![CloudNine_Transparent_Low Res.png]](https://kb.cloudnine.com/hs-fs/hubfs/1%20-%20CloudNine%20MARKETING/1%20-%20LOGOS/CloudNine%20Logos/CloudNine_Transparent_Low%20Res.png?height=40&name=CloudNine_Transparent_Low%20Res.png){kind=small}
How should I format my Control Numbers?
Control Numbers are important to all projects to have a consistent numbering scheme for data reference at the item level. It is best to have an idea of how your data is going to be represented in the system before you process your first import and create a numbering scheme that allows for consistency and understanding of data as it correlates to the project.
Control Numbers, regardless of the mechanism used for importing data into CloudNine Analyst
(UI import, ESI Desktop), must be unique across the project. Items with duplicate control
numbers will be rejected. It is important to remember to assign a starting value that will not
overlap with any of your previous imports.
Given that Control Numbers are often alpha-numeric values, having a consistent length in both
numbering and length will allow for the best sorting using your Control Number field.
Good:
ABC-CHT-00000001
Good:
ABC-CHT-00000001
ABC-SMS-00000002
ABC-EML-00000003
Not so good:
ZZZ-0000000001
XYZA-000001
AB-00000002
Why are my Attachment Paths causing my load file to be rejected?
CloudNine Analyst is a web-based application that leverages programming languages that interpret the backslash character as an "escape: character, meaning that any character following the backslash is to be interpreted as a literal character. When working with Windows-based systems file paths leverage the backslash as a path separator, but when they are at the end of a string, it causes the delimiter not to be recognized.
For example: "\My Documents\Contracts\Important\" causes the load file reader to interpret the last quotation mark as a literal character that is part of the Attachment Path column. This then causes the load file's column count to be read incorrectly and subsequently be rejected as an invalid row.
To correct this issue there are a couple of options:
- Replace all back-slashes ("\") with a web-compatible forward-slash ("/") using any text editor's "Find & Replace" functionality
- Ensure your Attachment Path column value (or any column value) does not end with a backslash (e.g. "DOC-000001"|"\My Documents\Contracts\Important\"|"IMG_0001.jpg" should be "DOC-000001"|"\My Documents\Contracts\Important"|"IMG_0001.jpg")
Why is my load file failing?
Using load files from multiple different systems and platforms can often be confusing. There are several reasons by a load file may be failing to ingest properly into CloudNine Analyst.
Some of the most frequent issues we see with improperly formatted load files are:
Some of the most frequent issues we see with improperly formatted load files are:
Missing column headers & empty columns
Improperly formatted delimiters
Improperly formatted date fields
Backslashes in column values
Missing Column Headers & Empty Columns
When creating a load file so that you may import metadata into CloudNine Analyst, be sure that all of the header rows have the field names you need and that there are no empty field titles or empty columns. Below is an example of an empty column when opening the file in a spreadsheet program. Notice the empty column value in the first image.
Without a column header, the import mechanism fails to recognize the column and this causes the import engine to have a mismatch between values and mapped columns. When this occurs, the row is rejected. If the value is empty, but the column header is present, if the field is not a required field, then the column will be accepted.
Improperly Formatted Delimiters
Currently, CloudNine Analyst accepts the following delimiters:
Comma
Pipe
Tab
DC4 (\x14 - standard Concordance style delimiter)
Note that if you select the "\x14" delimiter (DC4 Concordance Delimiter), the quoted text identifier is assumed to be the "þ" character (thorn) , which are standard Concordance delimiters used in most DAT files. All other delimiters assume double quotes (") as the quoted text identifier.
If the column being parsed contains quotes and your delimiter expects quotation marks as the quoted text identifier, you will need to escape those quotes using a backslash "\" character.
Improperly Formatted Date Fields
There are many ways to format a date and they can often cause confusion! CloudNine Analyst can accept a wide variety of date time formats. Here are the two basic formats most widely encountered:
yyyy-mm-dd hh:mm:ss
mm/dd/yyyy hh:mm:ss
mm/dd/yyyy hh:mm:ss
When formatting dates, if your date value separator is a hyphen "-" your date value's first digits will be interpreted as the year. If your date value separator is a forward slash "/" your date value's first digits will be interpreted as the month. (https://en.wikipedia.org/wiki/Date_format_by_country)
If you are using Microsoft's Excel to format your load file beware that Excel likes to drop the seconds off of the timestamp! Unless you modify your date time format directly in Excel this can be problematic. To prevent Excel from munging dates, you can use a "T" value between the date and time values (e.g. "yyyy-mm-ddThh:mm:ss" - in Excel you must select "custom" format and input this as the pattern)
The best standard to use for date values is the ISO 8601 date format ( https://www.iso.org/iso-8601-date-and-time-format.html
When providing your date time stamp in a load file, it is important to separate your timezone value from the date time stamp. This allows ESI Analyst to employ the proper offset methods to the original date-time value to provide a review in UTC or your user's profile timezone setting. See our article about acceptable timezone formats for further information.
Why Can't I Change a Project's Target Language?
CloudNine Analyst supports over 70 different languages for machine translation. However, only one target language can be applied per project.
For more information about Machine Translation through CloudNine Analyst, check out these articles:
Do I Need to Turn off Auto Updates?
If you are loading data through any CloudNine Analyst desktop-based applications, it is best to turn off any auto-updates that would force a restart to your workstation. These updates will shut off the process and the data will need to reprocess and import through the "Reprocess Import" option.
How Much Space Do I Need to Process My UFDR or PST?
When uploading a Cellebrite UFDR or Microsoft PST, you will need adequate space for the project files to be created. These project files are what is uploaded to CloudNine Analyst but are saved locally first. As a general rule of thumb, have a 1:1 size allocation (if you have a 30GB UFDR, have 30 GB's of available space).
If the proper space is not available, you will be prompted when you click "process".
If your main drive doesn't have the available space, you can map your Projects Folder to an external hard drive or another local drive.
Data can not be stored over the network.
How can I Cancel and Restart a Project?
If you want to cancel a project after you have already clicked “Process,” select the “Cancel” button right next to it. The cancellation may take a moment to process. Once the cancellation is complete, you can add a new evidence container and begin a new import to said container.
Where are my Project Folders and Logs
Often times you will want to access your project logs to check for exceptions, counts, errors etc.
To find them, you will go to the ESI Analyst folder to see your logs and projects on your C Drive:
Example: C:\Users\Company Employee\AppData\Local\ESI Analyst\Desktop
Note: sometimes the path is hidden and after the user name you will need to use a backslash "\" then type "AppData then click enter and you will see the subsequent paths.
When you open the Desktop folder, you will see your Logs and Project Folders.
You can open these folders to access your projects or logs:
If you would like to change this location you have the option to do what when you log in to ESI Desktop. Full article here.
How do I Change the CloudNine Analyst Domain in ESI Desktop?
If you manage two or more sites of CloudNine Analyst or misspelled the domain on your initial setup, you will need to change the domain so ESI Desktop logs into the correct CloudNine Analyst Site.
On your local machine, you will need to access the "Accounts cfg" to update your domain. This is found by getting to your ESI Desktop applications folder:
C:users/(username)/appdata/local/esi analyst/desktop folder
When you open the .cfg file in Notepad or similar you will see the following
In this example, you can change the to saandbox.esianalyst.io to your specific domain and save the file.
Note: Ensure there are no extra spaces and the site is correct.
How can I Import Slack, Teams, or Other Channel Based Data Into CloudNine Analyst?
The current import process will take in ANY data that is organized by field and corresponding metadata through our Communications Import process. The same is true for channel-based applications where the data will need to be processed in a way you can leverage that process.
When importing Microsoft Teams PST's through ESI Desktop, the behavior is that each item will be treated the same as email.
Note: We are building more automated processes around importing JSON related data
"What does BETA mean when I see it in the interface?"
BETA means that this is a relatively new feature to CloudNine Analyst. While we thoroughly test these features before we release them to our Partners, we recommend that the data undergo quality control. Any issues noted should be raised with our support team as soon as they are encountered.
How are PSTs Extracted?
PSTs are extracted locally, both attachments and metadata, and then uploaded to the system.
Why Aren’t my Search Hits Highlighted?
To view the different search options in Review Project Metadata, click on the arrow next to the word "Search" and then click on the box that says "Has the word or phrase." Once you have selected your search type, you can enter your search term. Usually, when a search his it not highlighted, it's because the wrong search type was selected for a term containing a special character. The AND, OR, and Full Query String search types observe special characters while the other options do not.
How do I Delete my Project?
At this time, users do not have permission to delete projects. Please follow the steps below to have a project deleted:
- Archive the project you would like deleted.
- Email support@esianalyst.com with the Client Name, Project Name, and formal request to delete.