Do I have to re-index the whole case when I want to add a new source?
No, in order to add a new source to a case you do not need to re-index the whole case.
Adding a single source:
When you add a single source, you can index it immediately by selecting the 'Yes, I want to index this source now (recommended)' option, on the last page of the 'Add new source' wizard. Intella will index only the new source when you click on the Finish button.
Adding several sources:
You can also add a number of sources, then index only those new sources. To do this, add the first source, but don't select the 'Yes, I want to index this source now' option, just click on the Finish button. repeat the process for all of the sources that you want to add.
Once done, go to Sources in the file menu and select the 'Index new data' option. The indexing process will start and only the new sources will be indexed.
Can I re-index a single source in my case?
No, you can only re-index the entire case which includes all sources. This is not an issue if the case has only a single source. But, it can take some time to re-index a case that has multiple sources.
When the information in one of the sources has changed and re-indexing the entire case is undesirable (e.g. because of the time needed), you can work around this by removing the source, then adding the source back into the case.
Important note: All tags, flags, comments and other annotations for this source will be lost when it is removed. You will need to transfer these annotations manually (e.g. using MD5 and message hash lists. Make these lists before removing the source). When there is a substantial amount of annotations, you may want to consider re-indexing the entire case, as this is a fully automatic operation.
Will I lose my tags and comments after re-indexing the case?
No, all your existing tags and comments will remain in the case after re-indexing.
Will the item IDs be the same after re-indexing?
From version 2.1 the Item IDs will stay the same after re-indexing takes place. This was an added feature in this version.
With earlier versions, it is likely that the Item IDs will NOT be the same. We use multiple extractor pipelines which will likely cause evidence items to get different IDs during re-indexing.
Note: Item IDs are NOT used for storing annotations (tags, comments, etc.). This means that the annotations will not suffer from changes to the IDs.