Intella Connect Release Notes

Transcription

1 Intella Cnnect Release Ntes Highlights Case templates enable quick initializatin f a new case. Items can nw be exprted t a new case r cpied t anther case. Added a key stre fr passwrd and ther credentials, t be used when indexing encrypted evidence items. Added a Gelcatin view, shwing the gegraphic lcatins f search results, e.g. based n GPS data and IP addresses. Imprvements supprting the large-scale redactin f items, such as queuing items fr redactin based n their keywrd hits, pre-generating redactin PDFs t speed up the Redactin tab s lading time, redacting entire page ranges, and the autmatic redactin f duplicates. Several facets lad faster. Added a Shw Family search ptin. Many indexing and OCR imprvements. Installer On supprted systems, the entered user credentials are verified when installing Intella Cnnect r Intella Nde as a Windws service. Licensing The requirement t have at least 100 days f remaining Maintenance Agreement cverage has been reduced t 60 days. General Varius LDAP-related imprvements, increasing general rbustness and making cnnectin reuse and pling cnfigurable. Varius imprvements t hw the events.lg file stres infrmatin and hw the Restre Anntatins functinality can use it t recver data when the case becmes crrupt, e.g. due t a pwer utage r disk failure. The Abut screen nw shws the surce cde revisin number. The Cases item in the systray s right-click menu has been renamed t Admin Dashbard. Reslved an issue where clicking the Cases item in the systray icn s menu prduced an errr due t the use f SSL with a multi-subdmain certificate. Case Management The settings f a case can nw be stred in a case template. Such a template can be used t easily initialize the settings f a new case, e.g. t cmply with rganizatin plicies r t ptimize it fr the nature f the investigatin. Case templates can fr example cver: Settings in the Preferences windw. The default table clumn setup. Saved Searches. Task definitins.

2 Tags. Keywrd and MD5 hash lists. Exprt templates. Redactin prfiles. Cding layuts. One can nw exprt items t a case. This can either be an existing case r a new case. Several cnfiguratin ptins are available fr cntrlling what item infrmatin is included, e.g. tags, cmments, custdians, OCR text, etc. Parents f exprted items that are nt in the exprt set themselves are represented as stubs in the destinatin case. The new exprt functinality supprts several use cases: Merging f tw r mre cases, s that indexing can be spread acrss multiple machines. Adding data t an nging case while minimizing dwntime. The new evidence is indexed in a separate case first, rather than by adding a surce t the current case. Exprting f selected items t a new case, e.g. t filter ut privileged infrmatin r irrelevant items, r t divide the wrk amng reviewers in such a way that each reviewer nly has access t their wn assigned items. The name and descriptin f a case can nw be changed. Varius usability imprvements in this part f the user interface. Reslved several issues where a shared case wuld nt shw prperly in its tab when it was restred frm standby state after nt being used fr a while. The user wuld keep seeing the The case is being prepared message indefinitely. Reslved an issue with case cnversin nt functining when Intella Nde was running n an Intella TEAM Manager r Intella Prfessinal license. Indexing General A key stre has been added fr entering and managing passwrds and ther credentials. These credentials are used t decrypt any encrypted items encuntered during indexing. Supprted credentials are: Passwrds IBM Ntes ID files X.509 certificates PGP keys Updates fr prcessing Apple Mail files and EMLX files. Added supprt fr indexing lse S/MIME encrypted messages (usually.p7m files). Many imprvements t the indexing f archives. Updates fr indexing the mst recent Cellebrite UFED XML exprts and UFDR reprts. Images in OpenOffice/OpenDcument files are nw extracted. Imprved parsing f senders and receivers in cellphne extracts that cntain bth the cntact name and the address. Imprved the extractin f senders and receivers frm PST/MSG/TNEF items. Instead f Active Directry addresses (X.500 Distinguished Names), regular cntact names and addresses will nw be shwn. Updates fr indexing varius brwser artifacts such as dwnladed files, typed URLs, and bkmarks.

3 Imprvements t the prcessing f date attributes: Unrealistic dates are suppressed, e.g. dates befre r at :00:00 GMT, r at Tw-digit years in Date headers are crrected t a date in the range Imprved handling f s with a nn-standard MIME multipart hierarchy. Added the ability t index L01 files that cntain flders with illegal characters in their name. Reslved an issue with missing files when indexing a MacOS disk image. Reslved sme indexing issues with MS Exchange EDB files. Reslved suppressed indexing errrs when prcessing registry artifacts. Reslved unnecessary cpying f disk images t a temprary file. items that lack a bdy and all header fields relevant fr message hash calculatin are n lnger seen as duplicates. Varius lgging imprvements. Indexing Lad Files Reintrduced the Use the fllwing clumn and value t identify s field. This was remved in an earlier versin. Perfrmance imprvements when imprting a large number f custdians. Added the ability t map data t the Cnversatin Index clumn. Added the ability t imprt hierarchical tags. Reslved an issue with rtated PDFs nt imprting crrectly. OCR Imprted OCR packages can nw be larger than 2 GB. Reslved memry issues that culd ccur when OCR-ing very large files. Varius imprvements t OCR-ing prblematic files due t an upgraded OCR library. When using ABBYY Recgnitin Server, versin 4 is nw the default versin. Searching Added a Shw Family search ptin. This new peratin effectively cmbines the Shw Parents and Shw Children peratins int a ne-click peratin, by determining fr the selected item(s) the tp-level parents and all their nested items. This als relates t the Family Date field. Perfrmance imprvements in lading the Address, Chat Accunt and Phne Number facets. In ne test, lading and displaying a branch in the Address facet went frm 4 minutes t 5 secnds. The Address and Chat Accunt facets are nw case-insensitive. Fr example, tw ccurrences f the same address but with different casing will nw be shwn as a single entry in the Address facet. Added an Item Stubs categry t the Features facet. Item stubs are inserted when items are exprted t a new case, t represent parent items that are nt in the exprt set. Results A Gelcatin results view has been added, shwing the gelcatin f items n a zmable wrld map. Items are gruped in clusters that break dwn int smaller clusters when

4 zming in. Map tiles fr the first few zm levels are bundled with Intella Cnnect. Fr deeper zm levels a cnnectin with a tile server is required. Each cluster f items can be clicked, which lists the items in the Details view beneath the map. Gelcatin data is btained frm: Gegraphic crdinates stred in the EXIF data f digital camera phts. Gegraphic crdinates stred in items extracted frm cellphnes. sender lcatins, using a gelcatin lkup f the sender s IP address. The Lcatin clumn that is ppulated thrugh Cntent Analysis has been renamed t Gegraphical Lcatin. This prevents cnfusin with the Lcatin clumn that represents the evidence lcatin and prevents clumn name clashes in the CSV exprt. Previewer A gelcatin tab has been added, shwing the gelcatin f the current item, if any. See abve fr a descriptin f the infrmatin that this is based n. The utput f the Print Reprt buttn has been simplified t nly shw the item s native rendering, the mst critical item metadata, and (ptinally) the native rendering f its attachments. Imprvements t the native rendering f varius dcument types. The Redact buttn has been remved. Instead, the Redactin tab is nw always present. The OCRed tab has been renamed t OCR. Varius usability imprvements. Reslved an errr that ccurred when previewing EMLX items. Reslved an issue with hit highlighting nt clearing when switching t a different item. Reslved several issues with the rendering f items that have many recipients. Redactin Added an ptin t queue the current item fr redactin, tgether with its currently highlighted keywrd hits. This queue can then be prcessed batch-wise later, which creates their redactin PDFs and applies the redactins t these keywrds. This functinality makes it pssible t quickly review keywrd hits in the Cntents and Preview tabs and pstpne the generatin f the redactin PDF generatin. That generatin can then be run when Cnnect is nt in use, e.g. run vernight. It is recmmended t review the redactin PDFs and the added redactins in the Redactin tab after prcessing the queue. Added a backgrund task fr pre-generating redactin PDFs fr a set f items. This can be used t speed up the initializatin time f the Redactin tab. The benefit f this ptin ver the queue ptin described abve is that the user is reviewing the redactin PDF, which may differ frm the presentatin shwn in the Cntents and Preview tab. The dwnside is that redactin PDFs are generated fr items that ultimately turn ut nt t need any redactins. Added an ptin t let any redactins be applied t all duplicates autmatically. Added a buttn t redact full pages. One can either redact the current page r a range f pages. Added a backgrund task fr remving all redactins f a set f items.

5 Reslved an issue with exprt errrs being added t the redactin PDF rather than the exprt reprt. Varius usability fixes. Exprting CSV Reslved an issue with the exprt t CSV nt exprting Raw Data fields crrectly. Exprting PST Imprvements related t exprting t PST n Windws 10 r when using MS Outlk Exprting Lad Files Added a checkbx titled Opticn Page Cunt field cntains number f pages f entire dcument. This checkbx cntrls the meaning f the last field in an Opticn file. When switched ff, the field is interpreted as the number f pages f the current image file. When switched n, it becmes the number f pages in the entire dcument. This number shuld then nly be listed fr the first page. Added ALL_LOCATIONS and ALL_CUSTODIANS as custm field types. Reduced the verbsity f the date ntatin when using the date nly frmat fr a custm field. Upgrade Ntes Intella Cnnect can directly pen cases made the 2.2 and 2.1.x versins f Intella and Intella Cnnect. When a case made with Intella r Intella Cnnect 2.1 r lder is pened, all Cntent Analysis results are autmatically migrated t a new data strage frmat. This migratin happens nly nce. The ld stre is retained and will still be used when using versin 2.1 r lder. New results will nt be added t the ld stre thugh, and new results added t the ld stre will nt be migrated. Cases made with r later already use the new data stre and are therefre nt affected. When items in cases made with a 2.1.x versin are exprted t a separate case, the registered case size f the target case will be incremented with the size f the riginal case. This may be prblematic fr users with licenses that have a case size limitatin. T reslve the inflated case size, the surce case needs t be re-indexed befre exprting items frm it. Cases made with the 1.9.x and 2.0.x versins f Intella and Intella Cnnect can be pened, but these cases first require cnversin. Case cnversin will create a cpy f the case in which all item data is cnverted, and all tags, cmments and flags are imprted. The existing case will nt be altered in any way and can afterwards still be pened in the lder Intella versin. Access t the riginal evidence files is nt required fr case cnversin. Caveats cncerning the case cntents: Case cnversin will nt transfer the gelcatin metadata extracted frm s when the "Determine gegraphic lcatin f s" ptin was used. Re-indexing f the cnverted case is required t restre such metadata.

6 Multi-page TIFFs will be displayed in the cnverted case as if they were single-page TIFFs. Exprting and printing f the item reprt des reveal the ther pages. Re-indexing f the cnverted case will make all pages displayable again. Case cnversin will require sufficient disk space. As a rule f thumb, please reserve twice the amunt f the evidence size fr yur case flder. Cases made with Intella 1.8.x r lder are nt supprted. Cases made with beta versins are nt supprted and shuld be recreated.