Case Collaboration with Magnet IEF: How to Create a Portable Case
Portable Case is a simple and effective way to share your Magnet IEF case data with other examiners or stakeholders in your investigation. By creating a portable case, you are packaging up your entire IEF case, including the IEF Report Viewer executable file. The portable case can then be passed to another person working on the same case and will allow them to make their own searches, filters, bookmarks, tags or comments without requiring their own IEF license or plugging in a license dongle.
The Choice Is Yours With Portable Case
When it comes to sharing your portable case, you can choose to share your entire IEF case or you can pick and choose specific artifacts to include or exclude. To create a portable case in IEF Report Viewer, open File – Create Portable Case. You will be presented with some options on which artifacts you wish to include in the portable case. All artifacts will be selected by default.
Once you have selected which artifacts you’d like to be included, Magnet IEF will begin creating your portable case. Depending on the size of the evidence and the number of artifacts, this may take a few minutes to complete. When the process is finished, you can browse to the folder where the case was saved and either open or share the entire folder.
If you are passing this data to someone who does not have an IEF license, the case will open in “Investigator” mode, which is a simplified view for users without IEF licenses. For more information on the differences between “Examiner” mode and “Investigator” mode, read this blog.
No matter what mode you are viewing the evidence in, any bookmarks, tags, or comments that had previously been created will be included in the portable case. Additionally, any new bookmarks, tags, and comments will be saved as the case is shared amongst teammates and other investigators add their input to the case.
Collaborating Using Portable Case
Another option for examination teams is to distribute the workload and separate duties in an investigation by creating multiple portable cases. For instance, one examiner could look at a user’s browsing activity, while another could look at chats, pictures, and videos. What’s more is that you can merge these cases back together to create a single complete report on all of their work.
Whatever method you choose, creating portable cases in IEF provides examiners with the ability to collaborate with other stakeholders who might be involved in an investigation. Whether you’re sharing data with an investigator who has more context or knowledge about the suspect or victim, or working with an analyst to split the workload, creating a portable case allows the entire team to collaborate within the same IEF framework and keep all your evidence in a simple, easy to analyze format.