Evidence Grid

Forensic Email Intelligence (FEI) includes a powerful Evidence Grid that facilitates sorting, filtering, and reviewing items with ease. While some of the grid’s functionality should be self explanatory, we will share some key features that may not be immediately obvious.

Launching FEI Viewer

You can double-click on an item on the Evidence Grid to launch FEI Viewer. Once FEI Viewer is open, it is no longer necessary to double-click on items. Simply single-clicking on an item on the Evidence Grid would cause FEI Viewer to display that item. You can read about more ways to launch FEI Viewer here.

Freezing Columns

If you right-click on a cell on the Evidence Grid and choose the Freeze Column option, the column to which the cell belongs will be pinned as the left-most column. For example, you can freeze the Insight Score column this way to see the score of each item regardless of the scroll state of the grid.

Layout Templates

FEI comes with built-in grid layout templates such as MIME, MAPI, and Compact. You can choose one of these templates by right-clicking on a grid cell and choosing the Layout Template menu item.

Filtering on Multi-value Columns

Some columns such as Markers and Gmail Labels allow filtering by each individual value. You can click on the funnel icon on the column’s header to see a list of checkboxes per value. You can use this to focus on emails with specific problems or items that contain certain Gmail labels.

Filter Editor

Once you filter one of the grid columns, a filter row appears on the bottom of the Evidence Grid. You can click on the pencil icon on the right edge of that row to create complex grid queries using a visual interface.

Flags and Notes

The flag bubbles within the Flags column are clickable and would cause the corresponding flag to be queried. Any notes you enter in the Flags View of FEI Viewer would be shown in the Notes column of the Evidence Grid.

Sorting by Multiple Columns

If you click on a column header to sort by that column, this would clear the sort settings of other columns. If you would like to preserve the sort settings of existing columns, you can hold down the SHIFT key before clicking a column header to sort by that column.

For example, if you wanted to sort by Parent Item Id and then by Item Id, you can click on the header of the Parent Item Id column, hold down SHIFT , and then click on the header of the Item Id column. You should now see a sort indicator on both columns.

Quick Grid Search Syntax

You can use the Quick Grid Search textbox on the top right corner of the Evidence Grid to execute simple searches against grid columns. Note that these searches cover what is seen on the grid, not complete item contents such as full text and attachments. For such searches, you can use Index Search.

If you enter a single keyword, it would be executed as a substring search in any column. For example, mite would hit items where a column contains the word Limited.
If you enter multiple keywords such as apple orange banana, they will be combined with an implicit AND operator.
To search for a string that contains a space or special character, enclose it in double quotes such as "independence day".
If you would like to search a specific column, use the column’s display name as in subject:contract. You can also use only the initial characters of the column’s name such as subj:contract.
You can use the + and - operators to require a term or exclude a term. For example, project -upcoming finds items that contain the term project but not the term upcoming.