Within a top-level case tab in CloudNine™ Explore, you can access filter information by selecting the Filters sub-tab. The Case Filters display in three panes from left to right: Filters, Document List, and Document Details.
The Filters tab is automatically refreshed every five minutes, regardless of changes to the filter definitions.
Filters Pane
The Filters Pane (left) is used to define filter settings for the case. Select a filter type from the green drop-down, and the display will update to reflect the details for that filter. The tab at the bottom of the Filters Pane also updates to reflect the currently selected filter from left to right.
The available filters are as follows:
Total Effect of Filters Section
The Included, Excluded, and Total fields are displayed at the top of the Filters pane regardless of the filter type selected from the filter type list. The Included field indicates the total number of files included in the filter results for the case. The Excluded field indicates the total number files excluded from the filter results for the case. The Total field indicates the total number of files currently in the case. The Included, Excluded, and Total fields are divided into three categories: Count, Family Count, and Size. The Count, Family Count, and Size values reflect the actual count, family count, and size of the discoverable data in a case. This includes all loose files, e-mail messages, and Microsoft Office documents, but excludes all archive, mail store, and forensic image files.
•Count column - Displays the total number of top-level files. Top-level files include loose files and parent files, such as e-mail messages.
•Family Count column - Displays the total number of top-level files along with any attachments or child files.
•Size column - Displays the total size of the documents in gigabytes (GB). The total size is the sum of all the documents file sizes and is calculated using the family size. When a parent document contains attachments, the attachments are not included in the file size calculation because the parent document file size already reflects the file size of its attachments. This prevents doubling the actual file size of attachments.
Effect of Filters for Selected Filter Type Section
The Included, Excluded, and Total fields, as well as the Count, Family Count, and Size (GB) columns are also displayed at the bottom of the Filters pane for all filter types (except the File Hash Filter and the Duplicate Document Filter). The values displayed at the bottom of the Filters pane are specific to the filter type currently selected.
The Included field indicates the total number of files included in the filter results for the selected filter type. The Excluded field indicates the total number files excluded from the filter results for the selected filter type. The Total field indicates the total number of files currently in the selected filter type. The Included, Excluded, and Total fields are divided into three categories: Count, Family Count, and Size. The Count, Family Count, and Size values reflect the actual count, family count, and size of the discoverable data for the selected filter type. The Count, Family Count, and Size values include all loose files, e-mail messages, and Microsoft Office documents, but exclude all archive, mail store, and forensic image files.
•Count column - Displays the total number of top-level files for the selected filter type. Top-level files include loose files and parent files, such as e-mail messages.
•Family Count column - Displays the total number of top-level files along with any attachments or child files for the selected filter type.
•Size column - Displays the total size of the documents in gigabytes (GB). The total size is the sum of all the document file sizes and is calculated using family size. When a parent document contains attachments, the attachments are not included in the file size calculation because the parent document file size already reflects the file size of its attachments. This prevents doubling the actual file size of attachments.
File Type List
The file type list determines which filter is displayed in the Filters pane. It does not determine which filters are applied to the case. The filter check boxes in the filter list determine which filters are applied to the case documents.
Show List
The Show List is only available for the File Type Filter, E-mail Sender Domain Filter, and the Language Filter. The Show list determines which filters are displayed in the filter list for the selected filter type, based on the filter decision made for each filter. The Show list does not affect whether a filter is included or excluded from the filter results. Only the Inc. and Exc. check boxes in the filter list determine whether a specific filter is included or excluded from the filter results. If the filter list is long, the Show list can help you quickly view which file types have been included, excluded, or are still designated at "Not Decided". By default, the Show list is set to All.
The Show list contains four selections:
•All - All filters are displayed regardless of whether or not the Inc. or Exc. check-boxes are selected for each filter.
•Not Decided - Only filters without the Inc. or Exc. check-boxes selected are displayed.
•Included - Only filters with the Inc. check box selected are displayed.
•Excluded - Only filters with the Exc. check box selected are displayed.
Default Filters Link
The Default Filters link opens the Set Standard File Type Filter Inclusions and Exclusions dialog box. The Set Standard File Type Filter Inclusions and Exclusions dialog box is used to define and apply the default file type inclusions and exclusions for the File Type Filter. The default File Type Filter inclusions and exclusions can be applied to both new cases and existing cases in CloudNine™ Explore. For more information, see File Type Filter.
Filter List
The Filter list displays the filters available for the selected filter type. The check boxes next to each filter in the Filter list determines whether the filter is applied to the case documents.
The Filter list contains six columns, with the exception of the Date Range Filter, which has seven columns.
Filter List Columns |
|
|---|---|
Column |
Description |
Inc. |
Inc. stands for Include. When the Inc. check box is selected for a filter, the filter is included in the filter results. To select all Inc. check boxes, select the Inc. check box in the header. To clear all check boxes, clear the Inc. check box in the header. When both the Inc. and Exc. check boxes are deselected for a filter, the filter is automatically included in the filter results, but the filter is designated as "Not Decided". |
Exc. |
Exc. stands for Exclude. When the Exc. check box is selected for a filter, the filter is excluded from the filter results. To select all Exc. check boxes, select the Exc. check box in the header. To clear all check boxes, clear the Exc. check box in the header. When both the Inc. and Exc. check boxes are deselected for a filter, the filter is automatically included in the filter results, but the filter is designated as "Not Decided". |
(Date Range Filter only) |
The check box column next to the Start Date column determines which date range filters in the filter list are applied to the case documents. When a check box is selected, the filter is applied to the case documents. When the check box is not selected, the Date Range Filter is excluded from the filter results. |
Name |
Name of the filter. |
Start Date (Earliest) |
Start date for the Date Range Filter. |
End Date (Latest) |
End date for the Date Range Filter. |
Count |
The number of top-level case documents returned for the filter results. |
Family Count |
The number of top-level case documents and attachments returned for the filter results. |
Size (MB) |
The sum of all document file sizes in megabytes. The Size MB value is calculated using family size. When a parent document contains attachments, the attachments are not included in the file size calculation because the parent document file size already reflects the file size of its attachments. This prevents doubling the actual file size of attachments. |
Tags |
A check box or tag icon is displayed in this column. If group tags are applied to the filter, the tag icon is displayed. If no group tags are assigned to the filter, the check box is displayed. Click the check box or tag icon in the Tags column to view, add, or remove group tags. |
Sorting Data in the Filter List
In the Filter list, you can sort the data by a specific column in ascending or descending order. To sort the filter list by a column, click the column header name. When you click the column header name, the filter list is sorted by the selected column. After clicking the column header, a small arrow up or down is displayed in the column by which the table data is currently sorted, and the direction of the arrow indicates whether the data is sorted in ascending or descending order. The up arrow indicates ascending order and the down arrow indicates descending order. To change the column used for data sorting, click the column header for the column you want to use. To change the sort order, click the column header again.
Tagging from the Filters Pane
Tags are applied and maintained for groups of documents in the Filters pane by clicking the check box or tag icon for a filter in the Tags column of the filter list. Clicking the check box or tag icon opens the Group Tagging tab in the Group Tagging dialog box. For more information, see Tagging.
Refreshing the Filter Results
The Filters tab automatically refreshes when you select a different filter or navigate away from the Filters tab. If you change the filter settings on the Filters tab, or documents are currently being added or removed from the case while you are viewing the Filter tab, you can manually refresh the Filters tab by clicking the Refresh button in the upper right corner of the Filters Pane to view the latest filter results.
Document List
The Document List (middle) is used to view the filter results for a selected filter. Select a filter from the Filter list in the left pane and the Document List will update to display a list of files that match the filter.
Viewing the Family
When there are attachment or embedded files associated with an email message, the paper clip icon is displayed next to the file name, and a down arrow is displayed to the left of the From field for that file in the Document List. If the file is an attachment or embedded file, a paperclip is not displayed on the file type icon, but the down arrow is still displayed under the file type icon. Click the down arrow to view the attachment or embedded file details. You can click an attachment or embedded file name in the Document List to view the file's information in the Document Details Pane. To collapse the attachment or embedded file details, click the up arrow.
Navigating in the Document List
The navigation bar at the bottom of the Document List displays the current page number and the total number of pages of filter results for the selected filter.
Navigation Bar Key |
||
|---|---|---|
Feature |
Name |
Description |
|
First page button |
Navigates to the first page of the search results. |
|
Previous page button |
Navigates to the previous page of the search results. |
|
Page of field |
Indicates the page number of the currently displayed page. You can navigate directly to a page in the filter results by typing the page number in the field and then clicking outside of the field. |
|
Next page button |
Navigates to the next page of the search results. |
|
Last page button |
Navigates to the last page of the search results |
|
Docs/Page list |
Determines how many documents are displayed per page |
Document Details Pane
The Document Details Pane (right) is used to view the file details for a specific file. If you select a specific document in the center Document List, the Document Details Pane is updated to display text extracted from the file along with the file metadata.
Opening the Native File
The native file corresponding to the currently selected document can be opened by clicking the Launch Source Document link at the top of the Document Details Pane. Clicking the Launch Source Document link opens the native file in its native application.
Truncated Text
If the extracted text exceeds the extracted text limit for the Document Details Pane, the "Document text truncated due to length. Click to launch full text link" message is displayed at the bottom of the Document Details Pane. Clicking the link displays all of the file's extracted text in a text editor.
Tagging from the Document List Pane
Tags are applied and maintained for individual documents in the Document Details Pane within the Document Tagging section. For more information, see Tagging.