Appendix E: Frequently asked questions

Requirements & licensing

What can a Network Collection do that a Portable Collection cannot?

Files collected via a Network Collection can be saved as native files or as an encrypted FileSafe. A Portable Collection can only save collection results to an encrypted FileSafe.

What can a Portable Collection do that a Network Collection cannot?

A Portable Collection can collect files and disk images on Windows, Linux and macOS computers. A Network Collection can only run on a Windows computer that has a Nuix Collector Suite installation and an active Network Collector license. A Network Collection can only access Linux and Mac files via SAMBA shares.

Can I perform a Deletion during a trial license period?

Yes, trial licenses of Nuix Collector (i.e. "Network Collector") and Portable Collector are full-featured until they reach their expiration date.

Supported platforms

Windows 95, 98 2000: Can files be collected from a computer running Windows 2000 or older?

Yes. A PC running Nuix Collector can collect files from any PC on the network, so long as that PC shares its folders or volumes in a way that is reachable as a UNC path. But Nuix Collector Suite cannot be installed or run directly on these older computers.

Linux and Mac: Can files be collected from Linux and Mac clients?

Yes. Portable collection devices can be created which can run a collection natively on Windows, Linux or macOS (64-bit versions of OSX 10.10 or newer). The portable collection device must be configured on a Windows computer with Nuix Collector Suite installed and the Portable Collector license activated.

Also, a Windows PC running Nuix Collector with a Network Collection license can collect files from any PC on the network, so long as that PC shares its folders or volumes in a way that is reachable as a UNC path. Both Linux and Macintosh OS X-based computers can make their folders accessible on the network via SAMBA shares. On a Windows computer running Nuix Collector with a Network Collection license, any UNC path available from Windows Explorer is available.

NAS File Servers: Can files be collected from Network Attached Storage devices that use SMB (a.k.a. CIFS) shares?

Yes. A Windows PC running Nuix Collector can collect files from a NAS storage device, so long as the NAS can be reached via a UNC path. Linux and macOS computers running Nuix Collector Portable can collect from NAS devices, so long as they can be accessed via a mounted mount point.

Input source

Can an Exchange Server Mailbox Store be specified as an Input Source?

No, however Exchange Server EDB database files can be collected, provided: (1) the Volume Shadow Copy Service is running on the Exchange Server, (2) sufficient disk space exists to create the Volume Shadow Copy, and (3) the collection is run locally, i.e. directly on the Exchange Server.

To make use of such collections, you must have a data search and analysis program capable of examining EDB files. Nuix Workstation is one example of a search and analysis program (licensed separately) that can examine Exchange Server EDB database files.

Alternately, Exchange Server mailboxes and public folders can be exported to PST files. The folder holding these exported PST files can then be collected via the folder's UNC path.

Each version of Exchange Server may require a different tool and method to perform the mailbox export. For details, refer to the Knowledgebase on the Nuix Support web site, at https://nuix.service-now.com/support.

Can an FTP File Server be specified as an Input Source?

Nuix Collector cannot access files via FTP protocols. Nevertheless, it is possible to collect files residing on an FTP server in either of the following circumstances:

The FTP Server's volumes or folders can be accessed via UNC shares or mapped drives.

The FTP server runs Windows 7 / Windows Server 2008 R2, or newer, and has Nuix Collector Suite installed directly on the server.

Can open or locked files be collected?

Yes. Nuix Collector can collect most open files present on a local NTFS or ReFS formatted volume (i.e. a disk partition local to the computer running Nuix Collector). This feature leverages the capabilities of the Volume Shadow Copy Service included with modern versions of Windows.

Open files on network shares (non-local volumes) may not collect successfully, because Nuix Collector does not support access to Volume Shadow Copies on network volumes and NAS shares.

Also, certain applications or PC configurations (certain versions of Acronis TrueImage 9, Symantec Corporate AntiVirus, etc.) may interfere with Volume Shadow Copy Service and thereby prevent local, open files from being collected. Database files, in particular, may fail to collect if the database is actively running.

Some common database-driven systems include:

Microsoft SharePoint sites: Nuix Collector collects the data by crawling the SharePoint sites via http and web services. The items collected are saved as MHTML files, rather than in a database format, so the collected data can be readily searched and analyzed. The SharePoint site and its database must remain running during the collection process.

It is possible to collect SharePoint's underlying Microsoft SQL Server database files directly; however, this may limit the ability to subsequently search and analyze the data. Direct SharePoint (SQL Server) database collection requires running Nuix Collector directly on the SQL Server and having the Volume Shadow Copy Service running on the SQL Server. In lieu of installing Nuix Collector Suite on a SQL Server, you can run Nuix Portable Collector on the SQL Server without having to install the program.

Microsoft Exchange Server: EDB databases remain open while Exchange Server services are running. These open database files can be collected, so long as Nuix Collector Suite is installed and running on the Exchange Server and the Volume Shadow Copy Service is also running on the Exchange Server. In lieu of installing Nuix Collector Suite on an Exchange Server, you can run Nuix Portable Collector on the Exchange Server without having to install the program. Nuix Workstation (licensed separately) can process the EDB files.

As an alternative, mailboxes and public folders can be exported to PST files and then collected. Nuix Enterprise Workstation (licensed separately) can process both EDB and PST files.

For other databases: local databases can generally be collected while the database is in operation, provided the Volume Shadow Copy Service is running. For non-local databases, it is possible to collect database files by first shutting down the services associated with the database. However, you may be limited by the lack of database support in your search and analysis software. If necessary, export database reports in one of several text formats to ensure your database information can be searched and analyzed.

After a Collection completes, check the Error Log to see if any open files could not be successfully collected.

Can EFS-encrypted files and folders be collected?

Yes, however, the user who first encrypted the files must be logged in to the computer running Nuix Collector or Portable Collector. Contact Nuix Technical Support for assistance with EFS-encrypted collections.

When collecting EFS-encrypted files, it is best to save them to a FileSafe, rather than as native files. This is because the native files at the Destination will not be encrypted. Collecting EFS files to a FileSafe is more secure, because only someone with access to Nuix Collector Suite or other FileSafe-compatible product can access the files within the FileSafe.

To collect EFS-encrypted files saved by numerous users, consider deploying Nuix Enterprise Collection Center, which can run from multiple computers under the respective user accounts required for EFS collections.

Can virtual hard disk files be collected?

A PC running Nuix Collector can collect any file that you can access through Windows Explorer (or File Explorer). So Nuix Collector running on a hypervisor (VM host) can collect the virtual hard disk files, such as VMDK and VHD files, on that host. Also, Portable Collector can be run within the virtual machine to perform a collection.

Nuix Collector cannot crawl within a virtual hard disk file to collect the files and folders it contains. If the files residing within a virtual machine need to be collected, then configure input source folders which point to shares or local volumes & folders on the virtual machine.

The virtual hard disk files of stopped virtual machines may be collected just like any other file.

The virtual hard disk files of actively running virtual machines must first be copied, and then those copies can be collected. Each virtual machine host (VMware vSphere, Microsoft Hyper-V, Citrix XenServer, etc.) has its own procedures for suspending or stopping a virtual machine before virtual machine hard disk files can be safely copied. Some systems allow virtual machines to be copied while the virtual machine is actively running.

Can a website, such as an intranet or a content management system, be collected?

SharePoint sites can be collected from a PC running Nuix Collector with a Nuix SharePoint Collector license.

Other kinds of web-based intranet sites can be collected indirectly, if the site's web pages are amenable to being crawled by a third-party web crawling utility. Web crawling utilities save the web site's content as a set of files and folders. These files and folders can then be collected.

Some websites use scripting languages and an underlying database to generate their web pages dynamically. It may not be possible to crawl such systems in a comprehensive manner using a web crawling utility. Exporting the site's database contents as text files or as custom reports may be a practical alternative.

Destination

(This FAQ includes Evidence Files, such as FileSafe Files)

Can a Collection gather from multiple Inputs, and save all the files into a single, consolidated FileSafe?

Yes.

Why are the deepest folder levels at my Destination not shown in Windows Explorer?

Windows Explorer is limited to viewing paths with a maximum length of 255 characters. Nuix Collector can save paths that exceed this length (NTFS volumes support path lengths over 30,000 characters). For details and workarounds, see topic Navigating Extra-Long File Paths.

Performance

When collecting data to a FileSafe, how much faster is it to use HIGH, MEDIUM or NO compression?

Performance varies depending on the speed of the computer running the collection, the speed of the computer holding the original source files (if different), and the speed of the network (if the Destination is on another system). High compression is best if you want to minimize the collection's impact on the network and on disk space at the destination. No compression can result in faster collections, especially if the files being collected hold binary data rather than text.

Disk and volume imaging

Can disk and volume images produced by Nuix Collector be searched?

Yes. Nuix Workbench and related products (licensed separately) can ingest these disk and volume images, index their content and then search the data.

Can disk and volume images produced by Nuix Collector be restored?

Disk and volume images created with Nuix Collector Suite are not intended to be used for data backup purposes. Nuix Collector Suite does not offer any data restoration features. A third-party utility may be able to successfully restore these images, but such restorations are not supported and are beyond the scope of Nuix Collector Suite.

Can files and folders be extracted from disk and volume images produced by Nuix Collector?

Not with Nuix Collector Suite. Nuix Workstation (licensed separately) is capable of extracting files from several disk image formats, including those generated by Nuix Collector Suite.