Process Data into a Nuix Case

Learn how to ingest data into a Nuix cases.

After acquiring a license and creating a case, you can then begin ingesting data into the case using the Nuix Engine. Nuix RESTful Service provides multiple endpoints that can be used to ingest data from different data sources. These endpoints are described within the Processing category of the Nuix RESTful Service API reference documentation.

Within this topic, you’ll learn how to:

  1. Perform a simple ingestion.
  2. Checking the status of the request.

Ingesting Data into a Case

When processing data into a Nuix case, there are many configurable parameters that can be used to tailor what data is retrieved, how it is processed, where it is stored, and what resources should be used to perform the work. The settings used are often determined by the type of investigation being performed and the level of detail that is required.

Details about these parameters can be found within the reference documentation for the endpoint.

For the purposes of this example, a simple ingestion can be performed by submitting a POST request to the /cases/{caseId}/evidence/file endpoint. This request ingests the contents of a single file or directory into an evidence container within the case using basic processing settings.

curl -L -X POST 'http://127.0.0.1:8080/nuix-restful-service/svc/v1/cases/0eedda2d297046ae8e67fbda9f192df9/evidence/file' \
-H 'nuix-auth-token: 49e225d7-b88d-4d1b-9cbc-296e83706a60' \
-H 'Content-Type: application/json' \
--data-raw '{
  "container": {
    "custodian": "John Doe",
    "name": "Evidence Container 1"
  },
  "target": {
    "path": "C:/LocationOfData"
  },
  "processorSettings": {
    "analysisLanguage" : "en",
    "processText" : true,
    "reportProcessingStatus": "physical_files",
    "traversalScope" : "full_traversal"  
  }
}'
{
    "functionKey": "72744ec6-6de1-488c-bbec-ff27b64974e3",
    "location": "http://127.0.0.1:8080/nuix-restful-service/svc/v1/asyncFunctions/72744ec6-6de1-488c-bbec-ff27b64974e3"
}

In this example, the following parameters are submitted in the body of the request as raw data.

  • custodian: The name of the person who owns the data being ingested.
  • name: The name of the evidence container where the custodian’s data is being ingested.
  • path: The absolute path to the file or directory being ingested.
  • analysisLanguage: The language to use for text analysis when indexing the data.
  • processText: Store and index the text of data items.
  • reportProcessingStatus: Calculates the physical file size of the evidence before ingestion. This data can then be used to report the progress of the ingestion.
  • traversalScope: Indicates what files should be processed. The full_traversal value ensures that all loose files and forensic images are processed, including their contents.

Any number and combination of parameters can be submitted in the request. If you find that you use consistent processor settings when performing ingestions, an external processing profile can also be used to supply the settings rather than defining them individually within the body of the request.

To use a processing profile, specify the name of the profile using the processingProfile parameter. The profile must exist within the ..\nuix-engine\user-data\Processing Profiles directory of your REST installation.

See the reference documentation for the endpoint to learn more about available parameters.

After submitting the request to perform an ingestion, a GET request to the /asyncFunctions/{key} endpoint using the returned functionKey can be used to retrieve details about the ingestion request, including:

  • The status of the function.
  • Details about the request.
  • The processing settings used.
  • A summary of the processed data.
curl --location --request GET 'http://localhost:8080/nuix-restful-service/svc/v1/asyncFunctions/72744ec6-6de1-488c-bbec-ff27b64974e3' \
--header 'nuix-auth-token: 49e225d7-b88d-4d1b-9cbc-296e83706a60'
{
    "done": true,
    "cancelled": false,
    "result": true,
    "token": "49e225d7-b88d-4d1b-9cbc-296e83706a60",
    "functionKey": "72744ec6-6de1-488c-bbec-ff27b64974e3",
    "progress": 135591,
    "total": 135591,
    "percentComplete": 100.0000,
    "updatedOn": 1610047993132,
    "status": null,
    "statusId": null,
    "requestTime": 1610047968056,
    "startTime": 1610047968056,
    "finishTime": 1610047996497,
    "caseId": "8ca047e086aa4497bc311ef5cb4bada7",
    "caseName": "MyNuixCase",
    "hasSuccessfullyCompleted": true,
    "friendlyName": "Evidence Ingestion Function",
    "caseLocation": "C:\\ProgramData\\Nuix\\NuixCases\\MyNuixCase",
    "requestor": "user1",
    "action": "AsyncBulkIngestionFunction",
    "options": {
        "reloadQuery": null,
        "processorSettings": {
            "processText": true,
            "processLooseFileContents": null,
            "processForensicImages": null,
            "analysisLanguage": "en",
            "stopWords": null,
            "stemming": null,
            "enableExactQueries": null,
            "extractNamedEntities": null,
            "extractNamedEntitiesFromText": null,
            "extractNamedEntitiesFromProperties": null,
            "extractNamedEntitiesFromTextStripped": null,
            "extractShingles": null,
            "processTextSummaries": null,
            "calculateSSDeepFuzzyHash": null,
            "detectFaces": null,
            "extractFromSlackSpace": null,
            "carveFileSystemUnallocatedSpace": null,
            "carveUnidentifiedData": null,
            "carvingBlockSize": null,
            "recoverDeletedFiles": null,
            "extractEndOfFileSlackSpace": null,
            "smartProcessRegistry": null,
            "identifyPhysicalFiles": null,
            "createThumbnails": null,
            "skinToneAnalysis": null,
            "calculateAuditedSize": null,
            "storeBinary": null,
            "maxStoredBinarySize": null,
            "maxDigestSize": null,
            "digests": [],
            "addBccToEmailDigests": null,
            "addCommunicationDateToEmailDigests": null,
            "reuseEvidenceStores": null,
            "processFamilyFields": null,
            "hideEmbeddedImmaterialData": null,
            "reportProcessingStatus": null,
            "workerItemCallback": null,
            "workerItemCallbacks": null
        },
        "evidence": [
            {
                "guid": null,
                "name": "Evidence Container 2",
                "customMetadata": null,
                "encoding": null,
                "custodian": "Jane Doe",
                "timeZone": null,
                "description": null,
                "locale": null,
                "files": [
                    {
                        "path": "C:/LocationOfData"
                    }
                ],
                "exchangeMailboxes": null,
                "s3Buckets": null,
                "sqlServers": null,
                "enterpriseVaults": null,
                "sharepointSites": null,
                "mailStores": null,
                "loadFiles": null,
                "centeraClusters": null,
                "splitFiles": null,
                "dropboxes": null,
                "sshServers": null
            }
        ],
        "localWorkerCount": 2,
        "repositories": [],
        "parallelProcessingSettings": {
            "workerCount": null,
            "workerMemory": null,
            "workerTemp": null,
            "brokerMemory": null,
            "workerBrokerAddress": null,
            "useRemoteWorkers": false,
            "embedBroker": true
        },
        "rescanEvidenceRepositories": false,
        "loadProcessingJob": {
            "casePath": "C:\\ProgramData\\Nuix\\NuixCases\\MyNuixCase",
            "jobGuid": "989b79fe-43e6-4fa4-9466-19ea3d5ef644",
            "processingMode": "Load",
            "startDate": 1610047968374,
            "workerCount": 2,
            "finished": true,
            "paused": false,
            "masterAddress": "10.20.100.50",
            "bytesProcessed": 135591,
            "itemsProcessed": 12,
            "jobSizeTotalBytes": 135591
        }
    },
    "participatingInCaseFunctionQueue": true,
    "processedBy": "fdfc0544-4421-40df-bbd6-a200371b200d",
    "errorMsg": null
}
Last modified April 22, 2021