Filtered Items navigator
The Filtered Items navigator displays the built-in Nuix Workstation filters, which are based on metadata gathered from ingested items. You can view a breakdown of the items in the collection based on a variety of metadata criteria, such as:
Item type
Email attachments
Irregular and annotated items
Skin-toned images
Tagged items
Review jobs
This section does not include any excluded items. (See the preceding Excluded Items navigator section for that information.) Items can appear in multiple filters (folders in the navigation tree) if they meet the metadata criteria. Each folder displays a count of items included in that filter.
The following points list what you can do in the Filtered Items navigator:
To filter the data, select check boxes against folders or nodes in the tree or double-click their filter name.
This turns the navigator yellow indicating the full set of data is not being used for search and review tasks. Double-click the filter name to display the search syntax used to filter the data in the Search bar.
To expand the nodes in the tree, click the plus (+) sign, and to collapse them, click the minus (-) sign. To clear any filters and repopulate the entire set of evidence, at the top of the tree, select Reset.
To show or hide this section, click the double-arrow icon in the navigator's blue title bar. To view the entire tree left to right, use the bottom scroll bar.
The following table lists all items that appear in the Filtered Items navigator:
| Filtered Items |
Description |
| All Items |
Lists items by file type, organized under the parent folder called All Items. This folder includes all non-excluded items in the collection. |
| Email Attachments |
Lists items attached to the email messages in the collection. |
| Emails and Loose Files |
Lists a combination of email messages and loose files in the source folders that were not emails or email attachments. |
| Irregular Items |
Lists items that Nuix Workstation has determined 'irregular', listed by type of irregular file. See the preceding Icons for irregular files section for how these items appear. |
| Index and Storage |
Lists Index and Storage actions as: Index State: This lists all the items in the evidence list for a case. Storage State: This shows only items with a MIME type of Application. |
| Commented |
Lists items that have comments applied to them. You can search through commented items for a particular word or phrase by using the comment search syntax in the Search bar, in addition to selecting this filter. For example, if you search on comment:"ethical", Nuix Workstation searches for all commented items for that string. |
| Computer |
Lists items identified from a computer, by the following types of computer item: USB Device User Account User Search Host Information Storage Information Network Information Log Windows Registry: SAM, System, Security, Software, NT User. Forensic Relevance: LNK File, Shell Bag, Prefetch File, Jump List, Memory Dump, File System Artifact. |
| Forensics |
Lists items identified as forensic images. |
| Internet |
Lists items identified as internet files, by the following types of internet file: Browser: History, Cache, Bookmark, Search, Cookie, Download Torrents Cloud Storage: Google Drive, Apple iCloud Drive Torrents |
| Communications |
Lists items identified as communication, by the following communication types: Single Message Message Conversation SMS & MMS Skype All Messenger Clients Status Update Phone Call VOIP Call |
| Mobile |
Lists items identified from mobile devices, using the following categories of information: Mobile Device Mobile Other Communication: Call and email Device Detail: App, Account, and Network Location Image: Has EXIF Properties, Has Camera Properties, Has Geo Properties Contact Note Backup: Android and Blackberry |
| Multimedia |
Lists items identified as multimedia files, that are further divided into the following: Skin-toned Images Extra image analysis filters: Image Color Count, Image Size, and Image Color Range. |
| Delete Print Preview From Items |
Use this option to remove the print previews for all the items in the Production Set or Production Set items selected in the Results tab. Note: All the extra image analysis filters function when you select the Perform image color and skin-tone analysis option in Evidence Processing Settings. Skin-toned Images: Filters all images by the percentage of flesh tone identified by Severe, High, Medium, and Low categories. Image Color Count: Filters all images by the Image Color Count categories of Very high, High, Medium, Low, and Very low. Image Size: Filters all image by the Image Size categories of Very large, Large, Medium, Small, and Very small. Image Color Range: Filters all images by the Image Color Range categories of Color, Monochrome, Strict grayscale, Black and white, Not analyzed, and Images. Video Items: Filters items identified as containing video files. Audio Only Items: Filters items identified as containing audio-only files. Audio Items: Filters items identified as containing audio and video files. Has EXIF Properties: Filters images and movie file formats identified as containing EXIF properties, such as date and time, camera make and model, image orientation, resolution unit, software, and positioning. Has Camera Properties: Filters images and movie file formats identified as containing camera properties, such as latitude and longitude, aperture value, flash, focal length, camera make, and model. Has Geo Properties: Filters items identified with geographical mapping properties, including GPS latitude and longitude. Under Thumbnail Container: Filters thumbnail images inside containers such as thumbs.db. You can segregate thumbnails and full-sized images. |
| Named Entities |
Lists items identified as containing Named Entities found during the ingestion process. This filter appears only if you used Named Entities for the case. |
| Markup Sets |
Lists items identified as marked up with redacted or highlighted content, or both. |
| Languages |
Lists items identified by the primary language used in each document. This differs from Writing Scripts, which shows only the presence of those characters in the items. |
| Writing Scripts |
Lists items identified by a specific range of characters in the Unicode alphabet, including Arabic, Chinese, Cyrillic, Hangul (Korean), Japanese and Non-Latin characters. |
| Review Jobs |
Lists items assigned to review jobs, by review job. To view items assigned to a particular review job, select the filter for that job and the appropriate "responsive" tag in the Tagged filter. |
| Tagged |
Lists items tagged or listed by tag. To view items that are responsive but not privileged, select the "responsive" filter in the tree and in the Advanced Search tool, and add search criteria of "none" of the privileged tags. |
| Printed Items |
Lists items by the rendered status of their document conversion to PDF in the case. Items show as 'Not Printed' until they are printed by Export or by View as PDF. |
| Digest Lists |
Lists items that match Digest Lists defined in the case. |
| Fuzzy Hash Lists |
Lists items that match Fuzzy Hash Lists defined in the case. |
| Shingle Lists |
Lists items that match Shingle Lists defined in the case. |
| Word Lists |
Lists items that match Word Lists defined in the case. |
| Cluster Runs |
Lists items used in cluster runs. Each cluster run shows the resemblance threshold and also includes filters for: Ignored, grouping all items selected for clustering and that contain no shingles. Unclustered, grouping all items with shingles, but without common shingles to other items selected for clustering. |
| Search Macros |
Ability to point and click keyword filtering. This enables a repeatable process of identifying relevant items and screening them for sensitive information prior to exporting from Nuix Workstation. It allows investigators to build a profile around individuals being investigated, and is portable from case to case. |
| Batch Loads |
Tracks batches of files loaded into Nuix Workstation with a list of the settings applied to each batch. |
Filter data by File Type
In the Filtered Items navigator, under the All Items filter, you can filter by the item's MIME type. Nuix Workstation does not rely on the item’s file extension to determine its file type, which can be altered, but it relies on the metadata in its header.
You can perform equivalent filtering actions by entering kind as search syntax in the Search bar. See the Nuix Search Guide for detailed information.
Filter data by Writing Script
For customers who work in languages that use specific character sets, the Writing Scripts filter in the Filtered Items navigator lets you identify any item with Arabic, Chinese, Cyrillic, Hangul (Korean), Japanese and Non-Latin characters. Nuix Workstation uses Unicode character set definitions to filter these documents and identify, for example, a document that contains a single Chinese or Japanese character.
If you are unable to see particular characters in your documents, first check to see if you have the required Microsoft character set or sets on your computer. If you are still unable to see all of the appropriate character sets, contact https://nuix.service-now.com/support.
Nuix Workstation uses a regular expression search to find the specific character ranges associated with each language. See the Nuix Search Guide for additional detail on searching for character sets not included in the menu.
Filter data by Language
The Languages filter in the Filtered Items navigator lets you identify an item's primary language based on its textual content rather than on the writing scripts that it contains. The language is identified by a "majority wins" algorithm, so items containing multiple languages are categorized by the majority content.
Nuix can identify more than 50 languages.