ESI Analyst Frequently Asked Questions
How should I format my Control Numbers?
Control Numbers are important to all projects to have a consistent numbering scheme for data reference at the item level. It is best to have an idea on how your data is going to be represented in the system before you process your first import and create a numbering scheme that allows for consistency and understanding of data as it correlates to the project.
Control Numbers, regardless of the mechanism used for importing data into ESI Analyst (UI import, ESI Desktop), must
be unique across the project. Items with duplicate control numbers will be rejected. It is important to remember to assign a starting value that will not overlap with any of your previous imports.
Given that Control Numbers are often alpha numeric values, having consistent length in both numbering and length will allow for the best sorting using your Control Number field.
Good:
ABC-CHT-00000001
Good:
ABC-CHT-00000001
ABC-SMS-00000002
ABC-EML-00000003
Not so good:
ZZZ-0000000001
XYZA-000001
AB-00000002
Why are my Attachment Paths causing my load file to be rejected?
ESI Analyst is a web-based application that leverages programming languages that interpret the backslash character as an "escape: character, meaning that any character following the backslash is to be interpreted as a literal character. When working with Windows based systems file paths leverage the backslash as a path separator, but when they are at the end of a string, it causes the delimiter not to be recognized.
For example: "\My Documents\Contracts\Important\" causes the load file reader to interpret the last quotation mark as a literal character that is part of the Attachment Path column. This then causes the load file's column count to be read incorrectly and subsequently be rejected as an invalid row.
To correct this issue there are a couple of options:
- Replace all backslashes ("\") with a web-compatible forward slash ("/") using any text editor's "Find & Replace" functionality
- Ensure your Attachment Path column value (or any column value) does not end with a backslash (e.g. "DOC-000001"|"\My Documents\Contracts\Important\"|"IMG_0001.jpg" should be "DOC-000001"|"\My Documents\Contracts\Important"|"IMG_0001.jpg")
Why is my load file failing?
Using load files from multiple different systems and platforms can often be confusing. There are several reasons by a load file may be failing to ingest properly into ESI Analyst.
Some of the most frequent issues we see with improperly formatted load files are:
Some of the most frequent issues we see with improperly formatted load files are:
Missing column headers & empty columns
Improperly formatted delimiters
Improperly formatted date fields
Backslashes in column values
Missing Column Headers & Empty Columns
When creating a load file so that you may import metadata into ESI Analyst, be sure that all of the header rows have the field names you need and that there are no empty field titles or empty columns. Below is an example of an empty column when opening the file in a spreadsheet program. Notice the empty column value in the first image.
Without a column header, the import mechanism fails to recognize the column and this causes the import engine to have a mismatch between values and mapped columns. When this occurs, the row is rejected. If the value is empty, but the column header is present, if the field is not a required field, then the column will be accepted.
Improperly Formatted Delimiters
Currently ESI Analyst accepts the following delimiters:
Comma
Pipe
Tab
DC4 (\x14 - standard Concordance style delimiter)
Note that if you select the "\x14" delimiter (DC4 Concordance Delimiter), the quoted text identifier is assumed to be the "þ" character (thorn) , which are standard Concordance delimiters used in most DAT files. All other delimiters assume double quotes (") as the quoted text identifier.
If the column being parsed contains quotes and your delimiter expects quotation marks as the quoted text identifier, you will need to escape those quotes using a backslash "\" character.
Improperly Formatted Date Fields
There are many ways to format a date and they can often cause confusion! ESI Analyst can accept a wide variety of date time formats. Here are the two basic formats most widely encountered:
yyyy-mm-dd hh:mm:ss
mm/dd/yyyy hh:mm:ss
When formatting dates, if your date value separator is a hyphen "-" your date value's first digits will be interpreted as the year. If your date value separator is a forward slash "/" your date value's first digits will be interpreted as the month. (https://en.wikipedia.org/wiki/Date_format_by_country)
If you are using Microsoft's Excel to format your load file beware that Excel likes to drop the seconds off of the timestamp! Unless you modify your date time format directly in Excel this can be problematic. To prevent Excel from munging dates, you can use a "T" value between the date and time values (e.g. "yyyy-mm-ddThh:mm:ss" - in Excel you must select "custom" format an input this as the pattern)
The best standard to use for date values is the ISO 8601 date format (https://www.iso.org/iso-8601-date-and-time-format.html)
When providing your date time stamp in a load file, it is important to separate your timezone value from the date time stamp. This allows ESI Analyst to employ the proper offset methods to the original date time value to provide review in UTC or your user's profile timezone setting. See our article about acceptable timezone formats for further information.
Why Can't I Change a Project's Target Language?
ESI Analyst supports over 70 different languages for machine translation. However, only one target language can be applied per project.
For more information about Machine Translation through ESI Analyst, check out these articles:
Do I Need to Turn off Auto Updates?
If you are loading data through any ESI Analyst desktop-based applications, it is best to turn off any auto updates that would force a restart to your workstation. These updates will shut off the process and the data will need to reprocess import through the "Reprocess Import" option.
How Much Space Do I Need to Process My UFDR or PST?
When uploading a Cellebrite UFDR or Microsoft PST, you will need adequate space for the project files to be created. These project files are what is uploaded to ESI Analyst but is saved locally first. As a general rule of thumb, have a 1:1 size allocation (if you have a 30GB UFDR, have 30 GB's of available space).
If the proper space is not available, you will be prompted when you click "process".
If your main drive doesn't have the available space, you can map your Projects Folder to an external hard drive or another local drive.
Data can not be stored over the network.
How can I Cancel and Restart a Project?
If you want to cancel a project after you have already clicked “Process,” select the “Cancel” button right next to it. The cancellation may take a moment to process. Once the cancellation is complete, you can add a new evidence container and begin a new import to said container.
Where are my Project Folders and Logs
Often times you will want to access your project logs to check for exceptions, counts, errors etc.
To find them, you will go to the ESI Analyst folder to see your logs and projects on your C Drive:
Example: C:\Users\Company Employee\AppData\Local\ESI Analyst\Desktop
Note: sometimes the path is hidden and after the user name you will need to use a backslash "\" then type "appdata then click enter and you will see the subsequent paths.
When you open the Desktop folder, you will see your Logs and Project Folders.
You can open your these folders to access your projects or logs:
If you would like to change this location you have the option to do what when you login to ESI Desktop. Full article here.
How do I Change the ESI Analyst Domain in ESI Desktop?
If you manage two or more sites of ESI Analyst, or mispelled the domain on your initial set up, you will need to change the domain so ESI Desktop logs into the correct ESI Analyst Site.
On your local machine you will need to access the "Accounts cfg" to updated your domain. This is found by getting to your ESI Desktop applications folder:
C:users/(username)/appdata/local/esi analyst/desktop folder
When you open the .cfg file in Notepad or similar you will see the following
In this example, you can change the to saandbox.esianalyst.io to your specific domain and save the file.
Note: Ensure there are no extra spaces and the site is correct.
How can I Import Slack, Teams, or Other Channel Based Data Into ESI Analyst?
The current import process will take in ANY data that is organized by field and corresponding metadata through our Communications Import process. The same is true for channel based applications where the data will need to be processed in a way you can leverage that process.
When importing Microsoft Teams PST's through ESI Desktop, the behavior is that each item will be treated the same as email.
Note: We are building more automated processes around importing JSON related data
"What does BETA mean when I see it in the interface?"
BETA means that this is a relatively new feature to ESI Analyst. While we thoroughly test these features before we release them to our Partners, we recommend that the data undergo quality control. Any issues noted should be raised with our support team as soon as they are encountered.
How are PSTs Extracted?
PSTs are extracted locally, both attachments and metadata, and then uploaded to the system.
Why Aren’t my Search Hits Highlighted?
To view the different search options in Review Project Metadata, click on the arrow next to the word "Search" and then click on the box that says "Has the word or phrase." Once you have selected your search type, you can enter your search term. Usually when a search his it not highlighted, it's because the wrong search type was selected for a term containing a special character. The AND, OR, and Full Query String search types observe special characters while the other options do not.
How do I Delete my Project?
At this time, users do not have permission to delete projects. Please follow the steps below to have a project deleted:
- Archive the project you would like deleted.
- Email support@esianalyst.com with the Client Name, Project Name, and formal request to delete.
Related Articles
Tips on Ensuring Workstation is Configured Correctly - Long File Paths
There are a few things to do to ensure the workstation is ready to start uploading data using ESI Desktop. Long File Paths For instance in Cellebrite the root of an attachment may be found through a long file path that is over 260 characters, Windows ...Configuring Machine Translation
The ability to configure Machine Translation at a Project level is available only to Project Admin accounts and above. If you require access to Machine Translation for your Project, and the service is not available, please contact your Partner Admin ...ESI Desktop - Frequently Asked Questions
Do I Need to Turn off Auto Updates? If you are loading a data through any ESI Analyst desktop-based applications, it is best to turn any auto updates that would force a restart to your workstation. These auto updates will shut off the process and the ...Understanding Control Numbering Options in Imports
When importing data across all categories, you have the option to assign a control number through your load file or in the interface. You have three options to attribute Control Numbers to your data. 1. Control Number Included in Your Load File - ...Creating or Including Control Numbering in Your Import Process
When creating Control Numbers using the import process within ESI Analyst, you have the option to have those already created in your load file OR they can be created upon ingestion. When determining your control number you will be able to designate ...