Skip to main content

Reviewing Collections

When a collection completes, it needs analyst review before delivery. This guide covers the review process.

Collection Lifecycle​

pending → validating_creds → queued → in_progress → completed → reviewing → signed_off → delivered

Collections needing review (status reviewing) are surfaced on the dashboard's "Needs Review" banner and can be filtered in the Collections list by the reviewing status.

What to Check​

  1. Completeness: All endpoints ran successfully
  2. File counts: Expected number of files collected
  3. Data integrity: Hash verification passed
  4. Error review: Any failed endpoints explained
  5. Chain of custody: Events logged correctly

Review Process​

Open the collection detail page. The summary is shown on the page itself; View Files, API Logs, and Chain of Custody open dedicated sub-pages.

1. Check Summary​

Review the summary on the collection detail page:

  • Total files collected
  • Total data size
  • Endpoints: completed/failed/total
  • Collection duration

2. Review Files​

Click View Files:

  • List of all collected files
  • File sizes and hashes
  • Source endpoint for each file

3. Review API Logs​

Click API Logs:

  • Every API call made
  • Request/response details
  • Timing information
  • Any errors encountered

4. Review Chain of Custody​

Click Chain of Custody:

  • All events in chronological order
  • Who/what triggered each event
  • Timestamps for audit trail

Verifying Data Integrity​

Each file has:

  • SHA-256 hash: Computed during collection
  • Hash validated: Secondary verification passed
  • Source metadata: Original platform metadata

Verify that:

  • Hash validation shows "Validated"
  • File sizes match expected (not truncated)
  • Metadata is present and complete

Review Checklist​

Before signing off, confirm:

  • All enabled endpoints completed successfully
  • File counts are reasonable for the scope
  • All file hashes show "Validated"
  • No unexpected errors in API logs
  • Chain of custody is complete
  • Any failures are documented

Signing Off​

Sign-off is available for collections in completed, partial, or reviewing status (and is hidden for analyst test collections). Once satisfied with the collection:

  1. Click Sign Off on the collection detail page to open the sign-off page
  2. Work through the review checklist
  3. Add any notes (optional)
  4. Provide your signature
  5. Confirm sign-off

This action:

  • Creates chain of custody event
  • Marks collection for delivery
  • Queues ZIP generation
  • Notifies customer when ready

Handling Issues​

Partial Collections​

If some endpoints failed but data is usable:

  1. Document the failures in notes
  2. Explain what data is missing
  3. Sign off with limitations noted
  4. Customer receives notification of partial data

Failed Collections​

If collection cannot be delivered:

  1. Review failure cause
  2. Check if connector issue or credential issue
  3. Contact customer if new credentials needed
  4. Create new collection after fix

Hash Validation Failures​

If any file shows hash validation failed:

  1. Do NOT sign off
  2. Report the issue
  3. May need to re-run collection
  4. Investigate potential data corruption

Best Practices​

  1. Review promptly - Don't delay customer delivery
  2. Document everything - Add notes for unusual situations
  3. Verify scope - Ensure collected data matches request
  4. Check completeness - All requested data types present
  5. Maintain chain - Sign-off creates permanent record

Next Steps​