TABLE OF CONTENTS


Cases

Case information is stored in a database, and allows case administration as each new case is created. During case creation information must be provided for primary details, custodian mapping, load file imports 

Elements of Cases

Creating Cases

 

Creating Cases

To create a case:

  1. From the home page, click Case List.
  2. Click Create New Case.
     

Primary Details

 

 

 


To add the primary details:

  1. Configure the primary details of a case as explained below.


Options

Description

Copy from a previous case

Allows you to use previously created case’s details. Options available to copy range from, but are not limited to, copying custodians, custom fields, coding panels and labels.

Case Name

Provide a name for the case. The case names must be only alphanumeric characters. Special characters will cause the case creation to fail.

Case Description

Provide a description for the case.

Case Folder Path

Allows you to specify a local path or a UNC network path to the case folder.

This path is the location where all case data is stored.

Job Data Path

This sets the responsive folder path for data from jobs. Under this path, a folder is created for each job. The job sub-folders contain job reports and ad1 files for collected files.

Time Zone

This sets the time zone displayed within the case.

Default Filters

This sets default quick filters to a case. Filters available range from, Hide Duplicates, Ediscovery Refinement, Hide Containers and Hide Bookmarks. 

 

This option is dependent on the product type value set in the ADG.weblabselfhost.exe.config file

If set as ediscovery, these default filters will be selected by default during case creation.  If set as forensics, these default filters will not be selected by default during case creation.


Custom Case Properties

This option will allow users to select custom properties that have been defined by an administrator. Refer to the Creating Custom Case Properties section.


Options

Allows you to pick which optional processes to add to the case creation. The processes are:

  • Custodian Mapping – To configure the custodians of the evidence in this case. You can associate existing custodians or add new custodians. Custodians for the case can be configured later, but should be done before processing evidence. 
  • Load Files – To configure any load files that you would like to import into a case.
  • Process Evidence – To add evidence items and set the options for how the evidence is processed when added to the case.
  • User Assignment – To add specific users/user groups to a created case.

Note: Click Submit if none of the (optional) options are required.






Note:  The location for Case Folder Path and Job Data Path will be automatically populated based on the case defaults configured. However, you can change the path if required. To do so

  1. Click Folder  against the Results Path field.
  2. The below page appears.


    iii. Enter the Server Path.     iv. Click Go to view the directories available on the serve     v. Select the folder to be where the results are to be saved.

             vi. Click Select.




    2. Click Save and Next. 

 

Custodian Mapping

To map a custodian:

  1. Select the custodians to be added to the case. 
    • The selected custodians are displayed on the Custodians Mapped pane.


       2. Click Save and Next.



Note: You can also click Add Custodian to create a new custodian from this page and add to the case.



 

 

Load Files

You import evidence by using a load file, which allows you to import metadata and physical files, such as native, image, and/or text files that were obtained from another source, such as a scanning program or another processing program. 


You can import the following types of load files:

  • Summation DII - A proprietary file type from Summation.
  • Generic - A delimited file type, such as a CSV file.
  • Concordance/Relativity - A delimited DAT file type that has established guidelines as to what delimiter should be used in the fields. This file should have a corresponding LFP or OPT image file to import.

When importing, you must specify which import file fields should be mapped to database fields. Mapping the fields will put the correct information about the document in the correct columns in the case.

After clicking Map Fields, a process runs that checks the imported load file against existing case fields. Most of the import file fields will automatically be mapped for you. Any fields that could not be automatically mapped are flagged as needing to be mapped. Users can create Custom Fields if required.

Optionally, users can utilize the Run Validation option. This will verify:

The path information within the load file is correct.

  • The records contain the correct fields. For example, the system verifies that the delimiters and fields in a Generic or Concordance/Relativity file are correct.
  • All physical files are present (Native, Image and Text) which are listed in the load file.

 

Importing Generic load files

To import generic load file:



  1. Select Generic as the File Type.
  2. Enter the File Path or click Find to select the path.
  3. Click Map Fields to configure the required values for Field Mapping.
  4. Choose a similar field (e.g. mapping a text field to a text field, a date field to a date field, etc.) to use for mapping.
  5. Choose SKIP THIS FIELD to ignore the field.
  6. If neither of the previous options works, talk to the case manager or application administrator about creating a custom field to be used for mapping.
  7. Select Skip Unmapped to mark all unmapped fields with SKIP THIS FIELD.



Note: Alternatively, you can use an existing Field Mapping Template.


        8. Select the correct delimiters by clicking Filter as explained below.


Fields

Description

First Row Contains Field Names

Enable this to consider the first row as Column headers.

Field Separator

Select a character that is used as a delimiter. i.e., the character to be placed between the columns.

Quote Separator

Select a character that is placed on either side of the value within each of the columns.

Multi-Entry Separator

Select a character that is used to separate multi-entries in the column.

Return Placeholder

Select a character to mark the end of a line in a load file.


  1. Click Import Options to set specific options.
  2. Select Enable Fast Imports to exclude database indexes while importing.
  3. Select the Record Handling Options as explained below.

 


Fields

Options

Description

New Record

Add

To add the new records present in the load file to the case.

Skip

To skip adding the new records present in the load file to the case

Existing Record

Update

To update duplicate records with the record being imported.

Overwrite

To overwrite any duplicate records with the record being imported.

Skip

To skip adding the existing records in load file to the case

 



Note: All dates are stored in the database in a yyy-mm-dd hh:mm:ss format.


4. Select the Date Format as needed. This format appears in the load file system, allowing the system to properly parse the date to store in the database.

5. Select the Load File Timezone to choose the time zone that the load file was created. The values can be converted to a normalized UTC value in the database.

6. Click Run Validation to verify the import and then click Finish.



 

Importing QuinC/Summation DII load file

To import QuinC/Summation DII load file:

  1. Select QuinC EDII as the File Type.
  2. Enter the File Path or click Find to select the path.
  3. Click Map Fields to configure the required values for Field Mapping.
  1. Choose a similar field (e.g. mapping a text field to a text field, a date field to a date field, etc.) to use for mapping.
  2. Choose SKIP THIS FIELD to ignore the field.
  3. If neither of the previous options works, talk to the case manager or application administrator about creating a custom field to be used for mapping.
  4. Select Skip Unmapped to mark all unmapped fields with SKIP THIS FIELD.

    4.  Click Import Options to set specific options as explained below.

 


Note: Alternatively, you can use an existing Field Mapping Template.




Fields

Description

Enable Fast Imports

This will exclude database indexes while importing.


Page count follows DocID

Enable this if your DII file has an @T value that contains both a Doc ID and a page count.


Import OCR/Fulltext

Select to import OCR or Full Text documents for each record.


Import Native Documents

Enable this option to import native files for each record.


Process files to extract metadata

Enable this to import only the metadata that exists on the load file and not process native files as you import them with a load file.

Import Images

Enable this to load images.

 

   

    5. Select the Record Handling Options as explained below.



Fields

Options

Description

New Record

Add

To add the new records present in the load file to the case.

Skip

To skip adding the new records present in the load file to the case

Existing Record

Update

To update duplicate records with the record being imported.

Overwrite

To overwrite any duplicate records with the record being imported.

Skip

To skip adding the existing records in load file to the case

 

6. Select the Date Format as needed. This format appears in the load file system, allowing the system to properly parse the date to store in the database.



Note: All dates are stored in the database in a yy-mm-dd hh:mm:ss format.



7.  Select the Load File Timezone to choose the time zone that the load file was created. The values can be converted to a normalized UTC value in the database.


8. Click Run Validation to verify the import and then click Finish.


 

 

Importing Concordance/Relativity load file

To import concordance/relativity load file:

  1. Select Concordance/Relativity as the File Type.
  2. Enter the File Path or click Find to select the path.
  3. Enter the Image Path or click Find to select the path. This may be an LFP or OPT file type.
    • OPT - Concordance file type that contains preferences and option settings associated with the files.
    • LFP – IPRO file type that contains load images and related information.
  4. Click Map Fields to configure the required values for Field Mapping.
  5. Choose a similar field (e.g. mapping a text field to a text field, a date field to a date field, etc.) to use for mapping.
  6. Choose SKIP THIS FIELD to ignore the field.
  7. If neither of the previous options works, talk to the case manager or application administrator about creating a custom field to be used for mapping.
  8. Select Skip Unmapped to mark all unmapped fields with SKIP THIS FIELD.


Note: Alternatively, you can use an existing Field Mapping Template.


        9. Select the correct delimiters by clicking Filter as explained below.


Fields

Description

First Row Contains Field Names

Enable this to consider the first row as Column headers.

Field Separator

Select a character that is used as a delimiter. i.e., the character to be placed between the columns.

Quote Separator

Select a character that is placed on either side of the value within each of the columns.

Multi-Entry Separator

Select a character that is used to separate multi-entries in the column.

Return Placeholder

Select a character to mark the end of a line in a load file.



    10. Click Import Options to set specific options as explained below.


Fields

Description

Enable Fast Imports

This will exclude database indexes while importing.

Import OCR/Fulltext

Select to import OCR or Full Text documents for each record.

Import Native Documents

Enable this option to import native files for each record.

Process files to extract metadata

Enable this to import only the metadata that exists on the load file and not process native files as you import them with a load file.

Import Images

Enable this to load images.

 


    11. Select the Record Handling Options as explained below.


Fields

Options

Description

New Record

Add

To add the new records present in the load file to the case.

Skip

To skip adding the new records present in the load file to the case

Existing Record

Update

To update duplicate records with the record being imported.

Overwrite

To overwrite any duplicate records with the record being imported.

Skip

To skip adding the existing records in load file to the case

 

12. Select the Date Format as needed. This format appears in the load file system, allowing the system to properly parse the date to store in the database.


Note: All dates are stored in the database in a yyy-mm-dd hh:mm:ss format. 


13. Select the Load File Timezone to choose the time zone that the load file was created. The values can be converted to a normalized UTC value in the database.

14. Click Run Validation to verify the import and then click Finish.


 

 

To save a Field Mapping template:

  1. When you have selected the relevant field mapping options for a specific load file type, enter a template name in the templates section.
  2. Click Save Template.
    1. Saved templates can be loaded by selecting it within the Templates drop-down list. 

 

Process Evidence

During case creation you can use the Process Evidence section to specify the data that you want to add. You specify to add either parent folders or individual files.


 
 

For example, you could have a parent folder with a set of subfolders.

  • \\10.10.3.39\EvidenceSource\
    1. \\10.10.3.39\EvidenceSource\John Smith
    2. \\10.10.3.39\EvidenceSource\Bobby Jones
    3. \\10.10.3.39\EvidenceSource\Samuel Johnson
    4. \\10.10.3.39\EvidenceSource\Edward Peterson
    5. \\10.10.3.39\EvidenceSource\Jeremy Lane


You could import the parent \\10.10.3.39\EvidenceSource\ as one evidence item. If you associated a custodian to it, all files under the parent would have the same custodian.

Additionally, you could have each subfolder to be its own evidence item, and then you could associate a unique custodian to each item. An evidence item can either be a folder or a single file. If the item is a folder, it can have other subfolders, but they would be included in the item. This can be done by selecting Import subfolder as unique evidence items and Subfolder names are custodians.

The following table lists the default Evidence Properties available during ingestion.


Options

Description

Evidence Name

Name of the evidence. This can be a custom name.

Evidence Path

The full pathname of the evidence file.

Use universal naming convention (UNC) syntax in your evidence path for best

results.

Evidence Number

Any numbering associated to evidence. This is optional.

Evidence Date

Any dates associated to the evidence. This is optional.

Custodian

Custodian (People) can be added and associated to specific evidence if required. This is optional.

Time Zone

Local machines must be set to the same time and date settings as the case evidence to correctly display all dates and times.

Media Type

The media type will be automatically identified by FTK Central, however in rare occurrences you may need to select an option yourself. 

Evidence Source

Source of the evidence being ingested. Computer, Mobile, CCTV or Body Cam. This is optional.

Suspect Name

Names of suspect relating to the evidence being ingested. This is optional.

Make and Model

Any specific make and model relating to the evidence being ingested. This is optional.

Place of Acquisition

Any specific location relating to the evidence being ingested. This is optional.

Notes

Any other notes relating to the evidence being ingested. This is optional.

Images

Any images/graphics relating to the evidence being ingested.

 


 

 

To add an evidence item to a case:

  1. Upon checking the Process Evidence option, you will be navigated to a new section.
  2. Click Add Evidence.
  3. Enter Evidence Path. Ensure this is a UNC path.
  4. Click the Explore button to browse to the specified path and select the evidence. If it is a single file or folder, ensure it is selected in the item grid.
  5. Click Select.
  6. Select the Time Zone. Click Apply To All if required.
  7. Click Save.



Note: Additionally, by clicking on Copy Down, the fields in the first row of the evidence grid will be copied to all other rows. Do not click this if the evidence being ingested do not share the same field data.



 

 

To add an evidence item to a case using the CSV Template:

  1. Upon checking the Process Evidence option, you will be navigated to a new section.
  2. Click Add Evidence > Import from CSV file.
  3. Click Select files to import.
  4. If required, check First row contains headers/1 or more custom columns.
  5. Click Add Evidence.


Note: CSV imports can use the following columns: Custodian, Evidence Path, Timezone, Evidence Source, Suspect Name, Evidence Number, Evidence Name, Evidence Date, Make and Model, Place of Acquisition, Notes, Images. However, only the evidence path is required. Other columns can be left empty.





Tip: Evidence files can be deleted and edited from the Evidence List by clicking on the Context  button. 

If the case had evidence added and processed previously, it will be listed here. By accessing the context menu, previous procession options can be displayed.



To select specific Processing Managers and Processing Profiles:

  1. Upon checking the Process Evidence option, you will be navigated to a new section.
  2. The bottom of the page will display the currently selected processing manager and processing profile being used.
  3. If available, click the drop-down list on either to toggle these options. 
Tip: By clicking on the Customize Options button, the currently selected processing profile can be edited efficiently.


 

To Manage Custom Evidence Properties:

Evidence properties relate to the fields that appear for each evidence item being ingested. These fields can be customized for specific requirements. 

  1. Upon checking the Process Evidence option, you will be navigated to a new section.
  2. Click Custom Evidence Properties.
  3. Click Add Property.
  4. Enter a Name and Description.
  5. Check the Required box to ensure this field is filled in during ingesting of evidence. If a value is not selected for a pick list, a choice will be selected automatically. 
  6. Select the Type
    • Date 
    • Pick List – Items should be listed one per line.
    • Text


To Manage Custom Evidence Properties:

  1. Upon checking the Process Evidence option, and ingesting evidence; the evidence will be listed in the Evidence List.
  2. Click the Context menu .
    • The Evidence Options pop-up is displayed.
  3. Click Edit Evidence.
  4. Make any necessary changes to the evidence properties.
  5. Click Update.

 

To set predefined Processing Options:

  1. Once evidence has been added to a case, you have the ability to set predefined processing options.
  2. Click the drop-down list located in the Profile Setting pane.
  3. Select a Processing Option from the available (table below).
  4. Click Process Evidence.


Options

Description

Forensic Processing

  • MD5 Hash
  • SHA-1 Hash
  • SHA-256 Hash
  • Expand common compound files
  • File Signature Analysis
  • Flag Bad Extensions
  • Search Test Index
  • Create Thumbnails for Graphics
  • Include Deleted Files
  • Include File Slack
  • Include Free Space
  • Create Email Threads

Field Mode

  • Include Deleted Files
  • Include Free Space
  • Only add items that match both File Status AND file Types criteria

Summation Processing

  • MD5 Hash
  • Flag Duplicate Files
  • Expand Compound Files
  • Flag Bad Extensions
  • File Signature Analysis
  • Search Text Index
  • Create Thumbnails for Graphics
  • Create Thumbnails for Videos
  • Generate Common Video File
  • Document Content Analysis
  • Enable Advanced De-duplication Analysis
  • Propagate email attributes
  • Create Email Threads
  • Cluster Analysis
  • Include extended information in the index
  • Don’t Expand Embedded Graphics
  • eDiscovery Refinement

eDiscovery Processing

  • MD5 Hash
  • Flag Duplicate Files
  • Expand Compound Files
  • Flag Bad Extensions
  • File Signature Analysis
  • Search Text Index
  • Create Thumbnails for Graphics
  • Document Content Analysis
  • Enable Advanced De-duplication Analysis
  • Propagate email attributes
  • Create Email Threads
  • Cluster Analysis
  • Include extended information in the index
  • Don’t Expand Embedded Graphics
  • eDiscovery Refinement

Basic Assessment

  • Expand Compound Files
  • Include Deleted Files
  • Include File Slack
  • Include Free Space
  • Only add items that match both File Status AND file Types criteria

Image Processing

  • MD5 Hash
  • SHA-1 Hash
  • Expand Compound Files
  • File Signature Analysis
  • Search Text Index
  • Create Thumbnails for Graphics
  • Create Thumbnails for Videos
  • Generate Common Video File
  • Explicit Image Detection
  • Include Deleted Files
  • Create Email Threads
  • Include extended information in the index
  • Include File Slack
  • Include Free Space
  • Only add items that match both File Status AND file Types criteria

Video Processing

  • MD5 Hash
  • SHA-1 Hash
  • Expand Compound Files
  • File Signature Analysis
  • Flag Bad Extensions
  • Search Text Index
  • Create Thumbnails for Videos
  • Generate Common Video File
  • Explicit Image Detection
  • Include Deleted Files
  • Create Email Threads
  • Include File Slack
  • Include Free Space
  • Only add items that match both File Status AND file Types criteria

All Communication

  • MD5 Hash
  • SHA-1 Hash
  • Expand Compound Files – All Communication
  • File Signature Analysis
  • Flag Bad Extensions
  • Search Text Index
  • Include Deleted Files
  • Create Email Threads
  • Include extended information in the index
  • Include File Slack
  • Include Free Space
  • Only add items that match both File Status AND file Types criteria

 

To select additional Processing Options & saving a new profile:

While you are able to select predefined processing profiles, you can select additional options and add them to an existing profile while saving it as a new profile.

  1. Click Customize Options.
  2. Select the additional processing options.
  3. Click Save User Profile.
  4. Enter a Name.
  5. Enter a Description.
  6. Click Save.


 

Copy from a previous case

To copy from a previous case:

  1. From the home page, click Case List.
  2. Click Create New Case.
Note:  There must be a case created prior to attempting this function.


     3. Click the Copy from a previous case drop-down list and select the required case.


     4. Select the required field values that needs to be copied over to the new case. 

  • All    
  • Custodians
  • Custom Fields    
  • Coding Panels
  • Labels    
  • Bookmarks
  • Issues    
  • User Groups
  • Users    


5. Enter a Case Name.


6. Configure the primary details for the Case Description, Case Folder Path and Job Data Path.


7. Select additional options such as Custodians Mapping, Load Files and Process Evidences.


8. Click Save and Next.


9. Add any additional Custodians. (Refer to the Custodian Mapping section for more details) 

10. Click Save and Next.

11. Add any additional Load Files. (Refer to the Load Files section for more details) 

12. Click Next.

13. Add Evidence and select a Processing Option. (Refer to the Process Evidence section for more details) 

14. Click Process Data.
 



User Assignment

During case creation, users/user groups can be assigned to a case. If a user is not assigned to a case, they will not be able to see it within the case list. 


To assign users:

  1. Upon checking the User Assignment option, you will be navigated to a new section.
  2. Check any uses/user groups.
  3. Click Submit.
Note:  To remove users/user groups from a case, you must use the User Management option in the administration panel.  (Refer to the User Management section for more details)