Statistics tab

The Statistics tab offers an itemized listing of all file types processed in the case and their respective frequency in the dataset, including a listing of the raw file extensions found and any files classified as irregular. The tab offers a good overview of the items in the case and you should review its contents each time you load data into a new case or add evidence to an existing case.

The Statistics tab differs from the View by: Statistics feature in the Results pane. It shows information about all case evidence; the latter shows information only about the items in a given result set.

Note: This tab is for the entire case and does not take into account excluded items.

Also see the Fast Review Statistics tab section.

Open and use a new Statistics tab

To open and use a new Statistics tab:

Go to Window and select New Statistics Tab, then you can do any of the following:

View the statistics on the following panes for:

Processed files

Raw file extensions

Irregular files

Double-click a row to open a result set containing items for a specific file type.

Single-click the column header to sort a column in ascending (default) or descending order.

Go File > Export >Export View and export the Statistics view with all values seen in the UI to a file or as a case note; and:

Copy and paste the table to a CSV with file type column values shown in the UI.

Export file type strings to use for MIME-type search queries, using the following switch:

Dnuix.investigator.statistics.exportQueryFileType=true

Nuix Workstation does not rely on an item's extension to determine its file type. It checks the contents of the file to ensure the file types are accurately associated. This eliminates the chance to hide evidence simply by changing the file extension.

View stats on processed files

To view statistics on processed files:

Go to Window and select New Statistics Tab.

In the Raw File Extensions pane, view statistics classified by:

File Type: All file types encountered during the ingestion process.

Processed: The total number of items processed for the specific file type.

Corrupted: The total number of items Nuix Workstation was unable to process or found to be corrupted for a specific file type.

Encrypted: The total number of items Nuix Workstation detected as encrypted.

Deleted: The total number of permanently deleted items found in Microsoft mail container formats for a specific file type.

Percentage Encountered: The percentage, by item count, of the total dataset consumed by the specific file type.

The statistics include the percentage of that file type found in all items processed, and includes all files marked as irregular files.

View stats on raw file extensions

To view statistics on raw file extensions:

Go to Window and select New Statistics Tab.

In the Processed Files pane, view statistics for each file extension type found in the raw ingested files, classified by:

Raw File Extension: All file extensions of the raw evidence encountered during the ingestion process.

Processed: The total number of items processed for the specific raw file extension.

Percentage Encountered: The percentage, by item count, of the total dataset consumed by the specific raw file extension.

View stats on irregular files

Shows how many of the processed items were marked irregular, and the percentage of each irregular file type in all items marked as irregular. Files listed as Irregular are still represented in the Processed Files section. The designation is simply an additional attribute associated with the item.

To view statistics on irregular files:

Go to Window and select New Statistics Tab.

In the Irregular Files pane, view statistics for each irregular file type found in the raw ingested files, classified by:

Text Stripped: Items that are searchable, but the text may be garbled or not be properly formatted because the file type, although recognized, did not have a routine to cleanly extract all text and metadata in accordance with API file types.

Unrecognized: Items where Nuix Workstation did not recognize the header and was therefore unable to assign a mime-type.

Bad Extension: Items whose file type (MIME type) is not consistent with their file extension.

Corrupted: Items that Nuix Workstation was unable to process.

Deleted: Items that Nuix Workstation extracted from the slack space of Microsoft email boxes or flagged as deleted in an Encase Logical Evidence File (LEF).

Encrypted: Items that Nuix Workstation determined had encrypted content in files it could not fully index but still could extract the metadata and as much information as possible from them.

Unsupported Items: Items for which Nuix Workstation was unable to extract any content or text.

Non-Searchable PDFs: Items Nuix Workstation determined were PDFs through header recognition, but do not contain text that could be indexed.

Empty: Items that are zero (0) bytes in size.