While using FTK Central, you are able to use the review portal. This portal allows you to filter and search data while being able to label and book mark any data of interest to then create summary reports. 

Elements of Reviewing Cases

Filters let you leverage item attributes to locate specific data very quickly. They reduce the amount of time that you must examine data because they can narrow a large data set down to a very specific focus. You can also use filters to exclude data that you do not want displayed. For example, if you only want to see encrypted items, you can apply a filter to show you those. If you do not want to see files that were created after a certain date, you can also use a filter to exclude those files from being displayed.

The following are the different types of filters that can be used to filter files in the Review page:

You can make use of the exclusion filter by enabling the Explorer toggle.

When the Explorer toggle is enabled:

When the Explorer toggle is disabled:

Quick Filter provides you with the predefined set of filter types to aid you during review.

You can access the filters by expanding the Quick Filter section from the Explorer pane. 

The filter section provides you with all the common filtering options related to the files present in a case.

This section provides you with the list of filters grouped up based on the corresponding file types.

This section lists all the evidence present in a case. You can select the required evidence to view only the files associated with it. 

While in the process of reviewing records using the Files List, there may be times where you may want to filter the contents of a specific column. An example would be filtering the column for extensions. You can click the Filter icon located on each column to then create a filter of your own.

Upon clicking the Filter icon, you will be prompted with a filter creation window. It is simple to use and only requires a custom value to be filtered. The following are the two types of filtering used in columns:

Filter by condition:

The following table lists the possible operators that can be found in the filter options. The operators available depend upon what property is selected. 

Filter by values:

This column filter type will display all the values present in the corresponding column from which you can select and filter the required values.

To apply a column filter:

1. In the Grid navigate to the Grid.
2. Click the Context menu   button against the required column header. 
3. Click the Filter  button.
   • Filter by Condition – allows users to filter using an applicable condition type such as the date.
   • Filter by Values – allows users to filter using the values present in the column such as an object name or extension.

Note:  You can also search for records with blank values by selecting the ‘Blank’ value from the column filter.

You can use searching to help you find files of interest that are relevant to your case. After you perform a search, you can save your search or share your search with groups. Then, you can filter your result set to further cull down evidence. As you find relevant files, you can tag the files with Labels, Issues, or Categories for further review or for export.

When you search data, you use search phrases to find relevant evidence. A search phrase is any item that you would receive a search hit on, such as a word, a number, or a grouping of words or numbers. 

You can search for text that is either in the metadata of the file or in the body of a file. You can also select a column in the Grid and filter on that specific column.

When you start a search, be mindful of the items in the list that you are starting with. For example, if you have applied a facet filter to show only DOC files, and you search for a text string that you think is in a PDF file, it will not find it. However, the same is not true for column filters. If you have applied a column filter to show only DOC files and you search for a text string that you think is in a PDF file, it will locate the file, regardless of the previous column filter application.

The Index Search Bar is where you can conduct a query of the Text Index. Index Search allows for fast searching based on keywords. Your evidence must be indexed in order to perform index searches. Indexing can be done either when evidence is added to your case or later. While indexing takes longer when you add evidence items, it is well worth it if you later need to do a search. This search is very quick and produces case specific results rapidly.

To perform the basic search, provide the required search term in the search bar and click on the below or press Enter. 

Note:  After performing a search, you can click on  against the required search term to remove it or click the Clear   button to remove all the search terms

While performing search you can click the Relationships  button and select any of the following options based on which the results should be displayed.

• Duplicates - To display the duplicate files. 
• Family – To display the family files.
• Near Duplicates -To display the files that are almost similar to the original file.

FTK Central Advanced Search allows you to perform a detailed search and obtain relevant results using the multiple filters and search options available in this feature.

To perform an advanced search:

1. In the Grid, click the Advanced Search   button against the search tab.
2. The Advanced Search prompt is displayed.

Note:  After performing a search, you can click on  against the required search term to remove it or click on Clear  to remove all the search terms.

To perform a Search using Metadata, Fields, and Sort:

Metadata:

1. Select the opening parentheses (if required) from the first drop-down.
2. Select the Field name from the drop-down.
3. Select the field operator.
4. Enter the field value.
5. Select the closing parentheses (if required).
6. Select an Boolean Operator if required.
7. Click on the below Apply  button to add an additional field search if required.

Field:

9. Select the columns to be filtered from the right-side section.

• The selected columns will be displayed in the Applied (left-side) section.

10. Drag and drop the required columns in the Applied section to reorder it based on which the columns will be displayed after the search is performed. 

Sort:

    11. Click on the Sort tab.

 12. Click the on the Apply  button to add a column sort preference if required.

• The Sort by field is displayed.

13. Select the field name and the sort preference in the field against it

14. Click Search.

To expand search terms:

You can use expand search terms to add related words and phrases to a search. For example, when you are searching for “text”, the function will display:

Search Term Categories:

    1. In the Grid, click the Advanced Search  button against the search tab.

• The Advanced Search prompt is displayed.

2. Provide the Text Search term.

3. Click Expand Search Terms.

Warning:  The Expand Search Terms button will be displayed only upon providing the terms for Text Search field.

4. Select the required search term.

5. Check the required variation terms.

6. Enable the required search term category:

7. Include Related

8. Include Specific

9. Include General

10. Click Apply.

To save a search:

You can save any advanced search that you design in the Advanced Search Builder. All saved searches are stored in the Advanced Search Builder. You can use saved searches to run past searches again. 

1. In the Grid, click the Advanced Search  button against the search tab.
2. The Advanced Search prompt is displayed.
3. Configure the required search terms and filters. 
4. Click the Save Searchbutton.
   • The Save Search section is displayed.

5. Provide the Search Name.

6. Select the visibility based on the below description:

• Private – To be displayed and accessed only for the user who created it.
• Public – To be displayed and accessed by all the users.

7. Click the below icon to save the search term and perform the search operation.

8. Click the below icon to save the search term.

To load a search:

1. In the Grid, click the Advanced Search  button against the search tab.
   • The Advanced Search prompt is displayed.
2. Select the required saved search from the Load Search drop-down field. 
3. Click Search.

Labels let you group files in the way that makes the most sense to you. Initially, there are no default labels. All are customized. Labels you create are saved locally and you have complete control over them within your case.

To create a label:

1. In the Grid, click the Show Tags Panel   button.
   • The Tag Configuration pop-up is displayed.
2. Click the Settings  button.
3. Click + Create Labels.
4. Select the Labels tab.
5. Click + Add Label.

Tip:  Click the   on a label folder to create a label specifically in the folder. This button will appear when you hover over a label folder.

7. Enter a Label Name.
8. Click the Save   button.
9. Enter a Label Name.
10. Click the Save   button.

To edit a label:

1. In the Grid, click the Show Tags Panel  button.
   • The Tag Configuration pop-up is displayed.
2. Click +Create Labels.
3. Select Labels tab.
4. Click on the label name and edit it.
5. Click Update.

Warning:  Deleting labels will remove them from the document(s). This cannot be undone.

To delete a label:

1. In the Grid, click the Show Tags Panel  button.
   • The Tag Configuration pop-up is displayed.
2. Click +Create Labels.
3. Select Labels tab.
4. Click the Delete   button against the required label.

To apply a label:

1. In the Grid, select the records requiring labeling.
2. Check or highlight these records.
3. Click the Show Tags Panel  button.
4. Select the Labels tab.
5. Check the required label.

Tip:  Checking a label folder will apply all child labels as well as any child labels located in sub folders.

Any changes made will now be applied.

Note:  To remove a label, uncheck the selected label. To remove all child labels, uncheck the label group.
 

To create a label group:

1. In the Grid, click the Show Tags Panel  button.
2. The Tag Configuration pop-up is displayed.
3. Click + Create Labels.
4. Select Labels tab.
5. Click Add Folder. This will create a root folder.

Tip:  To create a sub group, click the   icon in line with the parent group.

6. Click Save.

1. In the Grid, click the Show Tags Panel  button.
2. The Tag Configuration pop-up is displayed.
3. Click + Create Labels.
4. Select Labels tab.
5. Click on the folder name and edit it.
6. Click Update.

See Filtering section.

To filter a label:

1. In the Grid, click on Common Filter from the Explorer pane.
2. Expand the Labels folder.
3. Select a label or label group(s).

The Grid will update to show only these labels.

A Bookmark is a group of files that you want to reference in your case. These are user-created and the list is stored for later reference, and for use in the report output. You can create as many bookmarks as needed in a case. Bookmarks can be nested within other bookmarks for convenience and categorization purposes.

Bookmarks help organize the case evidence by grouping related or similar files. For example, you can create a bookmark of graphics that contain similar or related graphic images. The Tags tab lists all bookmarks that have been created in the current case. Bookmarks only apply to the case they are created in.

1. In the Grid, click the Show Tags Panel  button.
   • The Tag Configuration pop-up is displayed.
2. Select the Bookmarks tab.
3. Click + Create Bookmarks.
4. Enter the bookmark Name and Comment.
5. Click Save .

The bookmark will now be created.

To edit a bookmark:

1. In the Grid, click the Show Tags Panel  button.
   • The Tag Configuration pop-up is displayed.
2. Click the Bookmarks tab.
3. Click + Create Bookmarks.
4. Click on the required bookmark and make changes to the Name and Comment.
5. Click Update.

Any changes made will now be applied.

To delete a bookmark:

1. In the Grid, click the Show Tags Panel  button.
2. The Tag Configuration pop-up is displayed.
3. Click the Bookmarks tab.
4. Click + Create Bookmarks.
5. Click the Delete  button against the bookmark to be deleted.
6. Click Yes in the confirmation pop-up.

To apply a bookmark:

1. In the Grid, select the records requiring bookmarking.
2. Click the Show Tags Panel   button.
3. Select Bookmarks.
4. Check the required bookmark.
5. Any changes made will now be applied.

Note:  To remove a bookmark, uncheck the selected bookmark.

Refer Performing Actions from the Grid section.

Refer Filtering section.

To filter a bookmark:

1. In the Grid, click on Common Filter from the Explorer pane.
2. Navigate to Bookmarks.
3. Expand the bookmark folder.
4. Select a bookmark(s).

The Grid will update to show only these bookmarks.

You can share the labels, issues, and custom fields created for other users in order to be utilized during the review process. Using the Apply Users & Groups function allows you to share these tags with users to edit and use within the case and coding panel.

To share tags:

1. In the Grid, click on the Tags  button.
2. The Tags panel is displayed.
3. Click + Create Labels.
4. Select Labels, Issues, or Custom Fields section.
5. Select the required label, issues, or custom fields.
6. Click + Apply Users & Groups.
7. In the Users & User Groups dialog, select the required users or user groups.
8. Click Save.

The user or user groups can now access the selected labels, issues, or custom fields in the case and within the coding panel.

You can create a case report about the relevant information of a case any time during or after the investigation and analysis of a case. Reports can be generated in different formats, including HTML and PDF. The PDF report is designed specifically for printing hard copies with preserved formatting and correct organization. The HTML report is better for electronic distribution.

Note:  Click the Reports button to access reporting functionality.

• Detail Report: Standard FTK Report
• Processing Reports: 
  1. Data Volume Report – Category Overview, Evidence List, Encrypted File List, Case Breakout and Processing Exceptions.
  2. File De-Duplication Report – De-Duplication Information and File Duplicates.
  3. Email De-Duplication Report – De-Duplication Information and Email Duplicates.
  4. Processing Error Report: General Processing Errors.
• Event Reports: Event Audit Log – User events-based report.
• Search Reports: 
  1. Search Term Report – Search terms associated with a case.
  2. Detailed Search Report: Active search query report. Users must have an active keyword search before this option is available.

You can create a detailed report about the relevant information of a case any time during or after the investigation and analysis of a case. Reports can be generated in different formats, including DOCX and PDF. The PDF report is designed specifically for printing hard copies with preserved formatting and correct organization. 

To create a search term report:

1. From the home page, click Case List.
2. Select the required case.
3. Click Enter Review.
4. Click on the Reports   button.
5. Click Detail Report.
   • The Detail Reports prompt is displayed.

6. Enter a Report Name.
7. Select a Report Format.
8. Select any required Report Attributes
   • Title Page
   • Table of Content
   • Case Summary
   • Embed documents in report – this option will allow users to embed media types within the report.
   • Configure Columns – this option will allow users to select predefined column sets or create custom sets. Refer to the Configure Columns section.
9. Click Save & Next.
10. Select any required Labels or Bookmarks.
11. Click Save & Next.
12. Click Generate Report.

Using Custom Columns (Configure Columns)

During Detail Report creation, users can select the report attribute; Configure Columns. This option allows users to use predefined column sets or create custom sets to be included within a report. 

1. Check Configure Columns.
2. Click Create.
   • The Create columns pop-up is displayed.

6. Enter a Template name.
7. Select a File Type.
8. Click and drag any columns within the Configure Columns list to reorder them.
   • Alternatively, click the delete button to remove any columns from the predefined list.
9. Click Add Columns.
10. Using the Search functionality, locate any required columns and check them.
11. Click and drag any columns within the Applied list to reorder them.
12. Click Apply.
13. Click Save & Close.
    • The custom column set for reports will be available in the Configure Columns drop-down list.
    • If additional changes need to be made to the created set, click Edit after selecting it from the drop-down.

To create a search term report:

1. From the home page, click Case List.
2. Select the required case.
3. Click Enter Review.
4. Click on the Reports  button.
5. Click Search Term Report.
   • The Search Reports prompt is displayed.

7. Enter a Name.
8. Select any of the below searching options:
9. Use current results – To generate search report for files filtered in the Review page.
10. User selected label(s) – To generate the search report for the files associated with the selected labels.

11. Enter Search Requests.

• Syntax - <Search_term>, <label_name>
• Example – Official, Priority

Note:  The dtSearch syntax should be followed.

14. Click Add.
15. Check Assign Labels to automatically apply labels to the corresponding search results. 
16. Check Assign Labels to Family to automatically apply labels to the family files associated with the corresponding search results.

Warning:  The Assign Labels to Family option will be disabled by default and will be enabled only upon checking on the Assign Labels option.

17. Check Search Full Text Only to run the search only across the files’ content i.e.  the search will not be performed across the files’ metadata details. 
18. Check Simple Search Report to create a simplified search term report. When this option is checked, a report with only the number of hits and size for each search term will be created.
19. Click Create Report.
20. Click View Completed Reports from the Generate Report prompt to view the completed search term report with the relevant hit types:

• Docs with Hits
• Docs with Hits + Family
• Size (MB)
• Total Hits
• Unique Docs with Hits
• Unique Family Docs
• Family Emails
• Family Attachments
• Unique Emails without Attachments

To export a report:

1. From the Generate Report prompt, click on any type of reports.
2. The report configuration prompt is displayed.

3. Configure the required information in all the sections and proceed by clicking on Save & Next.
4. Click on Generate Report to generate the selected report.

The job intended for exporting the report will be initiated. 

Creating Viewing and Downloading Completed Reports

To view and download a completed report:

The download will be initiated.

Coding is putting values into the fields (columns) of documents. The Coding panel in Review allows you to use coding layouts to change the data of the selected document. Coding layouts can be created from the Case List or during Batch Administration. 

Reviewers with View Coding Layout permissions can code the data of a document using the Coding panel and the mass actions in the Grid panel. Coding allows you to identify descriptive pieces of information that never had metadata, like images that were loaded and need to have dates manually added into the field. The Coding panel in Review allows you to use coding layouts to code the selected document.

To create a coding panel:

1. From the home page, click Case List.
2. Select a Case. 
3. Click Enter Review.
4. Click on the Show Tags Panel  button.
5. Select the Coding Panel tab.

6. Click + Create Coding Panel.

7. The Create Coding Panel page is displayed.

8. Select the Panel Name. 

9. Select the Users that will have access to the coding panel.

10. Use the sections below to configure new Creating Labels, Creating Issues, Creating DB Columns and Creating Custom Fields.

12. Click Create. 

To create a Label:

1. Navigate to Labels tab.
2. Click on + Add Label.
3. Enter the label’s name in the field prompted.
4. Configure the hotkey by selecting a key against the SHIFT + field.
5. Enable Copy From Previous option in order to apply the previously made configuration to the current record.
6. Click on the Save button.

Notes: 
From the list of labels, you can click on Delete   to remove the label. 
From the list of labels, you can click on the New Label   button against a label folder to create a child label.
From the list of labels, you can click on the New Folder  button against a label folder to create a child folder.

To create an issue:

1. Navigate to Issues tab.
2. Click on + Add Issues.
3. Enter the issue’s name in the field prompted.
4. Configure the hotkey by selecting a key against the SHIFT + field.
5. Enable Copy From Previous option in order to apply the previously made configuration to the current record.
6. Click on the Save button .

Notes:  
From the list of issues, you can click on the Delete  button to delete the issue.
From the list of issues, you can click on the Add Child Issue  button against the required issue to create a child issue.

To create a DB Column:

1. Navigate to DB Columns tab.
2. Select one or more DB columns.

To create a Custom field:

1. Navigate to Custom Fields tab.
2. Click on + Add Custom Fields.
3. Enter a custom field Name.
4. Select the Type of custom field to be created.
   • CheckboxRadio
   • Date
   • Text
   • Number
   • Multi Entry – This option requires users to separate values with a semicolon (;).
5. Enable Copy From Previous option in order to apply the previously made configuration to the current record.
6. Enable the Required option to force users to enter a value into the custom field before submission. 
7. Click Save.

Note:  From the list of custom fields, you can click on the Delete  button to remove the field

To reorganize a coding panel Layouts:

1. From the home page, click Case List.
2. Click on the required case.
3. Click on Enter Review. 
4. Click on the Show Tags Panel  button.
5. Select the Coding Panel tab.
6. Click + Create Coding Panel.
7. Hover over a coding panel element in the Preview-Coding Panel pane.

8. Click and drag an element in its desired order.

9. Click Update.

To delete a Coding Panel:

1. From the home page, click Case List.
2. Click on the Context menu (in the Actions column) against the required case.
3. Click on Manage Coding Panel.

        4. Click on the Delete button .

Warning: Clicking on the Delete button  will remove the coding panel without prompting any further confirmation.