When performing complex searches in Intella, standard keyword search may not always be sufficient to find exactly what you're looking for. This is where Regular Expressions (RegEx) come into play. Regular expressions are powerful tools that enable you to search for patterns or specific formats within your data, such as credit card numbers, email addresses, symbols, or any other structured information. RegEx provides the precision needed for more detailed and targeted searches, making it an essential feature for forensic investigators and eDiscovery professionals working with large data sets.
To learn more about Regular Expressions in a detailed walkthrough you can watch our video here: https://vound.info/regex-searching
Using Regular Expressions in Intella
Regular Expressions (RegEx) in Intella are powerful tools for enhancing search capabilities by allowing users to define specific patterns in text. Here's a quick guide on how to use them:
1. Accessing RegEx Search:
● Navigate to the Facet Search section of Intella
● Click on the “Content Analysis” facet to reveal the default categories
● Click on “Content Analysis” facet to reveal the default categories
● Select the "new" button to bring up the “New Content Analysis Category”
Enter a category name.
If you need assistance building your regular expression click on the "Regular Expression Assistant" button.
This opens up the wizard where you'll see two tabs, Cheatsheet and library. In the library tab we have a list of predefined regular expressions that work with bank account numbers, shipment tracking numbers, and emails to name a few. We have selected emails which has populated the regex within the field above. Below you can see that our test text has been highlighted.
Under the Cheatsheet tab you have a list of special characters and operators that make up your regular expression. You can visit the link below to learn more about the regular expression syntax.
Once your regular expression has been set, click OK.
You will be taken back to the initial screen where you will see your regular expression populated within the field. Click OK.
Running a Search:
● We're going to run our regex over emails by selecting the Type Facet - expanding Communication - clicking Email - Search
● Click on the cluster to reveal your items in the details pane
● Select the items you want to analyze then, right click - Process - Content Analysis
● The Content Analysis box will populate with predefined categories.
● Check to enable one or more categories of your choosing.
● We will select the Email category which we have just created, click the "Run" button.
Reviewing and Refining:
● After your search has completed you can review the results in the “Content Analysis” facet. Ensure the RegEx is capturing the intended data, you may need to make adjustments to your regex if results aren't as expected.
● Click on the cluster to display your results in the details pane. Double click an item to view in the previewer.
● Within the contents tab you will see all hits relating to your regular expression highlighted in yellow.
● You will now see an additional tab within the previewer called Analysis. Clicking on the Analysis tab will allow you to view only the contents of your regex.
● By highlighting one of our email hits and clicking the search button at the bottom we can view additional items within our regex search that contain that same email address.
● As you can see we have a total of 3 items within our regex that contain the mrblond777 email address.
● Here we have displayed all 3 items that contain our email address. This provides another effective way to drill down into your data and quickly locate the results most relevant to your search criteria.
By mastering RegEx in Intella, you can significantly streamline your data search and analysis, making it easier to pinpoint specific information within large datasets.