Description:

The Person of Interest is a feature designed to show connections between Phone evidence and Email evidence. The solution will scrape your email signatures looking for phone, email and website information and allow you to place that information into a list. Pulling of the phone number will allow you to link emails to phone call history, SMS, MMS or chat communications for example.

Setup:

During case creation you will see a new option that allows you to turn on email scraping, see below:

Opening up the "Persons Of Interest Options... " will reveal the Scrape email signatures is checked by default.

The "Person of Interest... " button will allow you to set up person of interest information prior to processing.

Usage:

After you selected the option and processed evidence with email data and phone data from the same person. To enter the person of interest dialogue at the top of the screen click the new button that looks like 2 people talking:

This screen should be blank the first time you open it, unless you manually added a person in case creation.

Click the plus sign  . That will open the Add/Edit Person dialogue as shown below.

 

  1. In the top right hand corner search for a name in your data.
  2. Scroll through the scraped email addresses and choose one by clicking on it. This will show data in the window in 3.
  3. Check the import check boxes to the left of the data.
  4. Click Import (note Steps 2-4) can be repeated, this will result in more emails and numbers in 6.
  5. Check that the name was extracted in a way. This name is used for the investigators reference and is not used in the filters.
  6. In this dialogue you can add new information and edit entries. We strongly encourage a reviewing your data and confirm the number formatting.

After you have created your Communication Participants

Check the participants you want to review communications from and click "Create Filter... "

At this point, you are presented with an option to choose what communications you are interested in (note if you selected two contacts that have only emails, you will only see email in this list).

Click OK

This means we have created a filter successfully and you can click yes to apply that filter.

The filter will be named with the communication participants name(s).