Document Timeline

Provides a two-part summary report of the frequency of items occurring between two dates that you select.

In the first part, a line chart shows a frequency of documents in the case for each custodian.

In the second part, a table depicts the occurrence of each custodian for e-mails versus electronic documents on a year/month basis, along with the percentages of all documents for that custodian in the document date range. The counts of these items do not include container items.

Exception Report

Displays a report of any errors or other exceptions that may have been logged during the processing of the case.

The counts include the total number of times a type of error was reported.  Some documents may be responsible for more than one error.

Export Exclusion Log

A tab-delimited text-based log file containing a list of all documents not included in the export set provided to CloudNine™ LAW or a native file output directory.

Export Inclusion Log

A tab-delimited text-based log file containing a list of all documents included in the export set provided to CloudNine™ LAW or a native file output directory.

Export Report

Provides a summary of the documents exported to CloudNine™ LAW or a native file output directory from CloudNine™ Explore based on the selected export set for the current case.
 
Summary section:

•Items in System (Count and Size) - A count and size of all inventoried and expanded items, excluding container items.

•Filtered Items (Count and Size) – A top level count of the filtered items in the case and the family size of those items.

•Total Export Items (Count and Size) - Number of documents in the export and their size.

•Pending or Exported Items (Top Level) – Displays the top level count and family size of the top level items that have been exported or are pending in an export.

•Pending or Exported Items (Included Families) - Displays the family count and family size of the top level items that have been exported or are pending in an export.

•Items Not Exported (Export Errors) - The count of items not exported due to export errors.

Tag Summary section:

Any tag associated with a document which exists in the export set will be included in the tag summary list (not just the tags selected for export). The Count column includes top-level and attachment items that are tagged. The Count may include container items if container items are returned by a search (containers as attachments). These container items can result in a Count that is higher then the Family Count. The Family Count is a sum of the total items in a family excluding container items.
 
By Custodian section:

Summarizes the exported documents on a custodian level using the same fields found in the Summary section of the report.

File Type Summary

Provides a summary report of documents in the case by file type, including the total number of documents by file type and the total size of each file type (including parents and attachments, but excluding all container items).
 
The Min Date and Max Date columns are populated for the file type when available, since not all types of files provide date metadata.

Filter Summary

Provides a summary of the effects of the current filter settings on the case by displaying the total number of included and excluded items per filter, as well as a summary of the net result of the filters on the case as a whole.
 
The Summary section provides a list of each filter type and displays count, family count and size of included and excluded items in the case. These counts and sizes exclude container items.
 
The Eligible Items column displays the total number of items eligible for a specific filter. For example, only items with a matching duplicate item are eligible for the duplicate filter, and only email items are eligible for the email domain filter.
 
The Total Effect of Filters row shows the end result of the remaining filtered items after all filters have been applied to documents in the case.
 
The Detailed Filter Settings section of this report lists the individual item types for each filter, and indicates which items are being included or excluded.

Import Report

Summarizes items imported into the current CloudNine™ Explore case by session, custodian, or both.

In the Summary section, the Imported Items (Source Files) row represents all top-level items imported into the case, such as loose files, archives, mail stores, and forensic images.  It is the file count prior to expansion.  The Family Count value is always "-", and the Size (GB) value is the size of the imported files on disk, including loose files, archives, mail stores, and forensic images.

The Expanded Items row represents all top-level items and the content of archives, mail stores, and forensic images, but excludes the counting of the actual container files (archive, mail store, and forensic image files).  The Size (GB) value is the sum of the file sizes of the documents and is calculated using family size. When a parent document contains attachments, the attachments are not included in the file size calculation because the parent document file size already reflects the file size of its attachments. This prevents doubling the actual file size of attachments.

A .pst will be counted as 1 file in the Imported Items row, and the Expanded Items row value reflects the total number of top-level files within the .pst file, but it does not include the actual .pst file in the count. The Family Count value is the total number of top-level files and attachment/child files in the .pst file.

This report also has sections that display Count, Family Count, and Size information by File Types and By Session.

Language Identification Summary

Provides a summary of all languages found in the case, followed by the total count of documents which were detected for each language.
 
The % of Docs value is calculated based on all of the non-container type items in the case that have content.
 
The language counts displayed in this report may be different then the counts in the language filter since this report includes items which cannot be removed via a filter, such as email attachments. The language filter excludes the non-filterable items so the counts in the report will normally be slightly higher. It is possible for a single document to contain multiple languages.

Search Report

Provides a report based on the search hit results for the search terms defined in the current case, grouped by search term and custodian.  This report includes search names, search filters, and search sets.

Unique Documents (UD) represents the number of documents in this search only and in no other search.

Unique Documents Size (UDS) represents the size of the Unique Documents.

Parent Documents with Hits (PDH) is the number of family parent (standalone and top level) documents that have at least one hit for the search.

Child Documents with Hits (CDH) is the number of child (attachment) documents that have at least one hit for the search.

Total Documents with Hits (TDH) is the sum of Parent Documents with Hits and Child Documents with Hits.

Total Documents with Hits Size (TDS) represents the size of Total Documents with Hits.

Family Count (FC) includes the total number of family members if any member has a hit on the search term.

Family Size (FS) represents the size of the documents included in the Family Count.
 

Top 25 File Types

Summarizes documents in the current case by the 25 most common file types. This report includes the total number of documents by file type, the popularity percentage, and the total size of each file type (including parents and attachments, but excluding all container items).
 
The Min Date and Max Date are populated for each file type when available, since not all types of files provide date metadata.

User Audit Log

A tab-delimited text-based log file containing a list of qualified actions performed by users in the case.

User actions are listed by date and time, with the most recent actions at the top of the log and the oldest actions at the bottom. For more information, see To generate the User Audit Log.

Audit ID

Sequential numbering for audits

TimeStamp

GMT time stamp when the action was performed

UserName

User-name of the user who performed the action  

Action

Action performed by the user

Type

Identifier for the action that took place

AffectedID

ID of the item (search, document, filter, exception) that the action was performed on

AffectedDescription

Brief description of the item that was acted on.  

Value

Value of the affected item after the change was made

Value Data

This column is only populated when tags are applied to an item. The name of the tag(s) are displayed in this column.

FilterDefinitionChanged

One or more documents present in a filter category were excluded from the production set.

FilterDefinitionValueChanged

There was a change made in the filter condition under Date Range Filters.

FilterDefinitionAdded

A new filter condition was added under Date Range Filter.

FilterDefinitionTagAdded

Documents present in a filter category were group tagged.

FilterDefinitionTagRemoved

Group tagged documents present in a filter category were untagged.

FilterDefinitionDeleted

A filter definitions was removed from the filter group.

TagAdded

Tag fields were added to the case.

TagChanged

Tag fields were edited in the case.

TagDeleted

Tag fields were deleted from the case.

DocumentTagAdded

Tagging was applied to one or more documents in the case.

DocumentTagRemoved

Tagging was removed from one or more documents in the case.

SearchAdded

Search terms were added to the saved search list.

SearchTermChanged

Existing search terms were edited in the saved search list.

SearchExecuted

A saved or unsaved search term was executed.

SearchTagAdded

Saved search terms were group tagged.

SearchTagRemoved

Group tagged saved search terms were untagged.

SearchDeleted

Saved search terms were deleted from the saved searches list.

ExceptionTagAdded

All documents from an exception category were group tagged.

ExceptionTagRemoved

Group tagged documents from an exception category were untagged.