Evidence analysis (Evidence)

To analyze
evidence:
  • Operations section, double-click an operation, double-click a target, click Evidence
  • Operations section, double-click an operation, double-click a target, double-click an agent, click Evidence
Purpose

This function lets you:

What the function looks like

This is what the page looks like:

Area Description
1

RCS menu.

2

Scroll bar

3

Window toolbar. Descriptions are provided below:

Icon Description

Show selected evidence details. See "Evidence details".

Show the total quantities by evidence type.

Export selected evidence to a .tgz file.

NOTE: the function is only enabled if the user has Export evidence authorization.

Delete selected evidence.

NOTE: the function requires a user license and is only enabled if the user has Evidence deletion authorization.

Apply a level of relevance to the selected evidence.

Apply a bookmark to the selected evidence.

Edit selected evidence notes.

Show evidence ID codes.
Saves currently selected filters or loads previously saved filter settings.
Clear all set filters.

View content in the interface language.

4

Evidence list based on set filters.

5

RCS status bar.

 

To learn more

For interface element descriptions see "Shared interface elements and actions".

For a description of the data in this window see "Evidence data".

For a description of exportable data see "Evidence export data".

For more information on evidence see "What you should know about evidence".

To view a list of evidence types see "List of evidence types".

Preparing evidence for analysis and export, tagging by relevance

To assign levels of relevance to evidence, helpful for display and export:

Step Action
1

Select one or more pieces of evidence.

2
  • Drag Relevance to the required position

or

  • Press the corresponding key combination.
3

Result: the single pieces of evidence are tagged with a symbol according to their level of relevance. Evidence can be filtered by this symbol and included/excluded from export.

Preparing evidence for analysis and export, tagging for the report

To include/exclude evidence in a report and filter for viewing:

Step Action
1

Select one or more pieces of evidence.

2
  • Click Add Report

or

  • press Alt+R
3

Result: single pieces of evidence are bookmarked. Evidence can be filtered by this symbol and included/excluded from export.

Preparing evidence for analysis and export adding personal notes

To add personal notes to one or more pieces of evidence:

Step Action
1

Select one or more pieces of evidence.

2
  • Click Edit Note

or

  • press Alt+N
3

Result: the Notes field can be edited. If several pieces of evidence are selected, the entered text will be copied to all other Note fields.

Analyzing evidence

To quickly or thoroughly analyze evidence:

Step Action
1

Analyze the evidence preview. For example, a mini player can be run for audio files to understand whether the evidence is of interest.

2

Double-click evidence: evidence details appear. See "Evidence details".

Viewing counters divided by type

To view the total amount of evidence divided by type:

Step Action
1

Click Show Summary: the evidence type symbols appear, each with its own counter.

2

Click Hide Summary to hide counters.

Exporting displayed evidence

To select some pieces of evidence and export them:

Step Action
1

First tag evidence by level of relevance and by whether they should be included in the report (Add report key).

2

Continue selections using the column heading filters on homogeneous groups of evidence (Include in report column).

3

Click Export Evidence: indicate which evidence to be included/excluded. Evidence that meets the selected criteria and has the Include in report field flagged is exported. See "Evidence export data".

4

Click Save: a .tgz file is created and downloaded in folder .

NOTE: evidence can also be exported using a Windows command prompt utility in folder . The command is: rcs-db-export. Enter rcs-db-export --help to view the correct syntax and description of all command options.

Deleting evidence according to special criteria

To delete several pieces of evidence according to special criteria (i.e.: date range):

Step Action
1

Hold down the Alt key and click : a window appears to set evidence deletion criteria. For field descriptions see "Evidence export data", fields are similar.