Set up cases
This section covers case types, and how to:
Create a case
Create an embedded Elastic Simple case
Nuix Workstation enables you to create new cases and add evidence to existing cases. During this process, you can specify the files, directories, or mail stores you want to add to the case. Nuix Workstation then ingests the items and processes them, adding Nuix Workstation metadata and indexing that data for search, analysis, review, and export tasks. There is no specified limit for adding items to a single case.
Also see the other subsections of this section:
Configure 'Advanced' case creation settings
And also see:
Export case subsets under Export data for information on creating case subsets.
Configure Evidence Processing settings for how to define settings to process your cases.
Nuix Workstation Guide to using Elasticsearch.
Case types
Before creating a case, it is important to understand the case types as cases can be used as content containers, to hold evidence which is then analyzed and exported to a legal load file. This enables further review while the case is exported. There and four types:
Select one of the following types, to change the form details according to the case type you select:
Simple: To add any collection of items such as email, documents, and images for indexing.
Compound: To bind together multiple Simple cases that have already been processed. See the previous 'Simple and Compound (Lucene/Derby) cases' section for more details.
Elastic simple case and Elastic compound case: To add a Simple case in a cluster or a collection of Elastic cases, backed by Elastic to enable searching while indexing is in progress.
See the previous 'Simple and Compound Elastic cases' section for more details; and for detailed information refer to the Nuix Workstation Guide to using Elasticsearch.
Note: You must process individual items for ingestion in a Simple case before you can add it to a Compound case. You can also combine multiple Compound cases together to consolidate all data related to an investigation or matter into a single searchable repository.
Simple and Compound LUCENE/DERBY cases
Compound cases are a collection of sub-cases (either Simple Lucene or Compound). Annotations such as tags and exclusions in the sub-cases become available in the Compound case and annotations with the same name aggregate. If you rename a tag in a Compound case, it renames the tag for all sub-cases. Tags created in the Compound case propagate back to its sub-cases. Apache Lucene provides the Indexer while Apache Dery provides the database.
Note: Item Sets and Production Sets from the sub-case are Read-Only in the Compound case, so you cannot add new items to it. To do so, you must create a new item set in the Compound case and add all the items from the sub-case. No aggregation is performed for Item Sets and Production Sets.
Simple (Single) Cases
While Nuix Investigate or Nuix Workstation can lock a Lucene/Derby case exclusively (for Read Only or Read/Write access):
Nuix Workstation locks out all Nuix Investigate users when it does so.
Nuix Investigate can lock a case for all its users, because its concurrent user access is managed internally.
Nuix Investigate users can only to work on the currently visible subset of data.
Compound Cases
Using a Compound case can partially help you overcome the preceding restriction of loading a simple case. As long as one of its single cases is not locked, Nuix Investigate users can work on its data and:
Split the data into multiple single cases (that are themselves access-restricted), for example in some of the following ways:
By custodian or subset of custodians
By data subsets as they come in (for example, first custodian emails from 2020, and then from 2021)
By data source (for example, only mobile data)
Merge the data.
For example, where you run the same 100 search term queries on 200 related sub-cases in exactly same way.
Simple and Compound ELASTIC cases
How long you need to wait before you can re-access a Simple case using the Derby database after processing a job depends on the file size of the evidence and the processing options you selected. This can be minutes or hours and sometimes even days.
Nuix is working on a future release of Nuix Workstation that will allow you to review a Simple case while it processes.
With an Elastic-backed case, you can search in the case while indexing is in progress. While this provides a near real-time search capability, and provides better performance than Nuix Workstation does for processing Derby cases. you do need additional hardware and software and you must refresh the index intermittently. The default Elastic setting = 1s (one second.
During the indexing process, Nuix Workstation temporarily re-configures the index.refresh_interval to sixty seconds, giving a valuable trade-off between fast ingestion and a high availability of searched items during ingestion. You can also reset this to 30s (thirty seconds) or 2m (two minutes).
Note: You cannot:
- Add an Elastic case to a Lucene Compound case.
- Add an embedded Elastic case to an Elastic Compound case.
- Add a Lucene Simple or Compound case to an Elastic Compound case.
Subsets of data you move into a Simple case are invisible and inaccessible in the Compound case unless you fully unlock them. All Simple Elastic cases you add to an Elastic Compound case must be on the same Elastic cluster.