOG, WEBHIST, REG, etc.
This field name should correspond to the type field in the TLN output format and
describes the nature of the log format on a high level (all log files are marked as LOG,
all registry as REG, etc.)
Log2t SourceType A more comprehensive description of the source. This field further describes the format,
such as "Syslog" instead of simply "LOG", "NTUSER.DAT Registry" instead of "REG",
etc.
Log2t User The username associated with the entry, if one is available.
Log2t Version The version number of the timestamp object.
Viewing Data Viewing Graphics and Videos | 94
Viewing Graphics and Videos
In the Natural panel, you can view the following kinds of media files that are in your project:
-View graphics files (such as JPEG, GIF, PNG)
-Play video files
The following video files are supported:
-View video thumbnail files
How videos are viewed is in part determined by the video processing options that were used when the
project was created. For example, you can view video thumbnails that were created at certain intervals.
To view thumbnails for video files, you must first enable the Generate (Video) Thumbnails processing
option when you create a project.
See Evidence Processing and Deduplication Options on page 166.
You can use the Thumbnail View to rapidly scan through the visual contents in a video file, without having
to launch and watch the entire video.
See Using the Thumbnail View on page 65.
To find graphics and media files
Do the following:
-Use filters, such as File Category or File Extensions.
-Use the Thumbnails View.
See Using the Thumbnail View on page 65.
To play a video file
1. Select a video file in the Item List or Thumbnail View.
2. Click the play button in the Natural Panel.
You can change the volume and expand the video viewer.
3G2 AVI MP4 SWF FLAC
3GP FLV MPG VOB MKV
ASF M4V RM WMV WTV
ASX MOV SRT OGG WEBM
Deleting Documents Deleting a Document | 95
Chapter 7
Deleting Documents
Users with the Delete Summaries permission can delete documents in the Item List panel of Project Review.
Users must be careful and back up the project before deleting documents.
You can delete individual records and documents from a project that has been added by either Evidence
Processing or Import. You can select any record or multiple records in Review and delete them. This will delete
the record and system generated data associated with the record, such as filtered text, .DAT files, and data from
the database.
Note the following:
-If a record is in use by another process, some part of the record might be locked, triggering an error when
you attempt to delete the record.
-If an original document has been included in a production set, you will not be able to delete that
document. This avoids issues with production sets.
-Both the Audit Log and the Work List displays what records have been deleted and which user has
deleted the record.
Note: You cannot delete an individual record that is part of a production set. However, you can delete a
complete production set.
You can also use the Delete action in the Item List to delete all filtered files without having to select the files
individually.
Deleting a Document
To delete a document
1. Log in as a user with Delete Summaries permissions.
2. Click the Project Review button in the Project List panel next to the project.
3. In the Project Review, ensure that the Item List panel is showing.
4. Use filters or others tools to cull the files in the Item List.
5. Check the documents that you want to delete. Skip this step if want to delete all the documents.
6. In the first Actions drop-down, select one of the following:
-Checked: Select this to delete just the checked documents.
-All: Select this to delete all of the documents on all pages of the Grid list.
7. In the second Actions drop-down, select Delete.
Deleting Documents Deleting a Document | 96
8. Click Go.
9. In the Confirm Delete Dialog, check Include Family to delete family documents as well.
10. Click Delete.
The job is sent to the Work List for the project/case manager to complete.
Note: When you apply the Delete action to filtered items in the Item List, the filtered data will not reset after the
data is deleted. You will need to click on the clear button to show all of the data back into the grid.
Searching Data | 97
Part 3
Searching Data
This part describes how to search data and includes the following sections:
-About Searching Data (page 98)
-Running Searches (page 100)
-Running Advanced Searches (page 117)
-Using the Search Tab (page 124)
-Using Filters to Cull Data (page 128)
Introduction to Searching Data About Searching Data | 98
Chapter 8
Introduction to Searching Data
This document will help you filter and search through data in the Project Review.
About Searching Data
You can use searching to help you find files of interest that are relevant to your project. After you perform a
search, you can save your search or share your search with groups. Then, you can filter your result set to further
cull down evidence. As you find relevant files, you can tag the files with Labels, Issues, or Categories for further
review or for export.
When you search data, you use search phrases to find relevant evidence. A search phrase is any item that you
would receive a search hit on, such as a word, a number, or a grouping of words or numbers.
See Building Search Phrases on page 103.
You can search for text that is either in the metadata of the file or in the body of a file. You can also select a
column in the Item List panel and filter on that specific column.
When you start a search, be mindful of the items in the list that you are starting with. For example, if you have
applied a facet filter to show only DOC files, and you search for a text string that you think is in a PDF file, it will
not find it. However, the same is not true for column filters. If you have applied a column filter to show only DOC
files and you search for a text string that you think is in a PDF file, it will locate the file, regardless of the previous
column filter application.
Searching Results
When you run a search, any items in your data that contain the search phrase are displayed in the Item List.
When you view an item in the Natural, Image, or Text viewers, the terms in the search phrase are highlighted.
You need to be aware of the following when viewing highlighted terms:
-After the first page of search results are available, the application retrieves the excerpts for the word/
phrase hits on the document through a separate workflow. Depending upon the load on the system,
highlights might take longer to appear.
-Search results are not highlighted in the view if the word phrases is split on separate lines, especially in
documents created in ASCII, such as text files.
-If you have a document where the text is arranged in columns, search results that appear in the same
column or span across multiple columns do not highlight in the Natural Viewer. The Text view should
highlight the results accurately.
Introduction to Searching Data About Searching Data | 99
To search data, see the following:
-Running Searches (page 100)
-Running an Advanced Search (page 117)
-Running Recent Searches (page 125)
-Saving a Search (page 126)
Search Limitations
When performing a Quick Search or Advanced Search, if you have over 10,000 total characters of search text,
the search may fail and the application may become non-responsive.
Running Searches Running a Quick Search | 100
Chapter 9
Running Searches
You can perform the following search tasks:
-Running a Quick Search (page 100)
-Searching for Virtual Columns (page 107)
-Running a Subset Search (page 108)
-Searching in the Natural Panel (page 109)
-Using Dates and Times in Search (page 111)
-Using the Search Excerpt Report (page 112)
-Using Search Reports (page 115)
-Running an Advanced Search (page 117)
When running a search, you build and use search phrases.
See Building Search Phrases on page 103.
Running a Quick Search
In most projects, relevant data and privileged information in a data set is found using quick searches. You can
use the basic search field in the Item List panel to help you perform fast filtering on selected evidence.
When you start a search, be mindful of the items in the list that you are starting with.
See About Searching Data on page 98.
Important:
A processing option, Disable Tab Indexing, disables the reindexing of labels, categories, and issues.
With this option, the application prevents reindexing from occurring as frequently while you are
reviewing data, and search counts appear correctly. This option is enabled by default. If this option is
enabled, in Review, the following text is displayed: Tag indexing is disabled. However, you can still
search for specific tags using a field search, such as “Label contains xxx”.
To run a quick search
1. Log in as a user with Run Search privileges.
2. Click the Project Review button in the Project List panel next to the project.
3. In Project Review, ensure that the Project Explorer, the Item List, and Natural panel are showing.
4. Populate the data in the Item List with the data that you want to search within.
See Selecting the Data that you Want to Search In on page 101.
Running Searches Running a Quick Search | 101
5. In the search bar of the Item List panel, enter a search phrase.
A search phrase can be either one word or or number or multiple words. You may also use operators or
boolean search phrases.
See Building Search Phrases on page 103.
6. Click Go to execute the search.
A green spinner indicates that the search is in progress. When the search is complete, the spinner is no
longer displayed.
The search is performed within the specified scope and searches the body content of the documents within the
scope. Also depending upon the type of search query, the query will also search the documents’ metadata.
Search results appear in the Item List panel.
If you are searching by keyword, you can select a document from your search results, and see highlighted
instances of the word in the Natural view. The instances will also be highlighted in the text view and in the Item
List if there are results in the metadata.
Quick searches will also appear in the Recent Searches on the Searches tab of the Project Explorer.
Note: You are unable to perform a quick search for values in the ProductionDocID column. To search for values
in the ProductionDocID column, use Advanced Search. See Running an Advanced Search on page 117.
Selecting the Data that you Want to Search In
When you perform a search, only the data that is contained in the Item List (all pages) will be searched. That
means that any data that you have filtered out of the list will not be searched.
This will apply the currently selected scope and any selected facets to the Item List, allowing you to search and
review on the resulting subset. The facets will persist through searches until you clear them. Scopes may be
changed and searches re-run by use of the Apply button as well. After updating a facet or scope item, you may
click the Apply button, which will update the scope and re-run any search that has not been cleared out by use of
the Clear Search button in the Search Options menu of the Item List panel.
To populate data in the Item List that you want to search from:
1. Select the data that you want to search in by doing the following:
1a. In the Project Explorer, the default scope selection includes all evidence items in the project. Using
the check boxes, uncheck items to exclude items from the scope of the search. These scope items
include:
Document Groups
Transcript Exhibits
Export Sets
Notes
Transcripts
1b. In the Facets tab of the Project Explorer, you may select any combination of facets to apply to the
current search scope.
2. Click the Apply check mark button in the top of the Project Explorer.
Running Searches Using Search Options | 102
Using Search Options
The following are search options that you can perform from the Search Options drop-down:
Search Options
Element Description
Clear Search This clears any search strings from the search bar and removes all results of the
search. The contents of the Item List are restored to how they were before the search.
Advanced Search Lets you perform and save advanced searches.
See Running Advanced Searches on page 117.
Vocabulary Lets you search within the current or all transcripts.
See Working with Transcripts and Exhibits on page 176.
Expansion Lets you include Family, Linked, or Similar Documents.
Settings Lets you configure the following search settings:
-Sorting
You can sort your search results by any column. By default, search results are
sorted by Relevancy in descending order. You can change the column by which to
sort by, such as ObjectID, extension, and so forth.
-Display Options:
Excerpts column
On by default. You can select to not display the Excerpts column. You can also
configure the number of excerpt words.
Relevancy column
On by default. You can select to not display the Relevancy column. If you turn
this off, results will not sort by Relevancy, even if that is the sorting selection.
Search Report
Options Lets you generate and download search reports.
See Using Search Reports on page 115.
Running Searches Building Search Phrases | 103
Building Search Phrases
When you search data, you use search phrases to find relevant evidence. A search phrase is any item that you
would receive a search hit on, such as a word, a number, or a grouping of words or numbers.
A search phrase can be any of the following:
-A single term, such as a word or number
For example, patent. Any document with the term “patent” will be found.
-A string of terms (within parentheses)
For example, 2010 patent application. Any document with the string “2010 patent application” will be
found.
-Multiple terms with boolean operators, such as AND or OR
For example, patent AND 2010. Any document with both “patent” and “2010” will be found.
See the following about building search phrases:
-See Using Search Operators on page 103.
-See Using Boolean Logic Options on page 105.
-See Using ? and * Wildcards on page 106.
-See Searching Numbers on page 107.
-See Search Limitations on page 99.
Using Search Operators
You can use a Boolean search to find the logical relationships among the search terms and phrases that you
enter. A Boolean search consists of the following three full logical operators:
-OR
-AND
-NOT
Note: The NOT operator by itself is not an option in Advanced Search. The Not Contains and Not Equals
operators are available in Advanced Search. However, you can use the NOT operator in Quick Search.
If you use more than one logical operator, you should use parentheses to indicate precisely what you want to
search for. For example, the phrase apple and pear or orange could mean either (apple and pear) or orange,
or it could mean apple and (pear or orange). Use parentheses to clarify which of the two searches that you
want.
However, if you want to execute searches that contain parentheses as part of the search term, you should
enclose the search term with double quotes. For example, if you want to search the To field of emails for the
phrase, Carton, Sydney (TTC-San Antonio), you need to write the search query as To Contains “Carton,
Sydney (TTC-San Antonio).” This will allow you to get the expected search results and those search results will
be highlighted in the Text view. However, the search results will not be highlighted in the Natural view.
Only alphanumeric characters are recognized in search terms. Also, certain non-alphanumeric characters are
recognized by the search, such as @ and $. To search for text with non-alphanumeric characters, include the
whole string in quotes. For example, if you searched for mckay@accessdata, you would find
mckay@accessdata. But if you searched for mckay#accessdata, it would not return results.
Running Searches Building Search Phrases | 104
Noise Words
Noise words, such as if, or the are ignored in searches. For example, if you were to search on the term MD&A,
the search would treat the & as an AND operator and return documents with both the terms “MD” and “A” in
them. However, because A is a noise word, the search only highlights “MD” in the document.
When a search phrase contains a noise word with another term, the search results will return results with the
noise word, as well as other words that are in the same place as the noise word. For example, by searching for
the term MD and A, not only are results returned that locate the terms “MD” and “A,” but also “MD” and “<any
word that is adjacent to ‘MD’>.” For example, by searching for the term MD and A, you might also get the result
of “MD” and “Surgeon.”
However, if you were to search on MD&Surgeon, you will only get “MD” and “Surgeon.
Words that are used as logical operators, such as And or Or will be treated as operators and not as part of the
search phrase. If you want to include words such as and or or as part of the search phrase, you need to enclose
the entire search phrase in double quotes. For example, enclosing in double quotes the search phrase “this or
that” will return only those occurrences where this exact phrase appears, and not where this appears
separately from that.
The following words and symbols are ignored in searches:
@, a, about, after, all, also, an, and, any, are, as, at, be, been, but, by, can, come, could, did, do, even,
for, from, get, got, he, her, him, his, how, i, if, in, into, it, its, just, like, me, my, not, now, of, on, only, or,
other, our, out, over, see, she, some, take, than, that, the, their, them, then, there, these, they, this, those,
to, too, under, up, very, was, way, we, well, were, what, when, where, which, while, who, will, with, would,
you, your
Also, there are exceptions for certain characters:
-The characters 0-9, a-z, A-Z, and the _ (underscore) are searchable.
-Other characters, such as - , +, and ; are not searchable. With a few exceptions, they are treated as
spaces.
-The characters ? and * are wildcards. See Using ? and * Wildcards on page 106.
-The %, ~, #, & , :, = characters are used in advanced variations of the search, such as synonym or fuzzy
searches. See Understanding Advanced Variations on page 121.
Note: The & symbol is interpreted as an AND operator. If you searched for Steinway & Sons, it would search for
Steinway AND Sons. To use the & symbol in a search, include it in quotes. For example, “Steinway &
Sons”.
Using the @ Symbol
In versions 6.0.1 and earlier, the @ symbol was indexed as a regular character and was searchable. One result
of this was that when searching for names within email addresses, you had to use the full address or a wildcard.
For example, if you searched on gwashington, it would not result in a hit for gwashington@usa.gov. Instead, you
had to search for gwashington* or gwashington@usa.gov.
In versions 6.0.1 SP1 and later, the @ symbol is now indexed as a space character and is ignored. This is the
same as FTK/LAB. Now, if you search for gwashington, it will result in a hit for gwashington@usa.gov.
This change is only in effect for projects that were created in 6.0.1 SP1 and later, not just reviewed or indexed in
6.0.1 SP1 or later.
Running Searches Building Search Phrases | 105
Using Boolean Logic Options
The following table describes the boolean options that you can use in searches. Some boolean options are
combined in the table to serve as examples of what is possible.
Boolean Logic Options
Option Description
AND Returns as search results those evidence files that contain all of the search words that you
specified. For example:
marijuana AND cocaine
Matches all evidence files that contain both the words “marijuana” and “cocaine.” However, if you
search for the example:
marijuana + cocaine
You will only get search results highlighted if “marijuana” and “cocaine” are adjacent.
OR Returns as search results those evidence files that contain any of the search words that you
specified or at least one of the search words that you specified. For example:
marijuana OR cocaine
Matches all evidence files that contain either the word “marijuana” or “cocaine.”
NOT Returns as search results those evidence files that do not contain the search words that you
specified.
This expression is an efficient way to eliminate potential privileged data from production sets.
Used the expression at the beginning of your search word or phrase. For example:
NOT licensed
Matches all evidence files except those with the word “licensed” in them.
Note: Do not use implied boolean search with this operator (Example: -license). It will
return incorrect results.
W/N Returns as search results those evidence files that include the specified word or phrase that is
found within so many number of words of another.
For example:
(rock AND stump) W/2 (fence AND gate)
Matches all evidence files that contain both the words “rock” and “stump” that occur within two
words of both the words “fence” and “gate.”
or
(pear w/10 peach) W/7 (apple OR plum)
Matches all evidence files that contain the word “pear” that occurs within ten words of the word
“peach” and that also occurs within seven words of either “apple” or “plum.”
You can also use this option to search for evidence files with known words in certain locations or
instant messaging chats.
Note: For all evidence files other than email, all occurrences of the words on either side of
the W/N operator are highlighted. For email files, there is no highlighting on the Natural
and Text views.
AND
NOT Returns as search results those evidence files that contain the expression on the left when the
expression on the right is not found. For example:
peach AND NOT pineapple
Matches all evidence files that contain the word “peach,” but do not also contain the word
“pineapple.”
Running Searches Building Search Phrases | 106
Using ? and * Wildcards
A search word can contain the wildcard characters * and ?. A ? in a word matches any single alphanumeric
character, and a * matches any number of alphanumeric characters. The wildcard characters can be in any
position in a word.
You can use wildcards with search phrases that use operators.
For example, 20* OR pat* OR appl* would match any document that had 2010, 2011, patent, patents,
application, or applications.
You can use wildcards within terms that are within text strings.
For example, “20* p*t a*n” would match 2010 patent application.
? and * Wildcard Limitations and Tips
-The ? and * wildcards can be used for alphanumeric characters only.
For example, a search of PSE?G or PSE*G will not find PSE&G.
-The ? and * wildcards only work within single words not separated by spaces, periods, commas, and so
on.
For example, a search of “n*w” will find “New” but a search of “n*k” will not find “New York” or New.York”.
OR NOT Returns as search results those evidence files that contain either the left expression or
specifically not containing the right expression. For example:
peach OR NOT pineapple
Matches all evidence files that contain the word “peach,” and any other file that does not contain
the word “pineapple.”
Note: The search phrase before the OR operator is highlighted.
Wildcard Description
? Matches any single alphanumeric character.
The following are examples:
-appl? matches apply or apple, but not apples
-a?l matches all or aol
*Matches any number of characters within a single word.
The following are examples:
-appl* matches apply, apple, apples, application
-ap*ed matches applied, approved
-appl*ion matches application
-a*l matches all, aol, april, actual, additional
-*cipl* matches principle, participle
Note: Use of the * wildcard character near the beginning of a word will slow searches
somewhat.
Boolean Logic Options (Continued)
Option Description
Running Searches Searching for Virtual Columns | 107
Searching Numbers
When searching for numbers, be aware the commas, dashes, and spaces are word separators. A word
separator will find evidence files where terms are separated by that separator or space.
For example:
-A search of 123,?56 will find
123,456, 123,556, 123,656, etc.
123-456
123 456
-A search of 123-456 will also find 123,456
-A search of *123, 456* will find
xxx123
456xxx
To find numbers containing a comma, dash, or space, use a string in parentheses.
Searching for Virtual Columns
You can search for virtual columns in the quick search field. Virtual columns are fields of data that are included in
the records, but there is not a physical column in the database that correlates with that data. Searching for virtual
columns will result in records that contain the virtual data, but the column will not actually appear in the Item List
panel.
Examples of virtual columns:
-AnyDate
-AnyField
-AnyText
-IsPivot
Running Searches Running a Subset Search | 108
Running a Subset Search
After running any kind of search, you can run another search that is a subset of your search. Subset searches
appear in your recent searches. Subset searches connect your first search with your second search using an
AND connector. Subset searches will appear in the recent searches of the Searches tab of the Project Explorer.
To run a subset search
1. Run any kind of search.
See Running a Quick Search on page 100.
See Running an Advanced Search on page 117.
2. Enter new search criteria in the quick search field in the Item List panel.
Subset Search Button
3. Click the Subset Search button.
Your search results appear in the Item List panel.
Returning to a Previous Search
After you run a subset search, you can return to a previous search using the subset drop-down.
To return to a previous search
After you run a quick search and a subset search, expand the Subset Search drop-down and select
Previous Search.
Running Searches Searching in the Natural Panel | 109
Searching in the Natural Panel
In the Natural panel, you can use the Standard Viewer or the Alternate File Viewer to search by keyword in the
selected document.
See Using the Standard Viewer and the Alternate File Viewer on page 78.
Note: You cannot search for numerals in spreadsheets.
To search in the Natural panel
1. In Project Review, ensure the Natural and Item List panel are showing.
2. Select a document in the Item List that has a native file.
3. Do one of the following:
-In the Alternate File Viewer:
3a. In the Find field, enter a search term for which you want to search.
3b. The first instance of a found search term is highlighted in the Natural view.
3c. Click the > next and < previous buttons to see the other instances of the keyword.
-In the Standard Viewer:
3a. In the Search field, enter a search term for which you want to search.
3b. The search field provides a type-down search as you enter text.
3c. All instances of the search term are highlighted.
3d. Click the > next and < previous buttons to see the other instances of the keyword.
Using Global Replace
In the Item List, you can use Global Replace to globally search the fields in documents and replace a keyword or
phrase. Only one Global Replace job can be submitted at a time per project. Once the job is submitted, you will
have thirty minutes to either manually commit the job or allow it to commit automatically. After a Global Replace
job has been committed, you can choose to create a new Global Replace job for that project.
Note: If Global Replace jobs are submitted by two different users on the same project at the same time, both
Global Replace jobs will fail. However, if two different users submit Global Replace jobs on two separate
projects at the same time, both Global Replace jobs should complete successfully.
See Committing a Global Replace Job on page 110.
To use Global Replace
1. In Project Review, either select a document in the Item List or select All from the actions.
2. Select Global Replace from the pull-down menu and click Go.
The Global Replace dialog appears.
Running Searches Using Global Replace | 110
Global Replace Dialog
3. Choose which field that Global Replace will search and replace:
-Text
-Number
-Date Time
Note: You cannot search for a specific date and replace it with a fuzzy date.
4. Choose the fields you want to look in from the Available list of fields, moving them to the Selected list of
fields. The fields available will change depending on what is chosen in the Look In drop-down.
5. Click Submit.
Once you have completed the Global Replace action, return to the Work List on the Home page. If there
were any items that failed to code, they will be listed by their number under the Work List. You can then
resubmit Global Replace for those failed items.
Committing a Global Replace Job
You must manually commit a Global Replace job if you want to run another Global Replace job on the same
project before thirty minutes has elapsed. You can also undo a Global Replace job within that thirty minute
window.
To manually commit a Global Replace job
1. In the Work List on the Home page, select the Global Replace job.
2. Click Commit .
3. A Commit job will appear in the Work List.
4. (optional) Click Undo to cancel a Global Replace job. You cannot cancel a Global Replace job
once thirty minutes has elapsed from the job’s creation.
Running Searches Using Dates and Times in Search | 111
Using Dates and Times in Search
Using Dates and Times in Searches
You can perform searches based on dates and times. For example, you can perform searches based on the
date a files was created or when an email was sent or received. The following are examples of date or time
searches:
-2/2/2008 - this will find any item with text or a database date of 2/2/2008
-anydate = 2/5/2011 - this will find any item with an event occurring on 2/5/2011
-anytext = 2/5/2011 - this will find any item with a date of 2/5/2011 in the text
-receiveddate = 12/18/2011 - this will find emails that were received on 12/18/2011
-receiveddate between 12/17/2011 and 12/19/2011 - this will find emails that were received between those
dates
-receiveddate > 12/17/2011 - this will find emails that were received after 12/17/2011
-receiveddate < = 12/17/2011 - this will find emails that were received on or before 12/17/2011
How Time Zone Settings Affect Searches
By default, date and times from metadata that you see in Review are in UTC format. These dates and times are
converted to UTC when data is entered in a project. As a result, by default, email dates and times, and file stamp
date and times are displayed in the UTC time zone.
However, an administrator can configure a Display Time Zone for a project. If this was done, then all dates and
times are offset to be shown in the specified time zone. For example, suppose an email was sent on 1/1/ 2010 at
1:15 am based on UTC time. If the project was set to the display the Pacific Time Zone, the email sent data
would have an -8:00 offset. As a result, it would have a sent date and time of 5:15 pm on December 31, 2009.
The offset does apply not to dates or times that are in the text body of a document, only dates in the metadata--
for example, file creation dates, email sent dates. As another example, if an email is a reply, the date and time of
the original email is in the email but simply as text, not metadata.
If you perform a search based on a metadata date or time, be aware the Display Time Zone will be used, not the
UTC date and time.
Viewing the Display Time Zone
To the Display Time Zone settings for a project
1. On the Home page in Review, select the case.
2. On the (Info) page, view the Display Time Zone value.
The time zone and the offset from UTC is displayed.
Running Searches Using the Search Excerpt Report | 112
Using the Search Excerpt Report
After performing a search, you can generate a Search Excerpt Report. You generate and see this report in the
Search Excerpts panel. This panel is now included by default in the Search layout.
You can generate the Search Excerpt Report after you have completed a search. When you generate the
Search Excerpt Report, a dtSearch job is run in the background on the text of the documents. The Search
Excerpt Report contains a list of all of the items that have search hits.
The excerpts can viewed in two different tabs:
-Document Type - Items are clustered by document type, such as email Message, Microsoft Word,
PowerPoint, PDF, and so on. Under each Object ID item, there is a list of excerpts of the text that
contains the search hits.
-Search Context - You can display the 1, 2, or 3 words before and after each search term hit. This lets you
more easily find the results you are looking forward by seeing the search term in context with other words
within each excerpt.
You can click either the item or the excerpt and the document is shown in the Natural view and the search results
and the excerpts are highlighted.
The Search Excerpt uses dtSearch to search for text strings. dtSearch will find exact terms unless you use
wildcards. For example, if your initial search is for the word document, other forms of the word, like documents or
Running Searches Using the Search Excerpt Report | 113
documented will be highlighted as a partial hit, but will not be shown as excerpts --it will not show excerpts of text
containing documents or documented. However, if your search includes a wildcard, like document*, then it will
display excerpts for all forms of the word.
Also, the dtSearch will not return excerpts for search results that do not contain text strings. For example, you
can search on a database property such as ObjectID > 50. Because there are no text hits, no excerpt scan be
generated.
You can also save and download a Search Excerpt report in CSV format.
To access the Search Excerpt panel
1. Open a project in Review.
2. Click the Layouts drop-down.
3. Click Panels.
4. Make sure that the Search Excerpt panel is checked.
5. If it is already checked, click the Search Excerpt panel in Review.
To generate the Search Excerpt Report
1. Run a search and let it complete.
2. In the Search Excerpt panel, click Create Search Excerpt Report.
A dtSearch job is run in the background to generate the list.
3. Click the Document Type tab.
The resulting view lists all items that contain the search results.
The items are clustered by document type, such as email Message, Microsoft Word, PowerPoint, PDF,
and so on.
3a. Expand a document category.
All of the items are listed by their ObjectID.
It also shows how many excerpts within that item meet the search results.
3b. Expand an item.
One or more excerpts containing the matching search hit from within the document are displayed.
4. Click the Search Context tab.
The resulting view lists all items with the default search context of:
-Sort Children: By Excerpt Hits
-Return: Top 10
-1 word before
-0 words after.
4a. Change any of the properties and click Refresh.
Sort Children By: This determines how the children are sorted.
- By Excerpt Hits
- By Object ID
- Document type
Return Top (10, 20, or 50)
Words before term (0,1,2)
Words after term (0,1,2)
Running Searches Using the Search Excerpt Report | 114
5. You can do one of the following:
-Click an Object ID item.
If you click an item, the document is opened in the Viewer and the search results are highlighted in
the document.
-Click an excerpt.
If you click an excerpt, and if the document has been converted to SWF, the document is displayed
in the Standard Viewer, and the whole excerpt is highlighted along with the search results. If the
document has not been converted to SWF, the document is displayed in the Alternate File Viewer
and only the search results are highlighted.
See Using the Standard Viewer and the Alternate File Viewer on page 78.
Performing either of the above actions will filter the Item List to the item you are viewing.
6. To restore the Item List to include all of the documents from the search, click Return Item List to
Search Results.
7. To save and download a report, click Save.
Running Searches Using Search Reports | 115
Using Search Reports
About Search Reports
You can generate, download, and view search reports. The search reports provide a history of a search and
information about the results.
The reports are saved in XLSX format. The report has the following XLSX sheets:
Generating and Downloading a Search Report
After you have generated a search report you can download it in one of two ways:
-In Review, from the Search Options.
-On the Home page, on the Reports tab, under Search Reports.
To generate and download a search report
1. In Review, after performing a search, click Search Options.
2. Click Search Report Options > Generate Search Report.
After several seconds, the report is generated.
To download the report, click Download Search Report.
3. Select to Open or Save the report.
By default, the report is saved in the browser’s Downloads folder as Search History Report - n.
You can use Save As to specify a filename and path.
Search Report Sheets
Sheet Description
Details Includes the following:
-The date and time of the search
-Who performed the search
-Which phrase was searched for
-Which search options were used
-Information about the files that were in the search results
Filters Which facets were included and excluded and which Quick Filters were applied.
Documents Group Any related Document Groups
Hits by Type Details which file types hits were found in
Keywords Details hit counts for each keyword used
Files Details of the files for the search hits
Running Searches Using Search Reports | 116
About the Search Report Details
The following table describes some of the information provided in the report details.
Search Report Details
Field Description
Total Files Includes all emails and eDocs that match the search criteria.
Unique Family Items This count is the number of files where any single family member had a keyword
hit. If any one file within a document family had a keyword hit, the individual files
that make up this family are counted and added to this total. For example, one
email had 3 attachments and the email hit on a keyword, a count of 4 files would
be added to this count as a result.
Unique Family Emails This count is the number of emails that have attachments where either the email
itself or any of the attachments had a search hit. This count is for top level
emails only. Emails as attachments are counted as attachments.
Unique Emails with no
Attachments This count is the number of the emails that have no attachments where a search
hit was found.
Unique Loose eDocs This count is the number of loose edocuments where a search hit was found.
This does not include attachments to emails, but does count the individual
documents where a hit was found from within a zip file.
Total Hit Count This count is the total number of hits that were found within all of the documents.
Max Relevancy This is the maximum relevancy score achieved with the search criteria. *
Min Relevancy This is the minimum relevancy score achieved with the search criteria. *
Note: * Max and Min relevancy scores are calculated based on the total number
of hits in the document as a percentage of the maximum number of hits found
in a during the search when performing an index search. For example, if one
document contains 50 hits but another document in the results has 100 hits
(and that’s the max) then the first document will be scored as 50% relevant
and the second document will be scored as 100% relevant. These relevancy
scores are only relative within a single search set. They may vary when the
search set is increased or decreased. Additionally, some searches are run
against the database instead of the index and these searches will always get a
100% relevancy score. A database search would be one that requests
information within a specific field or non-indexed field such as “ObjectID =
xxx”.
Running Advanced Searches Running an Advanced Search | 117
Chapter 10
Running Advanced Searches
Running an Advanced Search
If using a simple search does not return the results you expected, you can use advanced searching techniques
to pinpoint relevant data and privileged information.
AccessData software uses the utility dtSearch to index project data. In Advanced Searching, you can query the
index using a specialized query language. In addition to extended searching capabilities, the index allows
searches to be returned in seconds instead of the minutes or hours that are required for a standard linear
search.
Note: In order for a document to be indexed for search, it must contain at least six characters in the file.
Documents with less than six characters will not be indexed. However the metadata in those documents
will be indexed normally.
Note: When searching using the DocDate or NoteDate fields, you must search using a YYYYMMDD format
regardless of how your date fields are formatted for display.
For more information on using dtSearch syntax, you can view technical papers on the AccessData web site:
http://www.accessdata.com/technical
To run an advanced search
1. Log in as a user with Run Search privileges.
2. Click the Project Review button in the Project List panel next to the project.
3. In Project Review, ensure that the Project Explorer, the Item List, and Natural panel are showing.
4. Populate the data in the Item List with the data that you want to search within.
See Selecting the Data that you Want to Search In on page 101.
5. Click the Search Options button in the Item List panel and select Advanced Search.
Running Advanced Searches Running an Advanced Search | 118
Advanced Search Dialog
6. In the Information section, do the following:
6a. Enter a Name for the search if you want to save the search. Otherwise, the search will appear in
the Recent Searches list and will not be able to be saved.
6b. (Optional) Select the type of Variation you want to include in your search.
See Understanding Advanced Variations on page 121.
6c. In the text field, enter the free form text you want to include in the search. Freeform searching lets
you combine keyword, boolean, and regular expression criteria to perform a search on evidence
files.
See Using the Term Browser to Create Search Strings on page 122.
6d. To add related terms for the words you entered, click Expand All.
See Using the Term Browser to Create Search Strings on page 122.
6e. To import a list of terms from a TXT file, click Import Terms.
See Importing Index Search Terms on page 123.
7. Expand the Conditions section to search within the fields/columns of the documents.
Conditions
8. In the Conditions section, do the following:
8a. Select a field that you want to search within.
See the Project Manager Guide for more information on creating custom fields.
Running Advanced Searches Running an Advanced Search | 119
8b. Select an Operator from the drop-down.
See Using Search Operators on page 103.
See Using Boolean Logic Options on page 105.
8c. Select or enter a value using the following:
Field: Enter text or symbols.
Date: Enter a date or click the calendar to select a date.
Look up button: Click the blank button to look up available search criteria for the selected field.
8d. Select either “And” or “Or” as the connector.
See Using Boolean Logic Options on page 105.
8e. Click Add Row to add additional conditions.
8f. Set parenthetical criteria. Then, click Validate Grouping to validate your parenthesis.
9. Expand Result Sorting to select the column by which you want the search results to be sorted. The
column does not need to be visible to sort by it.
Result Sorting
9a. In the Sort By drop-down, select the field you want to sort by.
9b. In the second drop-down, select whether you want to sort by Ascending or Descending.
10. Click Search.
Advanced Search Operators
The following search operators are available in the advanced search:
Advanced Search Operators
Operator Description
Equal Searches for the exact value entered.
Not Equal Searches for everything in the selected field except the exact value entered.
Exists Searches for the existence of data within the selected field.
Fails Searches for all documents that do not contain data within the selected field.
GreaterThan Searches for a number greater than the value entered.
GreaterThanEqualTo Searches for a number greater than or equal to the value entered.
LessThan Searches for a number less than the value entered.
LessThanEqualTo Searches for a number less than or equal to the value entered.
Contains Searches for the value entered within a string. The value should be a full word. If
you want to search for a partial word, you need to include the * operator.
Running Advanced Searches Running an Advanced Search | 120
The search operators available depend upon the field selected to search. Not all search operators are available
for all fields.
Advanced Search Operators Exceptions
The ProductionSetID column contains values for exported files from both Export Sets and Production Sets and is
used for associating exported files with the original file. This column is populated with queries from multiple
tables and does not operate like other standard metadata columns. Search operators will return different results
than expected with other columns. You can expect the following results when searching the ProductionSetID
column:
NotContains Searches for everything except the value entered. The value should be a full word.
If you want to exclude a partial word, you need to include the * operator.
Between Searches between a range of dates or numbers.
NotBetween Searches for all dates or numbers except the range selected.
Search Operators Exceptions for ProductionSetIDs
Operator Results
Exists Search results return only the produced document.
Fails Search results return source documents and not the produced copy.
Contains Search results return only the produced document.
Not Contains Search results return source documents and not the produced copy.
Advanced Search Operators (Continued)
Operator Description
Running Advanced Searches Understanding Advanced Variations | 121
Understanding Advanced Variations
The following table describes the Variation options in the Information section of the Advanced Search dialog.
Variation Options in the Advanced Search Dialog
Search Variations Description
None No search variations are applied.
Stemming Finds grammatical variations on word endings. For example, stemming reduces
the words “fishing,” “fished,” “fishy,” and “fisher” to the root word “fish.”
Phonic Finds words that sound like the word that you are searching and begins with the
same first letter. For example, searching for “whale” using phonic, would also find
wale and wail.
Synonyms Finds word synonyms. For example, searching on “fast” would also find “quick”
and “rapid.” You can enable this option for all words in a request. You can also
add the “&” character after certain words in your request.
Related Finds all words in the search criteria and any related words from the known
related categories.
Fuzzy Finds words that have similar spellings, such as “raise” and “raize.” You can
enable this option for all words in a request.
The level of fuzziness that you can set is 1-10. The higher the level of fuzziness,
the more differences are allowed when matching words, and the closer these
differences can be to the start of the word. Setting too many letter differences
may make the search less useful.
Dragging the slider bar to the right increases the number of letters in a word that
can be different from the original search term.
Dragging the slider bar to the left decreases the number of letters in a word that
can be different from the original search term.
You can also add fuzziness directly in the search term you enter using the “%”
character. The number of % characters that you add determines the number of
differences that are ignored when you search for a word. The position of the %
characters determines how many letters at the start of the word have to match
exactly.
For example, “ca%nada” must begin with “ca” and have just one letter difference
between it and “canada.” Whereas, “c%%anada” must begin with “c” and have
only two letter differences between it and “canada.” In another example,
marijuana can be spelled “marihuana” or “maryjuana.” In this project, your
search expression could be “mar%%uana.”
As with the fuzzy slider bar setting, you should exercise care when you use
multiple % symbols because the number of junk hits rises quickly with each
added error.
Running Advanced Searches Using the Term Browser to Create Search Strings | 122
Using the Term Browser to Create Search Strings
You can create a search using terms that are related to any keyword. You can use the Term Browser to generate
a list of similar words. You then select which words you want to include in the search.
For example, you may start with a keyword of “delete.” By using the Term Browser, it will suggest synonyms,
such as “erase” and “cut.” It will also suggest related terms, such as “cut,” “deletions,” “excise,” and “expunge.” It
will also suggest general related terms, such as “censor,” “remove,” “take,” and “withdraw.” You can select which
of those words to include in your search.
To search for terms using related words
1. In Project Review, in the Item List panel, click Search Options > Advanced Search.
2. Enter a keyword.
3. Click Expand All.
Term Browser
4. In the Term Browser, highlight the keyword.
A list of synonyms is generated.
5. To add other related words, select the Include Related, Include Specific, and Include General check
boxes.
6. Select the words that you want to include in the search or click Variations to select all words.
7. To build a search including the words that you selected, click Apply.
8. You can edit the search or run it by clicking Search.
Running Advanced Searches Importing Index Search Terms | 123
Importing Index Search Terms
You can import a list of search terms. This lets you reuse a list of search terms that you saved from previous
searches, or that you saved for documentation purposes. You can import terms for CSV or TXT files.
To import a saved search terms file
1. In Project Review, in the Item List panel, click Search Options > Advanced Search.
2. Click Import to import a set of search terms.
3. Select the text file that you previously saved.
4. Click Open.
Using the Search Tab The Search Tab | 124
Chapter 11
Using the Search Tab
The Search Tab
The Search tab in the Project Explorer can be used to view recent searches, your searches, and shared
searches.
Search tab in Project Explorer
Elements of the Search Tab
Element Description
My Searches Displays all the searches that the logged-in user has saved.
See Saving a Search on page 126.
Users can run, delete and edit saved searches.
Users can also share their searches. If you share a search, it is moved to the Shared
Searches folder.
See Sharing a Search on page 127.
Using the Search Tab Running Recent Searches | 125
Running Recent Searches
When you execute a search, the search conditions are saved. You can view and reuse recent searches. The last
ten searches are saved in the Recent Searches. To run recent searches, you must have the Run Searches
permission.
To run a recent search
1. Log in as a user with Run Searches permissions.
2. Click the Project Review button in the Project List panel next to the project.
3. In Project Review, ensure the Project Explorer is showing.
4. Click on the Searches tab.
5. Expand the Recent Searches.
6. Right-click the search and select Run Search.
The search is run using the original search scope and the original search criteria. The search results
appear in the Item List panel.
Clearing Search Results
After you have performed a search, the items in the Item List are the result of the list. You can clear the search
result to view the documents in the Grid before you performed the search.
To clear search results
1. In Project Review, ensure the Item List panel is showing.
2. Click Search Options > Clear Search.
Recent Searches Every time a search is performed by the logged-ed in user, it is saved in the Recent
Searches folder. The last 10 searches are saved here in chronological order. Users can
run and delete searches from Recent Searches.
Shared Searches Displays all the shared searches that the user has permissions to access. Users can
run searches from Shared Searches.
Elements of the Search Tab (Continued)
Element Description
Using the Search Tab Saving a Search | 126
Saving a Search
You can save any advanced search that you design in the Advanced Search Builder. All saved searches are
stored in the Searches tab of the Project Explorer. You can use saved searches to run past searches again or to
share your search with a group of users.
To save a search
1. Log in as a user with Run Search privileges.
2. Click the Project Review button in the Project List panel next to the project.
3. In Project Review, ensure that the Project Explorer, and the Item List panel are showing.
4. Populate the data in the Item List with the data that you want to search within.
See Selecting the Data that you Want to Search In on page 101.
5. Click the Search Options button in the Item List panel and select Advanced Search.
6. Enter a Name for the search.
7. Enter criteria for the search.
See Running Recent Searches on page 125.
8. Click Save.
Using the Search Tab Sharing a Search | 127
Sharing a Search
You can share your saved searches with other groups of users. To share a search, you need to have the
Manage Searches permission.
To share a search
1. Log in as a user with Manage Searches permissions.
2. Click the Project Review button in the Project List panel next to the project.
3. In Project Review, ensure the Project Explorer is showing.
4. Click on the Searches tab.
5. Expand My Searches.
6. Right-click the search and select Manage Permissions.
Assign Security Permissions
7. Check the groups with which you want to share the search.
8. Click Save.
Using Filters to Cull Data Filtering Data in Case Review | 128
Chapter 12
Using Filters to Cull Data
Filtering Data in Case Review
In Project Review, you can filter evidence to help view only relevant evidence for the project. After filtering data,
the results are then displayed in the Item List. You can also use searches and column sorting to help you further
review and cull down evidence.
About Filtering Data with Facets
You can filter data using facets. Facets are properties of a document that you can include or exclude. The
following are a few example of facets:
-Object type and object sub-type (File > Email, File > Spreadsheet, Disk Image, Partition)
-File extension type (EXE, DLL, TXT, GIF, DOC, XLS)
-File category (Documents, Email, Graphics, Audio Multimedia, Video Multimedia)
-File Size (Small, Medium, Large)
-Email Senders Address
-Email Recipients Address
-Email by Date
See Available Facet Categories on page 133.
That facets that are available to use are based on your evidence. For example, if there are no XLSX documents
in your evidence, the XLSX facet is not displayed.
By default, when you first open a project in Project Review, all facets are applied, and as a result, all evidence is
listed in the Item List. You can use the facets to include or exclude evidence from the Item List. You can choose
one or more facets within a single category or you can choose facets across multiple categories.
For example, you can filter evidence to only display emails sent by one person to another person with a certain
date range. As another example, you can filter evidence to display only DOC or DOCX files that have a specific
label applied.
Applied facets are persistent across searches and have to be cleared by you manually.
Note: When you cull data with facets, this filtering will override and clear other filters applied to the Item List,
including Search and Column Filters.
Using Filters to Cull Data Filtering Data in Case Review | 129
About Dynamic Facets
Most facets are now dynamic. When you select and apply a facet, all other facet categories will reflect the results
of the previously selected facet. Other categories will only show facets that have data based on the applied
facet.
For example, suppose that before applying any facets, that under File Extensions, there are 25 DOCX files of
various file sizes. And then suppose you apply a facet to include only Large files. When you look at the File
Extensions filter again, you will only see the number of DOCX files that have a Large file size.
However, applying column filters, column filters, or searches does not affect facet counts.
About Sortable and Searchable Facets
Some facet categories include a pre-configured set of facets. For example, under the File > File Size facet
category, there will be a maximum of five facets: Tiny, Small, Medium, Large, and Huge.
Using Filters to Cull Data Filtering Data in Case Review | 130
Some facet categories include a dynamic set of facets based on the files in the evidence. For example under the
File > File Extensions facet category, facets are shown for all of the file extensions that exist in the evidence.
These facet categories can potentially have a very large number of facets. A project could easily include dozens
of different file extensions.
Facet categories that have a large number of facets have additional features that help you use them:
-By default only nine facets are shown but you can select to see more.
-Facets are sortable.
By default, the facets are sorted by the facets with the most hits. When you open a category, by default
the nine facets with the most hits are shown. You can use the following sort orders:
Ascending by name
Descending by name
Ascending by the number of hits
Descending by the number of hits
-You can search for specific values within the facets.
For example, if there are 100 email senders names, you can search for a certain name. You can clear the
search by clicking the red X.
Using Filters to Cull Data Filtering Data in Case Review | 131
About Excluding Tags Filters From a Facet Search
You can exclude Tags filters (categories, issues, labels, and summaries) from a facet search. The default for the
Tags facets are checked, or included. Clicking the check box once actively excludes the facet in filters group.
Clicking the check box a second time clears the check box and the facet is not included in the facet search.
When excluded, a red x appears in the facet check box, indicating that the facet is excluded. The hyperlink to
apply the excluded facet is disabled. You need to be aware of the following considerations when excluding Tags
facets:
-For labels, the exclude feature applies to all labels in a group. However, if there are children under the
labels, and one child label is selected for exclusion while another is not, the label group appears blank.
This is because you cannot include a whole label group when one of the child labels is excluded.
-For issues, you can exclude or include an individual issue. Additionally, you can exclude a child issue
while including a parent issue or vice versa.
-If you have a document that has been assigned a tagged item that is included in a facet in the Tags filter
and has also been assigned a tagged item that is excluded in a facet in the Tags filter, the facet does not
display the document. For example, a document may be tagged with both Tag 1 and Tag 2. If all
documents with Tag 1 are included in the facet and all documents with Tag 2 are excluded in the facet,
the document with both Tag 1 and Tag 2 is not posted to the Item List. The exclusion takes precedence.
This is because exclusions and inclusions in facets act as an AND property, not as an OR property.
The Facets Tab
The Facets tab in the Project Explorer in Project Review lists the available facets to apply to documents. You can
filter evidence to help view only relevant evidence for the Project. After you have applied facets, the results are
then displayed in the Item List. You can also use searches along with column sorting and filtering to help you
further review and cull down evidence.
The Facets tab in the Project Explorer allows you to filter before (and maintain after) conducting any searches.
This allows targeting specific areas of data for search and review with persistent facets. You may maintain the
applied facets as long as desired.
You can use one or more facets within a single filter or one or more facets across several categories to cull down
the evidence. By default, when you first open a project in Project Review, all filter facets are applied, and as a
result, all evidence is listed in the Item List. You use the facets to exclude evidence from the Item List.
Using Filters to Cull Data Filtering Data in Case Review | 132
Facets Panel
Only the top nine facets of a filter display when you expand a category. To see all the facets in a category, click
More... to display a facet dialog. Many categories also contains a search field that searches for facet hits within
that particular category.
The facets that appear in the Facets tab depends upon the product license that you have.
Using Filters to Cull Data Filtering Data in Case Review | 133
Available Facet Categories
The following table lists facets that may be available in the Facets tab of the Project Explorer.
Note: The Evidence Explorer and Custodian Facet counts are reduced when Family data uploaded by
Evidence Processing is updated by a CSV import. Existing documents that are updated by the CSV
import are removed from the Evidence Explorer and Custodian Facets.
Depending on your license, some filters may not be available.
General