Text message conversations
Define Grouping for Messages
Conversation field
• Conversation field will determine how many RSMF file you going to have
• Each time field changes, new file will be generated
• Long conversations are great for review
• You can scroll though long conversation
• Short conversation are good for productions
• You will have to redact what you don’t want to produce
Creating conversation threads
• Some applications will generate conversation thread to group messages together
• Oxygen Forensics Relativity Export
• ESI Analyst
• You can use Room ID from Slack or Conversation ID from Google Hangouts
• This creates conversations that usually too long.
• OK for review but may not work for production
• You can create conversation thread yourself
• Combine Date and Time with Room ID or Conversation ID
• Create thread id based on unique combination of from / to names
Conversation tool
• Static Field such as Room ID or Channel Name
• Unique combination of names
• Date
• Additional Options
• Apply From Parent
• Text Cleanup
• No hashing of output

свернуть