Starting with LAW 7.13, we have built out the ability for a user to convert their ED Loader cases into a LAW Turbo case. This page will go over how to convert your ED Loader case into a LAW Turbo case and what you need to be aware of once you have completed the process.
We have built this process as we are seeing more and more that IT groups in government agencies, LAW firms and companies are starting to force people out of 32bit programs. Their reasoning could be for any of these reasons performance gains, Security enhancements, industry standards, or driver and App compatibility. Microsoft has also indicated that they are stopping some 32bit programs.
The subjects covered on this page are
|
During the conversion process •Will be converted on the last used ED Loader settings. •It currently takes around 1min for every 100k documents in the case. •The case will close after the conversion process. •Converted case will be able to use the multithreading Turbo agents and process data much faster than ED Loader. •If there is a failure during the converting, the case will remain an ED Loader case. •PST files are limited to one workstation during the the "EDLCompatibility" stage •Is able to create the ED Loader hashing for PST, OST, loose MSGs, loose EMLs, DBX and MBOX files •Converted cases are creating the ED Loader hash not the Turbo hash. This takes place in the EDLCompatibility stage. •Is able to deduplicated against the data that was ingested with the ED Loader engine. We are first deduplicating against data in the ED Loader tables then the Turbo tables •Is able to work with 64bit or 32bit versions of Outlook. The same versions of Outlook with the same style of dummy or non dummy mail profile, will need to be installed on any workstation that Turbo is running on. Converted cases still need Outlook for generating the ED Loader hash. •Converted case are using Outlook, that means taht you can't run a Converted Turbo case and ED Loader on the same workstation. •Files from Archives: zip, 7-zip, rar, tar, TarBz2, TarGz, TarZ, Gz, Bz2, Z, Compound documents, PDF portfolio, MBOX emails (.eml files), Forensic Images: Encase Image, Raw Forensic Image, Forensic Image Segment Files are extracted during analysis for ED Loader converted cases only. •Converted cases still have access to the ED Loader Session Report, ED Loader Session Browser, as well as Turbo Session Reports and Session Browser. •If open, Outlook will automatically be closed on Turbo workstations when importing data on converted cases.
Converted case are not able to •ED Loader hashing is not supported for NSF files; however, NSF files can still be ingested, and Turbo hashing will be automatically generated. •Create top level documents with the container. Documents that were imported into ED Loader cases with the “Treat archive as attachment container (i.e. the container was created as the parent level item) will not be able to be deduplicated again in a converted Turbo case. •Automatically populate DupCustNames, DupCustPaths, DupParentName and DupParentPaths, populated after import.
ED Loader hashing is done through your version of Outlook and the program Redemption. Each Microsoft update could change how email hashed. Depending on which version of Outlook you ingested the data with will determine how high of a percentage match you get in a converted case. Testing was done on the last version of Redemption and a local install of Office 365. Results of those tests were 96% and greater.
If you have any additional questions, or would like to talk to someone to make sure your environment is setup correctly, please contact your Account Manager.
|
|
|
If this will be your first time using Turbo, it is highly suggested that you create a Turbo case in order to get used to it. OR There is no way to convert a LAW Turbo case into a ED Loader case. If you have concerns on converting an ED Loader case to a Turbo case, we highly suggest that you back a case up and then convert the case. |
Stating with LAW 7.13, if you decided not to convert your ED Loader cases to LAW Turbo cases right away, you can upgrade them later. In the top right corner you will see our blue upgrade button.
If you click the blue button inside of the LAW case but you do not have any Turbo licenses, then you will not be eligible to convert the case to a Turbo case.
•Click OK to return to the LAW case.
Please reach out to your account manager to purchases the Turbo licenses.
If you click the blue button inside of the LAW case, and you do have licenses then you will have an opportunity to convert them to Turbo cases.
•Click YES the case will then be converted to a Turbo case. Note that the case will case will close after conversion and will then need to be reopened. •Click No and you will be returned to the ED Loader case.
|
|
Support for Access cases was stopped in LAW 7.7. If you are still using an Access case, it is highly suggested that you migrate the case into a SQL case. Steps for this process can be found here: The blue upgrade to Turbo button will be visible in Access cases.
If you click the blue upgrade to Turbo button in the Access case and you do not have any Turbo licenses, you will get this window suggesting that you first migrate the case to SQL where it can then be upgraded to a Turbo case. This link can help:
If you click the blue upgrade to Turbo button in the Access case and you do have Turbo licenses, then you will get this window. Unfortunately we can not upgrade an Access case to a Turbo case. You will first need to migrate the case to SQL and which can then be upgraded to a Turbo case. This link can help:
|
