About Pre-configured Processing Profiles

There are five pre-defined, one-click processing profiles. You cannot edit, delete, or export these profiles.
However, you can use them as a template for a new custom profile.
The following are the pre-configured profiles.
Forensic
processing
This profile includes the following processing options:
MD5 Hash
SHA-1 Hash
SHA-256 Hash
Expand common compound files
This will expand many types of compound files.
See Expanding Compound Files (page 85)
File Signature Analysis
Flag Bad Extensions
dtSearch Test Index
Create Thumbnails for Graphics
Include Deleted Files
Include File Slack
Include Free Space
Include Message Headers
Create Email Threads
This list of processing options is the same as the Factory Defaults in version 4.x.
For a description of processing options, see Evidence Processing Options (page 82)
eDiscovery
processing
The eDiscovery profile allows the processed evidence to be easily imported into AD eDiscovery.
These options include:
MD5 Hash
Flag Duplicate Files
Expand Compound Files
File Signature Analysis
dtSearch Text Index
Document Content Analysis
Don’t Expand Embedded Graphics
Include Message Headers
Do not include document metadata in filtered text
Enable Advanced De-duplication Analysis
Propagate Email Attributes
Create Email Threads
Cluster Analysis
Include Extended Information in the Index
Configuring Detailed Options for a Case | 79
Creating a Custom Processing Profile
You can create a processing profile by selecting a set of processing options and then saving them as a
profile.
You can create a processing profile at one of the following times:
Before creating a case
While configuring processing options for a new case
To create a custom processing profile
1. From the Case Manager do one of the following:
To create a profile before creating a case, do the following:
1a. Click Manage > Evidence Processing Profiles.
1b. Click New Profile.
You can use the Profile dropdown to select an existing profile as a template.
To create a profile while creating a new case, do the following:
Summation
processing
The Summation profile allows the processed evidence to be easily imported into AD Summation.
These options include:
Flag Duplicate Files
Expand Compound Files
File Signature Analysis
Flag Bad Extensions
dtSearch Text Index
Create Thumbnails for Graphics
Generate Common Video File
Document Content Analysis
Entity Extraction (Doc. Content)
Don’t Expand Embedded Graphics
Include Message Headers
Do not include document metadata in filetered text
Enable Advanced De-duplication Analysis
Propagate Email Attributes
Create Email Threads
Cluster Analysis
Include Extended Information in the Index
Enable ‘Standard Viewer’
Basic
assessment
This profile includes the following processing options:
Expand Compound Files
Include Deleted Files
Include File Slack
Include Free Space
Include Message Headers
Field mode FTK Field Mode disables the standard processing options when processing evidence. This speeds
up processing. You can then re-enable processing options through Additional Analysis.
See Using Additional Analysis (page 134)
The Job Processing screen always shows 0 for Queued when Field Mode is enabled, because
items move directly from Active Tasks to Completed.