Export case subsets
This section covers:
How to export a subset of items to a new case
How to export a subset of items to an existing case
Exported case settings
How to export annotations to a file
Overview
Unlike a compound case, which aggregates multiple simple cases together, a case subset consists of copies of items from a case to create a new case with those items. The items you use for creating the case subset are not removed from the original case, allowing you to later import into the parent case any annotations that you apply when exporting the case subset.
Suggested use cases for creating case subsets include:
Exclusion-based workflows that cull the evidence by excluding items such as SPAM or other irrelevant items first, then with the remainder of the evidence, create subsets of the items for review.
Tag-based workflows that search for specific terms to find items, and tag sets of items into groups such as "Privileged" and "Responsive"; where you can also create a subset of the items tagged "Responsive" into separate cases for review.
Performance-based workflows that aggregate multiple simple cases, with numerous databases into a single database.
The review workflow is as follows:
Export a set of items from one case into a case subset.
Review those items, which are now in isolation from the items in the parent case.
When the review is complete, export the annotations (tags and comments) from the case subset to a CSV file.
Import the annotations back into the parent case.
Note: Any case history or metadata from the case subset does not transfer to the parent case.
Export a subset of items to a new case
When you want to isolate a set of items from a collection of evidence for a separate review, create a case subset by exporting those items. To export a subset of items to a new case:
List the items you want to export in the Results pane.
From the Results pane, select the check box in the column header to select the items for export. Alternatively, manually select individual items from a result set to export.
Select Export then Export Case Subset to open the Export Case Subset dialog.
Specify case options on the following tabs:
Case settings
Text processing settings: To control how items are indexed; and are the same as those in the Evidence Processing Settings dialog. See the Configure data processing settings section in Configure Evidence Processing settings for details on these options.
Note: Nuix Workstation does not re-process the source data when it creates a case subset, instead, it only re-indexes the previously extracted text.
Annotation settings: To set if user-defined comments, tags, custodians, item sets, and production sets from the parent case are to be included in the case subset. All options are selected by default.
Click OK to export the items to a new case.
An Export Results dialog shows the progress of how many items are being exported, while the Exporting Case Subset dialog remains open.
When all items are exported, click OK on the Export Results dialog to open a folder view of the new case directory.
Notes: When you export items to a case subset from a result set, the parent items of the selected items are also exported. If you export 1000 items, the case subset will have a greater number of items as the additional parent items are also included. Nuix Workstation deduplicates the parent items for any selected items that have the same parent or parents.
Subset cases do not store the binary of included items unless the binary was previously stored and you still require it to be accessible. If you require the subset to be independent of the original stored data, you must pre-populate the binary for the items in the subset before using the Populate Stores option from the Items menu.
The case subset inherits all ingestion processing settings of the parent case. The most important setting to note is the Store binary of items option. If you did not select this option when you originally processed the case, then the case subset will not contain the binary. This is important if you want to transport the case subset, as the path to the original source is likely to be unavailable after transporting it, (for example, after you move it to another PC, share it or use it on another device.)
The newly created case subset has no relation to the original case once the export is complete. It is a brand-new case.
Export a subset of items to an existing case
By exporting a subset of items to an existing case you can add data to that case. You just must ensure you select the existing cases’ case.fbi2 file location in the Directory location field.
To export a subset of items to an existing case:
List the items you want to export in the Results pane.
From the Results pane, select the check box in the column header to select the items for export. Alternatively, manually select individual items from a result set to export.
Select Export then Export Case Subset to open the Export Case Subset dialog.
In Case settings, in the Directory location field, ensure you specify the file location of the existing cases’ case.fbi2 file; besides specifying the case Name, a Description for it, and the Investigator name.
In Text processing settings, specify whether to use stop words and stemming or not.
These settings control how the items are indexed; and are the same as those in the Evidence Processing Settings dialog. See the Configure data processing settings section in Configure Evidence Processing settings for details on these options.
Note: Nuix Workstation does not re-process the source data when it creates a case subset, instead, it only re-indexes the previously extracted text.
In Annotation settings, specify whether to include any existing comments and tags.
These settings determine if user-defined comments, tags, custodians, item sets, and production sets from the parent case are included in the case subset. All options are selected by default.
Click OK to export the items to a new case.
An Export Results dialog shows the progress of how many items are being exported, while the Exporting Case Subset dialog remains open.
When all items are exported, click OK on the Export Results dialog to open a folder view of the new case directory.
Exported case settings
When you create a case subset of an Elastic case, Nuix Workstation processes the case subset according to the Elasticsearch settings you selected for the original Elastic case using the Advanced Settings button. For more details, see the Configure data processing settings section in Configure Evidence Processing settings.
The exported case settings include the following basic information about the case subset:
Name: Of the case subset. (Default = name of the parent case appended with "-Export #".)
Directory: The folder into which you want Nuix Workstation to export the case. The value defaults to the root folder of the last export.
Investigator: The name of the actively logged in user.
Description: Of the case subset for informational purposes.
Case Type: Either Simple (contains loaded evidence) or Elastic (Simple case in a cluster).
Number of Indexes: This controls the concurrent number of threads used in sub-casing, where:
For Lucene/Derby cases, this is the number of 'stores' that are created.
For Elasticsearch cases, there is only one index but 'n' threads to do the export.
Note: The optimal number of indexes depends on the machine you are using. It is best to target the number of indexes to match the number of 'cores' that can keep up with that amount of I/O in parallel. For export items, you do not want to have more indexes than Workers. For faster searching, use fewer indexes. For faster case creation, use more indexes.
Consider the following when deciding on the Number of Indexes to apply to update* existing items in a case or case subset. The number of Workers you determine to process items directly corresponds to the number of indexes that the Nuix Engine creates, since each Worker requires its own index. So, if you have a license to deploy eight (8) Workers but you select to have two (2) indexes to process the items, then a maximum of only two Workers launches for any operation on that case even if you reconfigure the number of Workers.
*Here updating existing items can be when you reload, OCR, or export items.
When performing a case subset to Elastic, the Elastic performance is based on the Elasticsearch settings in Advanced Settings. For more details, see Configure 'Advanced' case creation settings.