Documentation
CasesInvestigation Hub

Triage Packages

Packages uploaded to the case and their processing counts.

Triage Packages lists every package on the case.

Each row shows pending, running, done, and failed counts for that package.

Actions

ActionPurpose
CreateStarts the same wizard as Upload & Process.
ProcessRuns parsers on selected packages.
UploadAdds files to an existing package.
Folder-boltShows remote share mounts for the package. Active means the share is mounted.
Download / deleteExport or remove package files.

Triage packages table

Process selected packages

  1. Select one or more packages.
  2. Click Process.
  3. Select parsers and submit.

Process dialog

Remote shares

Share mounts

Deactivate or delete a mount when processing is finished. Keeping a writable mount increases the risk of overwriting evidence.