CloudNine Analyst: Actor Maintenance Process

Step-by-Step instructions on how to append or update new and existing actors.

This document provides step-by-step instructions on how to append or update
new and existing actors when importing multiple UFDR images to the same project. The reason for this process is to ensure that actors and any of their aliases are captured appropriately and that the chosen “Actor” name persists regardless of any other aliases that may be identified for that actor on a different UFDR/device.

Due to the behavior of the system, CloudNine Analyst will automatically update the actor’s name from the most recent UFDR import; therefore performing routine Actor Maintenance is important. 

Proceed with this process after your first UFDR import.

Step 1: Exporting the Actor Master List

The first step is to export the Actor Master List. This will provide you with a "master" list from the initial import. 

1. Login to CloudNine Analyst and open your Project.
2. Select actors from the top menu or expand the fly-out menu and select Project Items - Actors from the Project Options section.
3. When the Actor List displays, scroll to the bottom of the page and click the download icon. 
   
4. Once the download icon is clicked, CloudNine Analyst will begin to build the download file and will automatically download a CSV file containing all of the current actors in your project. 
5. In Windows, create a folder named Contacts_Update.
6. Navigate to your default download folder, locate the CSV file, and either copy/paste or move the file to the Contacts_Update folder.  NOTE: The CSV file naming scheme is: <ProjectID>-Actor-List-<YYYY-MM-DDtHH-MM-SS> (24hr time).
   

Step 2: Locating the NamedContacts.csv 

After each UFDR import, ESI Desktop generates a NamedContacts.csv, this file will need to be modified to proceed.

1. Launch ESI Desktop and proceed with importing your UFDR file. 
2. When the upload completes, locate the Projects directory for ESI Desktop. To determine where the project directory is stored, in ESI Desktop click the Status icon located at the top right. The ESI Desktop: Connection Status popup appears and provides the location of the project directory. 
   
   The default directory is C:\Users\<User>\AppData\Local\ESI Analyst\Desktop\Projects.
3. Navigate and open the Projects directory,  then find and open the "Client" folder. 
4. Inside the Client folder, there are subfolders named after each Project that exists for that client. Open the Project folder you are working with. 
5. Within the Project folder, there are folders for each evidence container you imported. Open the <Evidence Container Name> folder and locate the NamedContacts.csv.
     
6. Copy and paste the NamedContacts.csv to the Contacts_Update folder created in Step 1 of this article and rename the CSV file to match the UFDR filename. 
7. Repeat until you have copied/renamed the NamedContacts.csv for all UFDR imports related to the project.

Step 3: Modifying the NamedContacts.csv

The purpose of modifying the CSV is to organize the data so it can be consolidated efficiently.

1. Use a Text Editor program (i.e.,  Notepad++, Text Pad, UltraEdit, etc) or Excel to open the NamedContacts.csv; which was copied to your Contacts_Update and renamed to match the UFDR file in Step 2. 
2. If using a Text Editor, search for þ and replace all with a ; (semicolon). Verify the replacement, then save the file. Make sure it remains in UTF8 format. If a text editor was used, skip to 6. 
3. If you choose to work directly in Excel, you will need to globally replace the delimiter þ with a ; (semicolon). On the Home tab, choose Find & Select - Replace, or press CTRL-H to open the Find and Replace popup. 
4. On the Replace tab, enter þ in the Find what: value. Enter a ; (semicolon) in the Replace with: value. 
   
5. Click Replace All and Excel will replace all occurrences of þ with a ; (semicolon). An All Done message appears when the action is complete. Click OK, then close the Find and Replace dialog. 
   
6. If a Text Editor program was used, open the file in Excel. If Excel was used, your file is already open. Highlight Column A, select Data from the menu then select Text to Columns. The Convert Text to Columns Wizard appears. 
   • Step 1: Original data type selection: choose Delimited, then Next.
   • Step 2: Set the delimiters in your data: deselect any already selected delimiters and then select Semicolon as the delimiter. Click Next. 
   • Step 3: This step is not needed, click Finish.
   • NOTE:  A secondary prompt may appear if data exists in other columns "There's already data here. Do you want to replace it?" If you receive this error, do not proceed, cancel to investigate the data in Excel further. 
     • Commonly, this error is a result of a , (comma) in the data string causing Excel to automatically place data after a comma in its own cell.  Check for data that exists in other columns besides A, if data exists copy and append it to the end of the data in Column A, then clear out the data in other cells.
     • Resolve any other issues. 
   • After resolving issues, return to the Convert Text to Columns Wizard and repeat Steps 1-3 mentioned above. The text to column process should now complete without errors.  
7. Next, you need to find out the owner. Select the ISOWNER column, then choose Sort Z-A located under the Sort & Filter option. The ISOWNER field shows TRUE when that Actor name is the owner of the data. 
   • NOTE: If a Sort Warning message appears, choose the Expand the selection option so all other columns are included with the sort. Otherwise only the data in the selected column is sorted causing other column data to be out of sync.  Alternatively, a Custom Sort on the field may be more effective. 
8. Verify the actor exists in CloudNine Analyst, if the actor exists and there is no new information to update you can delete any TRUE items. If there is new information manually update it in CloudNine Analyst, then delete it from the NamedContacts file.   
9. Delete columns C and D, ISOWNER and SOURCE,  they are not needed for the remaining maintenance cleanup tasks. 
10. Select Column A (ID) and copy/paste into Column C. After the copy/paste is complete, clear the contents in Column A (highlight the column, right-click, and select Clear Contents). 
11. In the first row, you will add or modify field names for the columns that match the columns in the exported Actor List. Enter First Name (A1), Last Name (B1), Phone Number (C1), Email (D1), and Social Media (E1). 
    
    Either complete maintenance  steps 12-14 on this data or wait and proceed to 15 and then on to  Step 4 Modifying the Main Actor List to complete maintenance all at once. 
12. Select the Last Name (Column B) and sort from A-Z. 
13. Manually review the data to identify duplicate names, additional email, or social media information. Copy/paste to the correct cells. Additional maintenance cleanup: 
    
    • If a duplicate is found with different information, consolidate the information in one line then delete the duplicate entry. 
    • If an Actor has multiple phone numbers or email addresses, delimit with a ; (semicolon). 
    • Delete all blank lines.
14. Update any desired field values. The Last Name field is the only required field to create an Actor. Some users choose to only populate the last name field and often it contains both the first and last name. Other users populate all known data to the corresponding field. The advantage to populating all fields where data is avalable is to  enahance how information is searched and displayed in CloudNine Analyst.
    • 💡 If the first and last name exists in the last name column, copy the last name column to its own spreadsheet. Use the Text to Column feature to split the data into two cells. Choose delimited for the type and space for the delimiter.  Once the data is split, perform any necessary cleanup - you will be pasting the data back to the original spreadsheet, DO NOT DELETE any rows to ensure your data will match up to the original data. Once you have completed cleanup, copy the data back to the ContactName.csv spreadsheet. WARNING: The text to Column feature will split data to the right, any data existing in cells to the right will be overwritten or wiped out so this action must be performed in a different worksheet. 
15. When you have completed the maintenance cleanup and added field values. Save the CSV file. 

Step 4: Modifying the Main Actor List

This step is necessary to compare Actors that already exist in CloudNine Analyst and Those actors detected during the UFDR import. Practicing these maintenance steps will help to maintain the actors association more effectively. 

1. Open the actor list file you exported from CloudNine Analyst. 
2. Expand the columns to view the fields and their values. Delete these column fields: Actor_ID, Role, Date_Added,  Notes, Computer_User_Name, Account_Identifier, DOB, SSN, Device_SN, IMSI, and IMEI.
   • After deleting the columns named above, these fields should remain First_Name, Last_Name, Email_Address, Phone Number, and Social_Media_Screen_Name. 
     
     
3. Verify the fields are in the same order in both spreadsheets. If they are not, use the cut and insert functions to move the columns and their data. For example, the Email_Address (column C) and Phone Number (column D) placement may need to be moved. Highlight the Email_Addresses column (C), right-click then select Cut. A dotted border appears around the column. Select the Social_Media_Screen_Name column (E), right-click, and select Insert Cut Cells.  The Email_Address field is inserted as Column D. The Phone Number field is now Column C. 
4. Select all current data and highlight YELLOW.
   
5. Leave the Actor List file open, then open the NamedContacts.csv (renamed to match the UFDR) you modified in Step 3. In the actor list file, select the highlighted data, right-click and select copy.  Paste this data at the end of the NamedContacts.csv. 
6. With both sets of data in one spreadsheet, Sort A-Z on the appropriate name field. Most likely this will be the Last Name column.  HIGHLIGHTED = currently exists in the project, NOT HIGHLIGHTED = new information. 
7. Compare and remove any information that already exists in your project. You may notice a highlighted row above or below a non-highlighted row with the same actor. This is an indicator that you are updating for a potential overlay or manual update. 
8. Manually check the list to identify duplicate names, additional emails, or social media information associated with an existing Actor in the project. Copy/paste in the cells for the actor. 
   • If a duplicate is found with different information, consolidate the information into one line, then delete the duplicate. 
   • If there are multiple phone numbers or email addresses for an actor, delimit with ; (semicolon). 
   • Delete all blank lines. 
   • Examples:
     • If you have exact duplicates in the name column and the field information is in YELLOW and WHITE, delete the WHITE entry. 
     • If you have exact duplicates in the name column but the fielded information in white contains the same or less information than YELLOW, delete the WHITE entry. 
     • If you have exact duplicates in the name column, but the fielded information in WHITE contains more information than what is highlighted in YELLOW, Highlight the WHITE fielded information with RED. RED = Need to update this entry in your project. 
9. Now, sort by the phone number column to further identify new data and data that needs to be updated. Use the same procedures identified in 8. 
   • Examples: 
     
     • If you have an exact duplicate in the Phone Number field and the Name in YELLOW and WHITE are similar enough that you are confident they are the same actor, delete the WHITE entry. (i.e., The same name, but one entry might include a middle initial or one entry exists as Robert Smith and the other as Bob Smith). 
     • If you have exact duplicates in the Phone Number field and the Name in YELLOW and WHITE are the same or similar, BUT there is additional information in other fields such as Email Address or Social_Media_Screen_Name that is not highlighted in YELLOW, highlight the new information in GREEN as an indicator to update the actor with this new information. Or, consolidate this information with the corresponding YELLOW highlight if you are performing an overlay. 
     • If you have exact duplicates in the Phone Number field and the Names are different. Highlight the WHITE line in GREEN to indicate an update is needed. You will need to determine which name to use. 
10. Repeat these processes for Email and Social Media.
11. Once the maintenance cleanup is complete, select File-Save As. Enter a name for the file, then select CSV UTF-8 (Comma delimited) (*.csv).

Step 5: Updating the Actors in CloudNine Analyst

It is now time to determine how the data will be added to CloudNine Analyst. How you proceed will depend on how many new actors have been found and the number of actors that require updates. There are three ways to add /update actors: 

• Manually Update
• Import New Actors
• Import Overlay (requires Actor_ID field)

Manually Update or Add Actors

If there are only a few updates and new ones, you may opt to manually add the information.  To do this: 

1. In CloudNine Analyst, open your project then select actors in the top menu or from the fly-out menu select Project Items - Actors from the Project Options section. 
2. The Actors list appears. Locate an Actor that has updates and then select the EDIT icon. 
3. The Edit Information page appears. Select the appropriate tab, i.e. Social Media, and enter any new information. Select any additional tabs where information needs to be updated. Once complete, click SAVE. You are returned to the Actor List. Repeat this process for all Actors requiring updates. 
4. To add an Actor: Click Add Actor. Input all known information into the appropriate tabs, then click SAVE.  Remember the Last Name field is required.

Import New Actors Post Actor Maintenance

1. If you took advantage of the recommended color coding when performing the Actor Maintenance, you can filter out all highlighted items leaving just the non-highlighted (WHITE) items.  
2. Copy and Paste the non-highlighted items into a new spreadsheet, then select File-Save As to enter a name and save the file as CSV-UTF-8. 
3. Open and connect to CloudNine Analyst, then open the client and project. 
4. On the Project dashboard page, click the fly-out menu. Under the Project Options, select Import to Project - Components - Actors. The Import Actor Metadata (Bulk Creation) page appears.
5. Enter an IMPORT NAME, i.e <DATE_ActorUpdates).
6. Choose the IMPORT TYPE: THESE ARE NEW RECORDS TO BE ADDED TO THE MATTER.
7. UPLOAD LOAD FILE: DROP OR BROWSE FILES HERE TO UPLOAD.
8. DELIMITER: The delimiter should be a , (comma). 
9. NOTES: Optionally add any notes about the import. 
10. Click NEXT. Select the LAST NAME field and any additional fields containing data. 
11. Click NEXT and the IMPORT SETTINGS / FIELD MAPPING confirmation page appears. Select BEGIN IMPORT to proceed with the import. 

Import Overlay

If there are several updates to make to existing actors you can use the Import Overlay option that is found on the Import Actor Metadata (Bulk Creation) page described in the Import New Actors section. Requirements for an Import Overlay: 

1. The ACTOR_ID field must exist in the overlay file, this field will be used as the reference when overlaying. Since the field was removed during the maintenance process it will need to be added back to your spreadsheet. 
2. The IMPORT TYPE: THIS IS AN OVERLAY TO EXISTING RECORDS, UPDATING PREVIOUS RECORDS IMPORTED must be selected.