Process Data into a Nuix Case

Learn how to ingest data into Nuix cases.

  4 minute read  

Ingest data into a case

When you process data into a Nuix case, there are many parameters you can use. These parameters let you configure what data is retrieved, how data is processed, where it is stored, and what resources should perform the work. The settings you use are often determined by the type of investigation being performed and the level of detail that is required.

Details about these parameters can be found in the reference documentation for the endpoint.

For the purposes of this example, a simple ingestion can be performed by submitting a POST request to the /cases/{caseId}/evidence/file endpoint. This request ingests the contents of a single file or directory into an evidence container within the case using basic processing settings.

curl -L -X POST 'http://127.0.0.1:8080/nuix-restful-service/svc/v1/cases/0eedda2d297046ae8e67fbda9f192df9/evidence/file' \
-H 'nuix-auth-token: 49e225d7-b88d-4d1b-9cbc-296e83706a60' \
-H 'Content-Type: application/json' \
--data-raw '{
  "container": {
    "custodian": "John Doe",
    "name": "Evidence Container 1"
  },
  "target": {
    "path": "C:/LocationOfData"
  },
  "processorSettings": {
    "analysisLanguage" : "en",
    "processText" : true,
    "reportProcessingStatus": "physical_files",
    "traversalScope" : "full_traversal"  
  }
}'

{
    "functionKey": "72744ec6-6de1-488c-bbec-ff27b64974e3",
    "location": "http://127.0.0.1:8080/nuix-restful-service/svc/v1/asyncFunctions/72744ec6-6de1-488c-bbec-ff27b64974e3"
}

In this example, the following parameters are submitted in the body of the request as raw data.

  • custodian: The name of the person who owns the data being ingested.
  • name: The name of the evidence container where the custodian’s data is being ingested.
  • path: The absolute path to the file or directory being ingested.
  • analysisLanguage: The language to use for text analysis when indexing the data.
  • processText: Store and index the text of data items.
  • reportProcessingStatus: Calculates the physical file size of the evidence before ingestion. This data can then be used to report the progress of the ingestion.
  • traversalScope: Indicates what files should be processed. The full_traversal value ensures that all loose files and forensic images are processed, including their contents.

Any number and combination of parameters can be submitted in the request. If you find that you use consistent processor settings when performing ingestions, an external processing profile can also be used to supply the settings rather than defining them individually within the body of the request.

To use a processing profile, specify the name of the profile using the processingProfile parameter. The profile must exist within the ..\nuix-engine\user-data\Processing Profiles directory of your REST installation.

See the reference documentation for the endpoint to learn more about available parameters.

Check a request’s status

After you perform an ingestion, you can submit another request to get details about the ingestion request.

If you submit a GET request to the /asyncFunctions/{key} endpoint using the returned functionKey, you can retrieve several details about the ingestion request, including:

  • The status of the function.
  • Details about the request.
  • The processing settings used.
  • A summary of the processed data.
curl --location --request GET 'http://localhost:8080/nuix-restful-service/svc/v1/asyncFunctions/72744ec6-6de1-488c-bbec-ff27b64974e3' \
--header 'nuix-auth-token: 49e225d7-b88d-4d1b-9cbc-296e83706a60'

{
    "done": true,
    "cancelled": false,
    "result": true,
    "token": "49e225d7-b88d-4d1b-9cbc-296e83706a60",
    "functionKey": "72744ec6-6de1-488c-bbec-ff27b64974e3",
    "progress": 135591,
    "total": 135591,
    "percentComplete": 100.0000,
    "updatedOn": 1610047993132,
    "status": null,
    "statusId": null,
    "requestTime": 1610047968056,
    "startTime": 1610047968056,
    "finishTime": 1610047996497,
    "caseId": "8ca047e086aa4497bc311ef5cb4bada7",
    "caseName": "MyNuixCase",
    "hasSuccessfullyCompleted": true,
    "friendlyName": "Evidence Ingestion Function",
    "caseLocation": "C:\\ProgramData\\Nuix\\NuixCases\\MyNuixCase",
    "requestor": "user1",
    "action": "AsyncBulkIngestionFunction",
    "options": {
        "reloadQuery": null,
        "processorSettings": {
            "processText": true,
            "processLooseFileContents": null,
            "processForensicImages": null,
            "analysisLanguage": "en",
            "stopWords": null,
            "stemming": null,
            "enableExactQueries": null,
            "extractNamedEntities": null,
            "extractNamedEntitiesFromText": null,
            "extractNamedEntitiesFromProperties": null,
            "extractNamedEntitiesFromTextStripped": null,
            "extractShingles": null,
            "processTextSummaries": null,
            "calculateSSDeepFuzzyHash": null,
            "detectFaces": null,
            "extractFromSlackSpace": null,
            "carveFileSystemUnallocatedSpace": null,
            "carveUnidentifiedData": null,
            "carvingBlockSize": null,
            "recoverDeletedFiles": null,
            "extractEndOfFileSlackSpace": null,
            "smartProcessRegistry": null,
            "identifyPhysicalFiles": null,
            "createThumbnails": null,
            "skinToneAnalysis": null,
            "calculateAuditedSize": null,
            "storeBinary": null,
            "maxStoredBinarySize": null,
            "maxDigestSize": null,
            "digests": [],
            "addBccToEmailDigests": null,
            "addCommunicationDateToEmailDigests": null,
            "reuseEvidenceStores": null,
            "processFamilyFields": null,
            "hideEmbeddedImmaterialData": null,
            "reportProcessingStatus": null,
            "workerItemCallback": null,
            "workerItemCallbacks": null
        },
        "evidence": [
            {
                "guid": null,
                "name": "Evidence Container 2",
                "customMetadata": null,
                "encoding": null,
                "custodian": "Jane Doe",
                "timeZone": null,
                "description": null,
                "locale": null,
                "files": [
                    {
                        "path": "C:/LocationOfData"
                    }
                ],
                "exchangeMailboxes": null,
                "s3Buckets": null,
                "sqlServers": null,
                "enterpriseVaults": null,
                "sharepointSites": null,
                "mailStores": null,
                "loadFiles": null,
                "centeraClusters": null,
                "splitFiles": null,
                "dropboxes": null,
                "sshServers": null
            }
        ],
        "localWorkerCount": 2,
        "repositories": [],
        "parallelProcessingSettings": {
            "workerCount": null,
            "workerMemory": null,
            "workerTemp": null,
            "brokerMemory": null,
            "workerBrokerAddress": null,
            "useRemoteWorkers": false,
            "embedBroker": true
        },
        "rescanEvidenceRepositories": false,
        "loadProcessingJob": {
            "casePath": "C:\\ProgramData\\Nuix\\NuixCases\\MyNuixCase",
            "jobGuid": "989b79fe-43e6-4fa4-9466-19ea3d5ef644",
            "processingMode": "Load",
            "startDate": 1610047968374,
            "workerCount": 2,
            "finished": true,
            "paused": false,
            "masterAddress": "10.20.100.50",
            "bytesProcessed": 135591,
            "itemsProcessed": 12,
            "jobSizeTotalBytes": 135591
        }
    },
    "participatingInCaseFunctionQueue": true,
    "processedBy": "fdfc0544-4421-40df-bbd6-a200371b200d",
    "errorMsg": null
}