Summary
The Intella 3.0 update introduces two powerful features to enhance flexibility during investigations:
Selective Re-Indexing – Re-index specific items instead of entire sources/cases. Available in Intella Pro, Intella Investigator, and Intella Connect.
Binary Replacement – Swap damaged/encrypted files with repaired/decrypted versions. Only available in Intella Pro.
1. Selective Re-Indexing (Available in Intella Pro, Investigator, and Connect)
What’s New?
Re-index individual items (e.g., after adjusting memory settings, adding passwords to the Key Store, or other external changes).
Previously, only full-source or full-case re-indexing was available.
Key Benefits:
✅ Faster & Less Intrusive – Avoid reprocessing unrelated data in ongoing cases.
✅ Preserves Metadata – Tags, flags, and comments remain intact.
Important Notes:
⚠️ Not Instant – Removing items from case indices and recalculating case-wide metrics may take time.
⚠️ Lighter Than Full Re-Indexing – Still more efficient than reprocessing entire sources.
How to Use (in Intella Pro):
Navigate to the item(s) you want to re-index.
Right-click and select: "Process" > "Re-index Selected Items".
Monitor progress in the task queue. After finishing, Intella will automatically relaunch your session.
How to Use (in Intella Investigator and Connect):
Within the case, create a new tag. Tag all items you wish to reindex.
From the case list, navigate to the Sources tab of the relevant case.
From the "Indexing" drop-down menu, click "Re-index selected items".
4. Select the tag that contains items that should be deleted and be re-indexed.
5. Click "Re-index".
2. Binary Replacement (Only available in Intella Professional)
What’s New?
Replace an item’s binary (e.g., damaged files, encrypted files) with an externally repaired/decrypted version.
The replacement file is treated as evidence, retaining the original item’s virtual location.
Use Cases:
🔧 Repair Damaged Files – Swap corrupted binaries with clean copies.
🔓 Decrypt Files Externally – Replace encrypted files with decrypted versions for analysis.
How to Use:
Right-click the target item and select: "Process" > "Replace Item Content".
Browse to the replacement file and confirm.
The system validates the file and updates the case. After finishing, Intella will automatically relaunch your session.
Limitations:
Currently, this feature is only available in the Desktop version.
This feature works on a single item only. The option will be greyed out if multiple items are selected:
FAQ
Q: Will re-indexing affect my existing annotations?
A: No. Tags, flags, comments, and other user-created content are preserved.
Q: Can I undo a binary replacement?
A: No. Replacement is permanent. If needed, revert to a backup of the case.