Learn how Sfile works with you and your data.
Because most incoming inquiries about our technology are from the most knowledgeable professionals in the industry, we have decided to provide our readers with a basic, but comprehensive, list of 
frequently asked questions.
We hope you all find it insightful.
1. What is the best delivery method to send data to Sfile?
Sfile is flexible and encourages several delivery methods.
Upload it. Depending on the type and size of data, Internet and bandwidth connection, and the type of operating system, Sfile partners may send the data via a WebDav upload as a container file (ZIP, RAR, TAR, 7z, etc). A WebDav upload will require prior approval by an engagement manager who will set up a workspace for uploads.
Ship it. The most popular method for delivery is shipping the data directly to our processing center via a secured delivery service provider (FedEx, UPS, etc.). Make sure it is securely wrapped and upon receipt, a full Chain of Custody will be created to track the possession, movement, handling and location of data.
Personally deliver it. If you are near one of our processing centers, a good way to deliver data is to personally stop by. We always encourage partners to stop by and say hello.
2. What is the preferred format for email databases to be delivered in?
PST files. To eliminate issues such as the .NET Garbage Collector COM bug which can undetectably remove data such as senders, attachments or links, Sfile prefers to work mainly with PST files. To help partners understand this issue further, Sfile has introduced the exception handling logic for inspecting all msg files and is continually rolling out new reports to help our partner and user community identify and understand potential risk issues.
3. Are there any limitations as to how ESI can be received at Sfile?
No. Physically, there are no limitations in sending ESI to Sfile. ESI can be sent in hard drives, CDs/DVDs, thumb drives, etc. We can handle them all.
Sfile supports hundreds of different files and is able to configure its proprietary processing engines to ingest most kinds of data. However, as a matter of policy, file types such as ghost images are not supported as they are not regarded as sound forensic images. Certain files such as NSF files are supported natively and but require conversion to PST format by Sfile partners or by Sfile itself. EDB files should be converted to PST prior to shipment to assure priority handling.
4. What kind of load files can be imported into Sfile?
Common load files such Summation, Concordance, and LFPs can be easily imported into Sfile with no problem. Other types of load files can also be easily converted if necessary.
5. How is metadata retained? What metadata is visible to the user?
The metadata fields are captured by the Sfile ESI analysis process and through full-text indexing. Column field listings display Name, Type, Date, Author, Source and Size. Additionally, all metadata is available through full text and filtered searches with display in the preview window.
6. How does Sfile extract and process ESI from compressed archives, “ghosted” images, EnCase or FTK evidence files, and loose native files?
Once data is received at Sfile, a copy of the data is preserved in Sfile’s hosting environment. This ensures a backup copy of the data before extraction and processing.
By extracting through industry standard tools and protocols, Sfile extracts from compressed archives (ZIP, RAR, TAR, 7z), image files (Encase, FTK), Email (PST, OST), and loose native files, which are all supported means of import. Because ghost images are not forensically sound, they are not directly supported by Sfile.
7. What does the Sfile "standard processing" include exactly?
Sfile standard processing includes extraction of PST files, ESI analysis, deDuplication, de-NISTing and indexing.
8. What is post-processing?
Post-processing refers to the processing of exception files after consultation with Sfile partner.
9. What types of files does Sfile process?
Sfile processes and analyzes hundreds of different file types from data stores and network file shares including Microsoft Office and PDF documents, various email formats such as PST, NSF, MBOX, OST, and EMLX, attachments, and Guidance Software and FTK images. Sfile translates text in image files to searchable content with integrated OCR and identifies non-searchable image files that require OCR.
10. Can Sfile only host data when there is no need to process?
Yes. Sfile can ingest data for hosting only when there is no need to process. However, all data that is imported does go through our ESI Analysis and processing engines for normalization and optimization, with no additional time lapse.
11. Which load file types are considered "standard" and which ones are "custom"?
Standard load files include either Summation or Concordance files with standard metadata fields. Other standard load files can be generated for other platforms simply by providing Sfile with requested specifications. Custom load files with non-standard fields can be provided upon request.
12. What are Sfile’s de-duplication methodologies and processes, and means of testing? Is de-duplication conducted within custodian (vertical) or across custodians (horizontal)?
Standard deduping processes are as follows:
- Non-Message files (Word, Excel, PowerPoint, and other user files) are performed by comparing the MD5 Hash code of the entire binary file.
- Message files (msg, eml) are performed by comparing the MD5 Hash code of a series of metadata including, Sender, Recipient(s), CC, Message Subject, Message Sent DateTime, Message Body, and the Message Attachments.
De-duplication can either be done at the Custodian level or Globally across the entire data set. Custodians are assigned a unique identifier for reference in the DeDuplication reports.
For means of testing, users are able to view duplicate document families while previewing a document and are able to apply review determinations to one, multiple, or all duplicate items with a single operation.
13. What is Sfile’s methodology and timing for reporting and resolving exception files?
Sfile provides full exception reporting and consulting. Since Sfile’s proprietary High Computing Processing engine processes files at unprecedented speeds, Sfile is able to capture and report exception files within a short time of receiving data.
Sfile identifies through exception reports all documents that cannot be automatically processed. Sfile will then consult with partners to determine whether to attempt to manually process these documents or keep them in the system as exceptions.
14. What is Sfile’s ability to preserve full folder structure for ESI received as part of a container file or as loose ESI?
Sfile is capable of handling long path file names in excess of 255 characters commonly found in Windows 98 and prior versions.
15. How does Sfile handle metadata for productions?
Standard metadata for both Native and Tiff/PDF productions will be included in a load file. For requested, non-standard metadata fields, Sfile will consult with the partner to create a customized production load file.
16. During review, are users able to break documents directly online?
Based on the user’s security rights, users are able to break PDF documents while viewing with the Idox universal document viewer.
We hope these answers will bring up interesting follow up questions. We encourage you to contact us to learn more about our processes.
