Understanding the Available Fields for Communications
When importing communications data like text messages, chat messages, emails etc. you will have a list of fields that are available for your import. Generally, it is easiest to match closely the titles in ESI Analyst to your load file. Your load file can be in CSV, DAT, Pipe or Tab delimited.
Here is the screen that has the available fields:
Required Fields
Optional Fields
To further understand these fields, here are some helpful descriptions
Communication Type
The Communication Type field is to import the specific type of communication so you can filter appropriately in ESI Analyst. These types are email, chat, sms, mms, call and group. If your loadfile has mixed types, ensure your metadata in that field properly reflects that type of communication.
Control Number
You have three options to attribute Control Numbers to your data.
You can review the full article here.
Date Time Sent
This required field is needed to have the date and time sent. The data needs to be in the required format for proper loading
The two date time stamp options to leverage for your imports are:
- YYYY-MM-DDTh:mm:ss
- MM/DD/YYYYTh:mm:ss
Recipient(s) and Sender
These required fields need to have the recipients email address, phone number, screen name etc. to ensure proper threading.
Important Note: ESI Analyst threads on the exact phone numbers and screen names. If there is inconsistency among those items the 24 hour threads will create separate threads for those exact numbers of recipients and senders.
Timezone
Like all imports categories, the original timezone is a required field and you have two options to attribute a time zone to your data.
1. In your load file you can have a field with the original time zone
2. Input this information in ESI Analyst in the TIMEZONE field option on the initial import page
Note: Proper input information for the time zone is required, see full article here
Attachment Names and Path
If you have any files associated to your data, you will need to use the attachment Name and/or Path field to ensure your data maps to your files that have been uploaded through ESI Sync. Please see this complete article on Attachment Names and Path to ensure you have your metadata organized correctly
Note: All imports containing attachments NEED to have those attachments loaded through ESI Sync first!
BCC and CC
When importing email, this will include those fields in the item view and filters.
Date Time - Last Accessed and Modified
These can be mapped to those fields when available.
Note: All dates displayed in the analysis tools, chronological order, dashboards etc. are based off of Date Time Created
Deleted
This field is typically mapped if the deleted field is available in your collection.
Folder
This is a text value field to map to a specific folder name or important information for your upload.
For Example: "Inbox", "outbox", "personal folder", "pictures", "applications". "label"
Hash Key
If you have already hashed the files, you can provide your hash file for those files.
IMEI and IMSI
The International Mobile Equipment Identity and International Mobile Subscriber Identity can be imported to allow actor matching and searching using ESI Analyst's filters throughout the platform.
Message
This is a text value field that is typically the body of an email, text or group message but can also be OCR'd text or other available message data.
Note: This data can also be imported through a text file using ESI Sync. Ensure the Control ID or other identifiers properly link this data to the correct message metadata.
Status
This can be referenced as the status of the message and is typically "read", "unread", "delivered", "deleted" etc.
Subject or Chat ID
For email, this is the subject of the email, but in chat, text etc. messages where there is no subject, this can be a pre-created Chat ID for that conversation. If none is present, ESI Analyst will assign this ID for the full conversation for those specific recipient(s) and sender.
Family ID
If you have this information in your load file for your email families or chat, text, group families you can map to this fields. If none is present, ESI Analyst will assign an ID based off of its threading.
Translated Text
If you use a 3rd party to translate the text, this will show in the system as a secondary Extracted Text field where you will have "Original" and "Extracted Text" to show the translation.
Note: ESI Analyst offers project level, thread level and item level translation
XREF Link
This is a text value field reserved for the same item being linked in another platform, or can be a hyperlink to any outside application or domain.
Related Articles
Understanding the Available Fields for Computer Activity
Overview Computer forensic artifacts, proprietary platforms and structured data are a part of many investigations and growing in eDiscovery projects. With Computer Activity, you can use this category for many different types of data. This article ...How to Import Communications and Attachments Through ESI Analyst
Communications encompass a variety of communications. The system accepts the following load file formats: CSV, Pipe, Tab or DAT delimited files. Depending on how the data was collected or produced, you may not have a UFDR where you could use ESI ...How to Export Communications
When you have completed a review or want to export out a set of communication data, you can find "Export From Project" in your Project Options. By default all data categories are selected. To export the data you would like, you can use the filters. ...How to Import Electronic Files of Any Type into ESI Analyst
Electronic files of any type are always an important part of any investigation. You can easily load any type of electronic file or media through ESI Analyst's import system. To import files and media you will want to select Computer Activity under ...Viewing Various Communications and Types
In your project dashboard, click on "Review Project Metadata." On your left, you will see a list of filters. Select the "Type" filter to display a list of sub-categories. From that list, click on "Communication." After clicking on "Communication," a ...