It is advisable to follow a repeatable set of procedures to ensure quality control and repeatable results. Exactly what procedures will vary from case to case and even from organization to organization. We have created a short checklist of procedures that you should look to follow. It is by no means an exhaustive list, but it is designed to assist your organization to develop their own checklist.
Before you begin:
Quality Control - Create your own check list of tasks to ensure consistent and reputable results. The checklist should ensure that no data or results are missed. The checklist should cover all processes from early planning to final archiving.
Appropriate System setup - When scoping a processing system, you should ensure that your system meets the minimum hardware specs for the version of Intella/Connect which you are using, and the data which is to be processed. The recommended hardware/software specs are shown in this post. https://support.vound-software.com/help/en-us/8-installation/66-selecting-a-computer-to-host-your-vound-software
Appropriate System setup - Check you have enough disk space on the system. This includes the Case drive, Evidence drive, and Optimization drive. Note that compressed items with be expanded during the indexing process. You will need to allow for more free space, over and above the size of the evidence to be indexed.
Appropriate System setup - There are a several memory settings that can be configured in Intella and Connect. Depending on the data which is being indexed, you may need to set your product to use more memory and crawlers for the indexing phase. We have created a forum post which explains the memory settings for Intella and Connect at the link below. This should be reviewed, and the memory setting should be configured to work with the type of data which is being indexed, and the type of hardware your system has. https://support.vound-software.com/help/en-us/8-installation/71-optimizing-intella-memory-settings-for-best-performance
Appropriate System setup - The Case, Evidence, and Optimization drives should be local drives within your processing system. Indexing from/to USB attached drives, or network locations is not recommended or supported. Any brief dropouts or I/O issues when indexing from/to USB or network drives can cause data to not index properly, or your case can become corrupt.
Version and Case Control - Check for new versions of Intella/Connect before starting case. The 'Check for updates' feature in Intella's preferences would alert the user that a new update is available. If you have this feature turned off, you should check for updates on our website before proceeding with creating a case and indexing data. Note that Intella updates that involve the first two digits of the version number (e.g. the 2 or the 6 in this release 2.6.1), requires the dongle to be updated as well. If the customer has 100 days (or more) left on their MA at the date of release, they can use the 'Check for updates' feature in Dongle Manager to update their dongle.
- Note that some Antivirus and security applications can cause the dongle licensing service to not work properly. We recommend that you white list the Intella and sentinel files in these security applications to minimize dongle and license issues.
- Evidence data can contain corrupt data which Intella may not be able to process completely. It is important to have a plan to identify, and mitigate corrupt data.
Through support we see a number of instances where the evidence data is corrupt or malformed, and it can't be indexed fully. Examples are PST files (often created by 3rd party tools) where the PST does not conform to the correct specifications. If you encounter this type of data corruption, contact our support team as they may be able to help.
Creating a case:
After you have created your case (and before you index any data), make sure you have considered encrypted items that may be in the dataset. Passwords, keys and certificates for encrypted items can be added to the Key-store before adding and indexing your source. Not considering encrypted items may lead to items not being decrypted during indexing, resulting in data/information being missed during the searching and analysis phases.
Adding data to a case and processing:
- Verify that your evidence data is a supported source. A list of supported source types is shown in our user manual. Check whether there are any documented limitations with the type of your evidence data in the user manual.
- Note that you can have issues with common file types. For example, we see a lot of issues with PST files where they have been created with 3rd party tools. In most cases the 3rd party tool has not created the PST file in line with the specifications.
- As noted above, we recommend that you copy the evidence data to a local drive within the processing system. Indexing data from USB attached drives, and network locations is not recommended.
Post processing tasks:
- One of the first tasks to complete after indexing, is to check the Exception report for any processing issues. An indexing Exceptions report can be produced by choosing Sources > Exceptions Report. This produces a spreadsheet that lists all items that had issues during indexing. This can range from minor issues such as date parsing problems to major issue like file corruptions which can affect the entire item and all nested items.
- You can also see these processing issues in the Features facet, under Exception items.
Version and Case Control - Check that the case version matches or is compatible with the version of Intella you are planning to use. Know that some cases will need case conversion if made with an older version of Intella.
Completeness of data - Check for items that do not contain text, and may need to be OCRed. Note that Empty documents (documents that have size, but do not contain text) will not be respondent to keyword search criteria unless they have been OCRed. Common empty document types are scanned PDFs. These types are shown in the Features facet, under Empty documents.
Other types such as image files (e.g. TIFF, JPG etc.) may also need to be OCRed. You should discuss with your client, and agree on which types are subject to OCR processing.
Data quality control - Encrypted items will not be respondent to keyword search criteria unless they can be decrypted by Intella using the specified credentials, or have been decrypted prior to indexing. You should check which items are still encrypted after the indexing process. A list of the encrypted items can be exported from the 'Work flow' section of the Insight tab. This list can be provided to the client, who should advise on which files should be decrypted with further processing (dedicated decryption program etc).
Data quality control - Check that the data and header information appears to be correct for the indexed data. As mentioned above, some evidence data can be corrupt and they may not index fully. Not checking that the indexing has completed properly could lead to data being missed.
Searching and analysis:
Report and result quality - It is important to have your work peer reviewed to ensure that the findings, and number of results are correct. Simple user mistakes such as not selecting a tag, or not turning off a Require or Exclude search during your searching and analysis, can invalidate the results that you get. A peer review to show how you got the results will add to the accuracy for those results.
Report and result quality - A peer review may also help identify whether evidence data is corrupt.
Exporting:
Report and result quality - Any exports should be verified for correctness before handing them over to the client. The items actually exported should be checked with the items in Intella which are tagged and ready for export, to confirm that the numbers match. The last lines of the export report should also be reviewed to see whether there were any errors during the export process. The errors will be shown in the Errors column. In this example the last two items could not be exported.
Report and result quality - The format for the items being exported should be agreed with your client prior to exporting. This is more so with complex formats such as load files. We provide load file check lists in the user manual to help with this process. You must be in full agreement with the client (e.g. client sign off) as to all of the settings and requirements for the load file before running the production. We highly recommend producing a small test load file with a mixture of the different file types that will be produced. The client can load this into their system to ensure that everything is correct.
Backup:
Continuity Availability and Integrity - We advise running frequent backups for your cases. It only takes a drive to fail, or a case to become corrupt and you lose all of your previous work. A corrupt or inaccessible case can be frustrating. But without a backup, it is difficult or in some cases impossible to get the work which has been done back.
We recommend creating a backup right after any indexing process has completed, and before starting the review/investigation. In the event that the case becomes corrupt during review, then the annotations (e.g. tags, flags, comments etc.) from the corrupt case can be imported into this backed up case. More information is in the Restoring Annotations section in user manual.
Continuity Availability and Integrity - Along with backups, it is just as important to periodically test the restore process for the backup. The last thing you want to discover is that the backup was not actually working properly.
Continuity Availability and Integrity - If archiving old cases, consider archiving a copy of the Intella Installer that created the case along with the data. This will help to speed up opening of that case in the future.
Continuity Availability and Integrity - Ensure you have through notes on case specifics in the archive. This will assist you in the future. What data, what version, any issues or errors that may have occurred.
Connect specific tasks:
Managing Security - Check that the Connect server has been configured and secured properly. This includes changing the default Admin password, and configuring SSL. The Connect admin manual has details on these and other security tasks that you should implement.
Managing Security - Set up the correct permissions for the required roles before allowing users to access a case.
Continuity Availability and Integrity - Backup up the server configuration when migrating between versions (e.g. user, coding layouts, system preferences, authentication rules). The Connect admin manual actually has a section on the steps for updating to the latest version.
Updates August 2023