Frequently Asked Questions

computer forensics

Buy Intella P.I. online and get straight to work

$99

Intella P.I. will search, preview and produce custodians' email, attachments, data files, embedded images, archives, headers, cell phones and metadata with ease.

What file formats and source types does Intella support?

Mail formats

  • Microsoft Outlook PST/OST. Versions: 97, 98, 2000, 2002, 2003, 2007, 2010, 2013 and 2016.
  • Microsoft Outlook Express DBX, MBX. Versions: 4, 5 and 6.
  • Microsoft Exchange EDB files. Versions: 2003, 2007 and 2010.
  • IBM Notes NSF (formerly known as Lotus Notes or IBM Lotus Notes). Notes 8.5.x or higher needs to be installed on the computer running Intella in order to process the NSF files. Intella supports all NSF files that can be processed by the installed IBM Notes version.
  • Mbox (e.g. Thunderbird, Foxmail)
  • Saved emails (.eml, .msg)
  • Apple Mail (.emlx)
  • TNEF-encoded files (“winmail.dat” files).
  • Bloomberg XML dump

Document formats

  • MS Office: Word, Excel, PowerPoint, Visio, Publisher, OneNote, both old (e.g., .doc) and new (.docx) formats, up to MS Office 2016. MS OneNote 2007 is not supported.
  • OpenOffice: both OpenDocument and legacy OpenOffice/StarOffice formats
  • Hangul word processor (.hwp files)
  • Corel Office: WordPerfect, Quattro, Presentations
  • MS Works
  • Plain text
  • HTML
  • RTF
  • PDF (including data entered in forms)

Disk image formats

  • EnCase images (E01, Ex01, L01, Lx01 and S01 files)
  • FTK images (AD1 files), version 3 and 4
  • DD images
  • ISO images

Cellphone extraction reports

  • Cellebrite UFED XML export
  • Micro Systemation XRY XML and Extended XML exports (Extended XML is strongly recommended)
  • Oxygen Forensic Suite XML export

Instant Messaging

  • Skype SQLite databases
  • IBM Notes Sametime chats
  • Pidgin account stores
  • Instant messaging fragments contained in cellphone extraction reports

Search Warrant Results

  • Hotmail (uses a HTML-based collection of files)
  • Gmail and Yahoo (uses an Mbox variant)

Databases

  • SQLite databases, version 3 (Skype SQLite databases have a dedicated processor which extracts entire conversations)
  • Mac OS property lists (.plist files), in ASCII, XML or binary form.

Archives

  • Zip, 7-Zip, Gzip, Bzip2
  • Rar
  • Tar
  • Cabinet (CAB)
  • DEB
  • and other formats including: Cpio, ARJ, XZ, ZipX (partial support)

Miscellaneous formats

  • iCal
  • vCard
  • XML
  • IBM Notes deletion stubs
  • ... and many others

After indexing, is there a way to get an overview of my dataset and what user activity has occurred in that dataset?

Yes, in version 1.9.1 we introduced the Insight analysis shown in an additional tab next to the search tab. The Insight analysis feature was designed to 'deep dive' into your data to find the human context and connections in that data. The Insight tab then lists the most notable user, system and Internet artifacts in your case. This simplifies finding important evidence and improves the examination time and thoroughness of any investigation

What formats does Intella export to?

  • Reports (PDF, JPG, HTML, CSV)
  • Native formats (e.g. DOCX, XLSX, PDF, CSV, PPT, JPG, TIFF etc.)
  • Load file and other formats (Summation, Ringtail, Concordance, CSV (load file), i2 Analyst Notebook and iBase products)

On what OS does Intella run and what software needs to be installed?

Intella is designed to run on Windows Vista, 7, 8, 10 and Windows server (2008 and up). In order to index NSF files, Lotus Notes 8.5 or higher is required. In order to export results to a PST file, MS Outlook 2007 or higher is required.
Intella does not require installation or configuration of any third party database.

Does Intella require specific hardware?

The minimum hardware requirement for Intella Viewer is Intel Pentium 4 CPU, 2 GHz, 4 GB ram. For work stations that will process data using Intella we recommend a minimum of Intel Core Duo CPU with 8 GB ram (64bit system).
To read more on hardware requirements please read this article.

Can I use Intella for eDiscovery purposes?

Yes, Intella can be used for both forensic and eDiscovery matters. In regards to eDiscovery, Intella can process various data types. It allows for easy searching and filtering of the data with its simplistic UI. Review can be undertaken in the same platform where documents can be subjectively coded by the reviewer. Documents can be exported in native, PDF or various load file formats.

Does Intella support Geo Location?

Yes, Intella will process the Geo location data within picture files and emails if the geo location information is available. The user can then view the locations of these items on a world map.

What languages does Intella support?

Intella supports over 50 languages, including: Western (English, German, French, Dutch), Chinese (both Traditional and Simplified), Japanese and Korean. More information about language support can be found in Section 2.5 of our User Manual.

What is the difference between Intella Viewer, 10, 100, 250, Pro, Team and Connect?

Vound has a vast range of Intella products in its portfolio matching all kinds of investigations and budgets. Clients can choose between single-user products, client-server solutions and even a web variant of the platform. More details can be found on this page.

Where can I download the latest version?

If you are looking to try Intella, you can request the trial version.
New version releases can be found in two places. If you are registered on the support portal (support@vound-software.com), you can find new downloads there. You can also set your registered Intella version to check for updates when started.

Does Intella support .edb files?

Yes, we support indexing of Microsoft Exchange databases (.edb files). Intella will open the database and will provide the user with a list of all mailboxes in the database. You can then choose which mailboxes to index and include in your case.

How much does Intella cost?

Vound offers very affordable pricing for its products. The annual maintenance and support costs are 20% of the purchase cost. Please contact your local sales representative for pricing including attractive "bundled" pricing for software and training.

Does Intella filter by skin tone?

Yes, skin tone analysis was included in version 2.0. Skin tone is found under the 'Content Analysis' facet.

Does Intella recover deleted email?

Yes, Intella recovers deleted email from a number of mail formats.

Can Intella de-duplicate email and attachments?

Yes, Intella uses MD5 and smart message hashing to de-duplicate items.

Can Intella search through wildcard queries, fuzzy queries, Boolean operators, phrase queries, proximity queries and field-specific queries?

  • Intella can perform wild card search (single and multiple character) and will work with other search types such as fuzzy, phrases, grouping, proximity, field specific, and generic operators such as AND - OR - NOT.
  • We also provide the ability to search for patterns in your data (such as bank account numbers, tax numbers, invoice numbers etc.) by using a dedicated regular expression interface.

Does Intella work with other forensic and eDiscovery software?

Intella is often used in conjunction with other forensic and eDiscovery software. Intella has a useful enScript for working with EnCase. Intella is often used to reduce the cost of eDiscovery platforms such as "pay per GB products" by pre-culling evidence. Intella has the ability to export to, and import from various load file formats.

Does Intella interrogate all metadata, text and the binary content of documents to forensically identify relevant information?

Intella excels in the extraction of metadata and has been instrumental in a number of matters where the metadata was crucial to the case.

What fields and content does Intella help identify?

Intella identifies encrypted items, PDF images, faxes, and scans, duplicate items and email, near duplicates, messages attached to messages, contents of zip files, document and email headers, message ID and many other fields.

Can Intella natively view MS Office documents?

Yes, Intella has a native preview feature for MS office documents, PDF, RTF and other formats.

Can Intella help identify communication between 2 or more users?

Intella has a number of methods to help identify email communications between users. Intella´s cluster mapping visually depicts relationships between search terms and users. Intella also has a social graph where the communication links between two or more users can be viewed.

Can Intella help identify email threads (email on the same subject)?

Yes, Intella has a one click "Show Conversation" feature for tracing and email threading.

Can Intella be used to identify images inside a user's email?

Yes, during case processing Intella creates thumbnails of all images it processes. This includes images embedded in MS Word documents, PDF, PowerPoint, zip files and attachments to emails. Intella has been used a number of times by law enforcement to identify images used in prosecution.

cyber forensics