11. Previewing results

When you double-click an item in the List, Table or Thumbnails view, it will open in the Previewer tab. This new browser tab allows you to inspect, flag, and tag the item, to explore its relations with other items, and to download the item for later use.

Previewer

The Previewer will show a number of inner tabs, presenting different aspects of the item, such as Contents, Preview, Headers, Raw Data, Properties, Attachments, etc. The set of inner tabs will differ from item to item, depending on the type of item that you selected and what information is available for that particular item.

11.1. The Toolbar

The toolbar on the left of the Previewer contains options for producing and annotating the current item, as well as navigating to other items and starting new searches that use this item as a starting point.

Previewer toolbar

At the top is a panel with buttons for producing the current item in a number of formats:

  • Download original item - This button will download the currently previewed item in its original format to tge browser’s default download folder.
  • Print - This button opens the browser’s Print dialog. The printed output will show the contents of the currently selected tab (Contents, Headers, Thumbnails, etc.).
  • Print Report - This button opens a print dialog that shows the native rendering of the item with a minimal amount of metadata. If the item has attachments, you are asked if these should also be printed. The print output can also be saved as a PDF document.
  • Increase font size - This button increases the font size of the text in the inner Previewer tabs.
  • Decrease font size - This button decreases the font size of the text in the inner Previewer tabs.

The next panel lets one iterate over all items in the Details view from which the Previewer was launched and to add or remove tags:

  • Previous and Next buttons - Go to the next or previous item in the Details list. Alternatively, you can also use the keyboard shortcuts Ctrl+right-arrow to go to the next item, and Ctrl+left-arrow to go to the previous item.

    Note

    This functionality is not available when the Previewer was launched by opening a single item from the Item ID Lists facet, from the Tree tab of another Previewer, etc. It is also not available if current user has been inactive for a longer period of time.

  • Add or remove tag button - Opens the tag space where you can add new tags to your case and select a tag from a list of existing tags.

The next three panels are for annotating the current item:

  • Quick tag buttons - You can assign a tag to a quick tag button. Clicking the button tags the item and switches the previewer to the next untagged item in the list. If no tag is pinned to a Quick tag button, it is randomly associated with one of the recently used tags by default.
  • Quick tags configuration Quick tag settings - You can select the number of quick tags available.
  • “Go to next item after tagging” check box - When this check box is selected, clicking the quick tag buttons will switch the Previewer to the next item in the list (if there is one).
  • Flagged - Select this check box to flag the previewed item. You might want to flag an item for organizational reasons. For example, to keep track of the items that you have reviewed in the case.
  • Previewed - This check box is unchecked if this item was not previewed yet. It will be checked if this item was already previewed by any user.

The next panel holds actions for navigating to and searching for related items:

  • Show Family - Use this button to search for all items in the same family as the current item.
  • Show Children - Use this button to search for and display the children associated with the item being viewed in the Previewer. When selected, a search result with the associated children of the currently viewed item will be available in the Cluster Map panel. The label of the cluster will be “Children of [file name]” or “Children of [subject]”. An example of a child item would be an attachment of an email. Intella Connect views emails and attachments as separate items. The attachment would be the child of the parent email. Child items can have child items of their own. Depending on the option that you select, the Show Children shows either only the directly nested children or all children in the tree.
  • Show Duplicates - When an item has duplicates in the case, click Show duplicates to display these duplicates in the Cluster Map. The label of this cluster will be “Duplicates of [file name]” or “Duplicates of [subject]”.
  • Show Conversation - Based on the subject of an email item and certain email headers, Intella can find items that are part of a conversation. Click the button Show Conversation to show all these items in the Cluster Map panel. The label of this cluster will be “Conv: [email subject].” The email subject is the email subject of the item in the previewer.
  • OCR - When this button is clicked, OCR settings will be shown and after confirming, the current item will be OCRed. The result will be shown in OCR tab. See the section on OCR for more details.
  • Queue for Redaction - When clicked, the current item with its currently highlighted keyword search hits are stored in the redaction queue. This queue can be processed later, resulting in the redaction PDFs being generated and the visual areas where these hits appear in this PDF being determined. This allows for the quick review of keyword hits, without having to wait for the redaction PDFs to be generated on demand when one moves from item to item. See the section on Redaction for more details.

Finally, the last panel handles paragraphs:

  • Enable paragraphs detection - When this check box is checked, extra UI elements will be shown in the right margin. See the section on Contents for more details.

11.2. Tabs

The tabs show various aspects of the current item. The set of tabs shown for a particular item can differ from item to item, depending on the item type and which information that particular item holds.

When moving from one item to the next using the Next and Previous buttons, the current tab will stay selected – provided that that tab is also available for the next shown item.

Keyword matches

When the current item has any keyword matches, the tabs containing one or more of the keywords change their appearance:

  • The tab name will contain a number indicating the amount of hits.
  • When the tab contains text and has a scrollbar, the location of the keyword matches will be marked next to the scrollbar as horizontal stripes and buttons to jump from one match to another will be shown in the right bottom corner.

Next we explain which tabs can occur.

11.2.1. Contents

This tab shows the body of an item, e.g. the message in an email or the text inside a Word document. The Contents shows a limited set of stylistic elements such as bold, italic and underlined text, tables and lists. However, text is always drawn as black text on a white background, as to reveal all extracted text. For a native rendering of the item use the Preview tab (when available).

If the item text is too long, it is truncated in the previewer for performance purposes. Click on the “here” hyperlink to view the complete item text.

When the item is an image, this tab will show the image’s content.

If the image has extracted text, it will be shown in a separate tab called “Extracted Text” next to the Contents tab.

Note

Images that are not supported by major browsers are converted to PNG format on the server side.

Handling paragraphs

When the “Analyze paragraphs” option was selected during source creation, extra UI elements will be shown in the right margin. These UI elements indicate the start and end of the paragraphs that Intella Connect has detected. The UI elements are omitted for very short paragraphs (typically one-liners).

Handling paragraphs

Furthermore a popup menu will be shown when the user hovers the mouse cursor on a paragraph, offering the following options:

  • Collapse and expand the paragraph.
  • Mark the paragraph as Seen, or back to Unseen. This grays out all occurrences of this paragraph in all items, facilitating the review of large amounts of long and overlapping documents such as email threads with lots of quoted paragraphs.
  • Mark all paragraphs above or below the current paragraph as Seen or Unseen.
  • Search for all items in which this paragraph occurs. All items that contain the selected paragraph will be returned, ignoring small variances such as white spaces.
  • Mark the paragraph for exclusion from keyword search. This can be used to suppress information present in lots of items but with little relevance to the investigation, such as email signatures and legal disclaimers. Consequently, keyword queries containing terms such as “confidential” and “legal” are more likely to return meaningful results.

11.2.2. Imported text

Text that was imported using importText option in Intella Command-line interface can be viewed in this tab.

11.2.3. Image

Imported images from load files can be viewed in this tab.

11.2.4. OCR and OCR Preview

Shows the text extracted by running Optical Character Recognition on this item. The searchable version of the document will be shown in an OCR Preview tab.

11.2.5. Preview

This tab shows the item as if it was opened in its native application. The Preview tab is only shown when the format of the current item is supported and the Contents tab is not already showing it in its native form. The following file formats are supported:

  • Emails (when the email contains an HTML body)
  • Legacy MS Office formats (doc, xls, ppt)
  • New MS Office formats (docx, xlsx, pptx)
  • RTF
  • HTML
  • PDF
  • CSV and TSV files
  • WordPerfect
  • Open Office (Writer, Calc, Impress)

Important

When previewing emails, only images that are already bundled with the email are shown. Any images that a mail client would have to load from a web server are shown as static icons. When there are any such missing images, a “Show external images” button appears. Clicking this button will load the images from the servers and show them embedded in the email representation. Note that loading these images may constitute a violation of investigation policies.

11.2.6. Headers

This tab shows the complete SMTP headers of an email item. This tab is only shown when you open an email item and it had any headers (e.g. drafts may not have any headers).

11.2.7. Raw Data

The content of this tab depends on the item type. For example, in case of PST emails the low-level information obtained from the PST is listed here. This typically includes the SMTP headers (shown in the Headers tab) and the email body, but also a lot more PST-specific properties.

All this information is also searched through when using a keyword search. This may lead to additional hits based on information in obscure areas that Intella Connect does not process any further.

11.2.8. Properties

This tab shows a list of properties connected to the item. Examples are Size, MIME Type, Creator and Character Set. The list of properties shown depends on the type of the item and what data is available in that particular item.

11.2.9. Attachments

This tab lists the attachments of an email.

When you select it and click View, it will be opened in a new browser tab.

11.2.10. Thumbnails

This tab shows thumbnails of the images (jpg, png, gif etc.) attached to an email item or embedded in a document, e.g. the images embedded in a MS Word document.

When you click on a thumbnail, you will be able to open it in a new browser tab for full resolution of the image or open it in another Previewer tab.

11.2.11. Tree

This tab shows the location of the reviewed item in the item hierarchy (entire path from root to descendants), as well as all its child items.

The file names and subjects are clickable, which will open the item in a new browser tab.

11.2.12. Email Thread tab

This tab visualizes the email thread in which the currently previewed email is located. A blue border indicates the current email.

Each type of icon in this visualization has a special meaning. To see a basic explanation of the icons, click the Legend icon. The icons have the following meaning:

  • Inclusive Email – this email is part of the set of emails that a reviewer should read, in order to read everything in the thread.
  • Non-Inclusive Email – all content of this email is also present in at least one of the replies or forwards.
  • Missing Email – indicates that the existence of an email could be derived from references found in other emails, though the email itself could not be found in the case.
  • Duplicate Emails – indicates that one or more duplicates exist of this email.
  • Reply – indicates that the email was sent as a “Reply” to another email.
  • Reply All – indicates that the email was sent as a “Reply all” to another email.
  • Forward – indicates that the email contains a forwarded email.
  • Attachment – indicates that the email has one or more attachments.

The user can double-click on the nodes in the visualization. This opens that email in a separate Previewer. When the node represents a set of duplicates, one of these duplicates is opened.

To tag all items represented in the visualization, click the Tag Thread button.

To export the graph as a PNG image, click the Export button

11.2.13. Entries

This tab shows the list of items found in an archive file, e.g. a ZIP or RAR file.

When you click an item in the list, it will be opened in a new browser tab.

11.2.14. Comments

This tab lists the reviewer comments attached to the item. Every comment shows the reviewer name and time stamp, and the options to Edit or Delete the comment.

Multi-line comments can be written by using SHIFT+ENTER or CTRL+ENTER combination to add new line separator.

Note that this is not related to the comments such as found in the MS Word document metadata.

11.2.15. Words

The Words tab lists all words/terms extracted from this item, together with the following information:

  • The search field the term belongs to: text, title, path, etc.
  • The frequency of the word in this document and document field.
  • The number of documents having this term in the same field.

This list can be used to diagnose why a certain document is or is not returned by a certain query.

11.2.16. Actions

This tab shows the list of actions performed on the item. The action, the user that triggered the action and the time at which the action occurred are shown in the list.

Actions listed are:

  • Previewed – the item was opened in the previewer.
  • Opened – the item was opened in its native application.
  • Exported – the item was exported.
  • Tagged with – the item was tagged with the specified tag.
  • Flagged – the item was flagged.
  • Commented – the item was commented.
  • OCRed – the item has text content imported from OCR.
  • Redacted – the item was redacted.

Note

Listed actions are ordered by the time. Oldest action is at the top and latest is at the bottom of the list.

11.2.17. Redaction

See the Redaction section for a detailed explanation of the functionality in this tab.