Smart processing

XAMN Pro license required.

Smart processing in XAMN Pro is a group of time-saving tools that scan through and analyze all data sources in the case. The tools aim to identify or categorize artifacts, and make it quicker and easier for you to find the artifacts that are relevant to the investigation. Some of these tools are built into XAMN, and some are run as external tools but started from within XAMN.

Note:
  • When running a tool, all active data sources in the case are scanned without consideration to any applied filters.
  • If more data sources are added to the case after a tool was run, the artifacts in these data sources are not included in the results.
  • The tool can only be run once on the same set of included data sources.

The Recognized Text filter finds artifacts with text content containing criminal activity and other types of abuse.

Prerequisites
  • You must have an XAMN Text and Analysis license available. Contact sales@msab.com for more information.
  • You must download and install the XAMN Text Intelligence Pack. It's available on MSAB Customer Portal.
Run the XAMN Text analysis tool

To use the Recognized text filter, you need to run the Text analysis tool first to process the data sources in your case.

Note: Only applicable in English. No other languages are supported.

  1. In the ribbon, click Smart processing.
  2. In the Smart processing dialog, select Text analysis and click Next.
  3. If you have unsaved changes in the case, select Save changes to the current case. The case will be closed in order to run the Text analysis tool.
  4. Click Run tool.
  5. In the Text analysis tool, click the Run button to start the Text analysis processing. When the processing is completed, you can open your case in XAMN again, and use the Recognized text filter to find artifacts with text content containing criminal activity.
  6. Select the text content of interest from the displayed list:
    • Targeted Abuse
    • Discriminatory / Prejudice
    • Profanity
    • Grooming / Sexualized
    • Suspected Criminality

Use the integrated Pattern analysis tool to find artifacts that match with defined regular expressions provided in a .csv file. The Pattern analysis tool is useful to find items that follow a specific pattern or format, like credit card numbers, bitcoin addresses, vehicle registration numbers, and phone numbers.

Once the processing is complete, you can filter the results by using the Recognized patterns filter.

Run the Pattern analysis tool
  1. In the ribbon, click Smart processing.
  2. In the Smart processing dialog, select Pattern analysis and click Next.
  3. Under Options, select the .csv file(s) you want to run. You can add one or more files, click +Add files to add files to the list. The files are stored in the folder C:\ProgramData\MSAB\Spotlight\Regex.
  4. Click Next.
  5. Under Run, click Run tool. The selected files are processed one by one.

Note: The number of matched regular expressions is presented once the smart processing is complete. One single artifact can contain one or more matches.

Save and review results

Click Save to keep the results from the processing in your file or case.

Note: To avoid saving unwanted data in your case, review the results before saving.

To view the regular expression syntax within a label value from the .csv file, hover over the filter option under Recognized patterns in the Filters pane.

Note: You cannot save the Recognized pattern filter as a quick view.

Use the Language detection tool to analyze texts and identify the languages. The tool analyzes texts in properties that normally hold user-created data, like message texts, calendar events, and emails.

If an artifact has more than one property that holds user-created data, for example an email that has both a subject and a main message, they will be processed together.

If the text for an artifact contains more than one language, the language that make up the largest part of the text is listed as the identified language for the artifact. Normally only one language can be listed as the identified language but if the languages have different alphabets, one language can be listed per alphabet that occurs.

Only texts that consists of at least 5 characters are analyzed.

Note: The language identification is not 100% accurate. Expect that similar languages might be mixed up and that the language identification accuracy is lower for shorter texts.

Once the processing is complete, the Identified languages section is added to the Investigate pane on the Case tab. It provides a list of languages identified within the active data sources. You can also manually add the Identified languages filter to the filter pane on your work tab. The filter can quickly give you an idea of what the most used languages are within your data sources.

Tip:
  • The Identified languages filter also contains any results from the Speech-to-Text decoding that can be run for audio and video files in XRY.
  • The language detection can also be run in XRY, either during the decoding or as a separate process.
Prerequisites

  • The data sources cannot be write-protected. This is because the processing results are saved in the .xry files.

Run the Language detection tool

  1. In the ribbon, click Smart processing.

  2. In the Smart processing dialog, select Language detection and click Next.
  3. Click Run tool.
  4. When the detection is complete, click OK.

Related topics