FTK_User_Guide FTK UG

Ftk 5.3.4 User Guide FTK 5.3.4 User Guide FTK 5.3.4 User Guide ad

Ftk Ug FTK_UG FTK_UG 5.3.7 ftk ad

Ftk 5.3.3 Ug FTK 5.3.3 UG FTK 5.3.3 UG ad

2015-04-22

: Pdf Ftk Ug FTK_UG 5.3.8 ftk

Open the PDF directly: View PDF .
Page Count: 507

Download
Open PDF In Browser	View PDF

AccessData
Forensic Toolkit

User Guide

| 1

AccessData Legal and Contact Information

Document date: May 9, 2014

Legal Information
©2014 AccessData Group, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
AccessData Group, Inc. makes no representations or warranties with respect to the contents or use of this
documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any
particular purpose. Further, AccessData Group, Inc. reserves the right to revise this publication and to make
changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.
Further, AccessData Group, Inc. makes no representations or warranties with respect to any software, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, AccessData Group, Inc. reserves the right to make changes to any and all parts of AccessData
software, at any time, without any obligation to notify any person or entity of such changes.
You may not export or re-export this product in violation of any applicable laws or regulations including, without
limitation, U.S. export regulations or the laws of the country in which you reside.

AccessData Group, Inc.
588 W. 400 S.
Suite 350
Lindon, Utah 84042
U.S.A.
www.accessdata.com

AccessData Trademarks and Copyright Information
AccessData®

is a registered trademark of AccessData Group, Inc.

AD

InSight® is a registered trademark of AccessData Group, Inc.

AD

Summation is a registered trademark of AccessData Group, Inc.

Distributed
DNA®

is a registered trademark of AccessData Group, Inc.

Forensic
FTK®

Network Attack® is a registered trademark of AccessData Group, Inc.

Toolkit® is a registered trademark of AccessData Group, Inc.

is a registered trademark of AccessData Group, Inc.

Password
PRTK®

Recovery Toolkit® is a registered trademark of AccessData Group, Inc.

is a registered trademark of AccessData Group, Inc.

Registry

Viewer® is a registered trademark of AccessData Group, Inc.

AccessData Legal and Contact Information

| 2

A trademark symbol (®, ™, etc.) denotes an AccessData Group, Inc. trademark. With few exceptions, and
unless otherwise notated, all third-party product names are spelled and capitalized the same way the owner
spells and capitalizes its product name. Third-party trademarks and copyrights are the property of the trademark
and copyright holders. AccessData claims no responsibility for the function or performance of third-party
products.
Third party acknowledgements:
FreeBSD

AFF®

and AFFLIB® Copyright® 2005, 2006, 2007, 2008 Simson L. Garfinkel and Basis Technology
Corp. All rights reserved.

Copyright

BSD License: Copyright (c) 2009-2011, Andriy Syrov. All rights reserved. Redistribution and use in source and
binary forms, with or without modification, are permitted provided that the following conditions are met:
Redistributions of source code must retain the above copyright notice, this list of conditions and the following
disclaimer; Redistributions in binary form must reproduce the above copyright notice, this list of conditions and
the following disclaimer in the documentation and/or other materials provided with the distribution; Neither the
name of Andriy Syrov nor the names of its contributors may be used to endorse or promote products derived
from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE
COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
WordNet License

This license is available as the file LICENSE in any downloaded version of WordNet.
WordNet 3.0 license: (Download)
WordNet Release 3.0 This software and database is being provided to you, the LICENSEE, by Princeton
University under the following license. By obtaining, using and/or copying this software and database, you agree
that you have read, understood, and will comply with these terms and conditions.: Permission to use, copy,
modify and distribute this software and database and its documentation for any purpose and without fee or
royalty is hereby granted, provided that you agree to comply with the following copyright notice and statements,
including the disclaimer, and that the same appear on ALL copies of the software, database and documentation,
including modifications that you make for internal use or for distribution. WordNet 3.0 Copyright 2006 by
Princeton University. All rights reserved. THIS SOFTWARE AND DATABASE IS PROVIDED "AS IS" AND
PRINCETON UNIVERSITY MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY
WAY OF EXAMPLE, BUT NOT LIMITATION, PRINCETON UNIVERSITY MAKES NO REPRESENTATIONS OR
WARRANTIES OF MERCHANT- ABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE
USE OF THE LICENSED SOFTWARE, DATABASE OR DOCUMENTATION WILL NOT INFRINGE ANY THIRD
PARTY PATENTS, COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS. The name of Princeton University or

AccessData Legal and Contact Information

| 3

Princeton may not be used in advertising or publicity pertaining to distribution of the software and/or database.
Title to copyright in this software, database and any associated documentation shall at all times remain with
Princeton University and LICENSEE agrees to preserve same.

Documentation Conventions
In AccessData documentation, a number of text variations are used to indicate meanings or actions. For
example, a greater-than symbol (>) is used to separate actions within a step. Where an entry must be typed in
using the keyboard, the variable data is set apart using [variable_data] format. Steps that require the user to
click on a button or icon are indicated by Bolded text. This Italic font indicates a label or non-interactive item in
the user interface.
A trademark symbol (®, ™, etc.) denotes an AccessData Group, Inc. trademark. Unless otherwise notated, all
third-party product names are spelled and capitalized the same way the owner spells and capitalizes its product
name. Third-party trademarks and copyrights are the property of the trademark and copyright holders.
AccessData claims no responsibility for the function or performance of third-party products.

Registration
The AccessData product registration is done at AccessData after a purchase is made, and before the product is
shipped. The licenses are bound to either a USB security device, or a Virtual CmStick, according to your
purchase.

Subscriptions
AccessData provides a one-year licensing subscription with all new product purchases. The subscription allows
you to access technical support, and to download and install the latest releases for your licensed products during
the active license period.
Following the initial licensing period, a subscription renewal is required annually for continued support and for
updating your products. You can renew your subscriptions through your AccessData Sales Representative.
Use License Manager to view your current registration information, to check for product updates and to
download the latest product versions, where they are available for download. You can also visit our web site,
www.accessdata.com anytime to find the latest releases of our products.
For more information, see Managing Licenses in your product manual or on the AccessData website.

AccessData Contact Information
Your AccessData Sales Representative is your main contact with AccessData. Also, listed below are the general
AccessData telephone number and mailing address, and telephone numbers for contacting individual
departments.

AccessData Legal and Contact Information

| 4

Mailing Address and General Phone Numbers
You can contact AccessData in the following ways:

AccessData Mailing Address, Hours, and Department Phone Numbers
Corporate Headquarters:

AccessData Group, Inc.
588 W. 400 S.
Suite 350
Lindon, UT 84042 USA
Voice: 801.377.5410; Fax: 801.377.5426

General Corporate Hours:

Monday through Friday, 8:00 AM – 5:00 PM (MST)
AccessData is closed on US Federal Holidays

State and Local
Law Enforcement Sales:

Voice: 800.574.5199, option 1; Fax: 801.765.4370
Email: Sales@AccessData.com

Federal Sales:

Voice: 800.574.5199, option 2; Fax: 801.765.4370
Email: Sales@AccessData.com

Corporate Sales:

Voice: 801.377.5410, option 3; Fax: 801.765.4370
Email: Sales@AccessData.com

Training:

Voice: 801.377.5410, option 6; Fax: 801.765.4370
Email: Training@AccessData.com

Accounting:

Voice: 801.377.5410, option 4

Technical Support
Free technical support is available on all currently licensed AccessData products.
You can contact AccessData Customer and Technical Support in the following ways:
AD Customer & Technical Support Contact Information
AD
SUMMATIONand
AD EDISCOVERY

Americas/Asia-Pacific:
800.786.8369 (North America)
801.377.5410, option 5
Email: legalsupport@accessdata.com

AD IBLAZE and
ENTERPRISE:

Americas/Asia-Pacific:
800.786.2778 (North America)
801.377.5410, option 5
Email: support@summation.com

All other AD
PRODUCTS

Americas/Asia-Pacific:
800.658.5199 (North America)
801.377.5410, option 5
Email: support@accessdata.com

AD
INTERNATIONAL
SUPPORT

Europe/Middle East/Africa:
+44 (0) 207 010 7817 (United Kingdom)
Email: emeasupport@accessdata.com

AccessData Legal and Contact Information

| 5

AD Customer & Technical Support Contact Information (Continued)
Hours of Support:

Americas/Asia-Pacific:
Monday through Friday, 6:00 AM– 6:00 PM (PST), except corporate holidays.
Europe/Middle East/Africa:
Monday through Friday, 8:00 AM– 5:00 PM (UK-London) except corporate holidays.

Web Site:

http://www.accessdata.com/support/technical-customer-support
The Support website allows access to Discussion Forums, Downloads, Previous
Releases, our Knowledge base, a way to submit and track your “trouble tickets”, and
in-depth contact information.

Documentation
Please email AccessData regarding any typos, inaccuracies, or other problems you find with the documentation:
documentation@accessdata.com

Professional Services
The AccessData Professional Services staff comes with a varied and extensive background in digital
investigations including law enforcement, counter-intelligence, and corporate security. Their collective
experience in working with both government and commercial entities, as well as in providing expert testimony,
enables them to provide a full range of computer forensic and eDiscovery services.
At this time, Professional Services provides support for sales, installation, training, and utilization of FTK, FTK
Pro, Enterprise, eDiscovery, and Lab. They can help you resolve any questions or problems you may have
regarding these products

Contact Information for Professional Services
Contact AccessData Professional Services in the following ways:

AccessData Professional Services Contact Information
Contact Method

Number or Address

Phone

Washington DC: 410.703.9237
North America: 801.377.5410
North America Toll Free: 800-489-5199, option 7
International: +1.801.377.5410

adservices@accessdata.com

AccessData Legal and Contact Information

| 6

Table of Contents

AccessData Legal and Contact Information
Table of Contents

. . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7

Part 1: Introducing Forensic Toolkit® (FTK®).

. . . . . . . . . . . . . . . . . . . . . . . 22

Chapter 1: Introducing AccessData® Forensic Toolkit® (FTK®) . . . . . . . . . . . . . . . . . . . . . .
Overview of Investigating Digital Evidence . . . . . . . . . . . . . . . . . . . . . . . . .
About Acquiring Digital Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

23
23
24

Types of Digital Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Acquiring Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

About Examining Digital Evidence . . .
About Managing Cases and Evidence
What You Can Do With the Examiner .

. . . . . . . . . . . . . . . . . . . . . . . . . . . 25
. . . . . . . . . . . . . . . . . . . . . . . . . . . 26
. . . . . . . . . . . . . . . . . . . . . . . . . . . 27

About Indexing and Hashing . . . . . .
About the Known File Filter Database
About Searching . . . . . . . . . . . . .
About Bookmarking . . . . . . . . . . .
About Presenting Evidence . . . . . . .

.
.
.
.
.

Chapter 2: Getting Started with the User Interface

.
.
.
.
.

27
27
28
28
28

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Part 2: Administrating Forensic Toolkit® (FTK®) . .

. . . . . . . . . . . . . . . . . . . 31

Chapter 3: Application Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Creating an Application Administrator Account . . . . . . . . . . . . . . . . . . . . . .
Changing Your Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Recovering a Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

32
33
33
33

Creating a Password Reset File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Resetting your Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Setting Database Preferences . . . . . . . . . . . . . . . . .
Managing Database Sessions . . . . . . . . . . . . . . . . .
Optimizing the Database for Large Cases . . . . . . . . .
Managing Shared KFF Settings . . . . . . . . . . . . . . . .
Recovering and Deleting Processing Jobs . . . . . . . . .
Restoring an Image to a Disk . . . . . . . . . . . . . . . . .
Database Integration with other AccessData Products .
Table of Contents

. . . . . . . . . . . . . . . . 35
. . . . . . . . . . . . . . . . 35
. . . . . . . . . . . . . . . . 35
. . . . . . . . . . . . . . . . 36
. . . . . . . . . . . . . . . . 36
. . . . . . . . . . . . . . . . 37
. . . . . . . . . . . . . . . . 37

| 7

Adding New Users to a Database
About Assigning Roles to Users . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Assigning Initial Database-level Roles to Users . . . . . . . . . . . . . . . . . . . . 39
Assigning Additional Case-level Roles to Users . . . . . . . . . . . . . . . . . . . 39

Restrictions to the Case Reviewer Role
About Assigning Permissions to Users .
Assigning Users Shared Label Visibility.
Setting Additional Preferences . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . 40
. . . . . . . . . . . . . . . . . . . . . . . . . . 41
. . . . . . . . . . . . . . . . . . . . . . . . . . 41
. . . . . . . . . . . . . . . . . . . . . . . . . . 42

Choosing a Temporary File Path . . . . . . . . . . . . . .
Providing a Network Security Device Location . . . . . .
Setting Theme Preferences for the Visualization Add on
Optimizing the Case Database. . . . . . . . . . . . . . . .

Managing Global Features

.
.
.
.

42
42
42
42

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Managing Shared Custom Carvers
Managing Custom Identifiers . . . .
Managing Columns . . . . . . . . .
Managing File Extension Maps . .
Managing Filters . . . . . . . . . . .

Part 3: Case Management .

.
.
.
.

.
.
.
.
.

43
44
44
44
45

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Chapter 4: Introducing Case Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About Case Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
The User Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About the Cases List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Menus of the Case Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Menus of the Examiner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Chapter 5: Creating and Configuring New Cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Opening an Existing Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Creating a Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Configuring Detailed Options for a Case . . . . . . . . . . . . . . . . . . . . . . . . . .

Configuring Evidence Processing Options . . . . . .
About Processing Options . . . . . . . . . . . . . . .
Configuring Default Processing Options for a Case
Using Processing Profiles . . . . . . . . . . . . . . .
Manually Customizing a set of Detailed Options . .

Evidence Processing Options

.
.
.
.
.

49
50
56

68
69
70
70
70
71
72
75

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

Expanding Compound Files . . . . . . . . . . . .
Using dtSearch Text Indexing . . . . . . . . . . .
Configuring Case Indexing Options . . . . . . . .
Data Carving . . . . . . . . . . . . . . . . . . . . .
Running Optical Character Recognition (OCR) .

Table of Contents

.
.
.
.
.

48
48

.
.
.
.
.

79
81
82
84
89

| 8

Using Explicit Image Detection . . . . . . . . . . . . . .
Including Registry Reports . . . . . . . . . . . . . . . . .
Send Email Alert on Job Completion . . . . . . . . . . .
Custom File Identification Options . . . . . . . . . . . . .
Creating Custom File Identifiers . . . . . . . . . . . . . .
Configuring Evidence Refinement (Advanced) Options
Refining Evidence by File Status/Type . . . . . . . . . .
Selecting Index Refinement (Advanced) Options . . . .
Selecting Lab/eDiscovery Options . . . . . . . . . . . .

Adding Evidence to a New Case

.
.
.
.
.
.
.
.
.

90
91
91
91
92
94
94
96
98

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

Working with Volume Shadow Copies . . . . . . . . . . . . . . . . . . . . . . . . 100

Converting a Case from Version 2.2 or Newer

. . . . . . . . . . . . . . . . . . . . . 100

Chapter 6: Managing Case Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Backing Up a Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

101
101

Performing a Backup and Restore on a Two-Box Installation. . . . . . . . . . . 101
Performing a Backup of a Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

Archiving a Case . . . . . . . . . .
Archiving and Detaching a Case
Attaching a Case . . . . . . . . . .
Restoring a Case . . . . . . . . . .
Deleting a Case . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

Storing Case Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

Migrating Cases Between Database Types

. . . . . . . . . . . . . . . . . . . . . . . 106

Chapter 7: Working with Evidence Image Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Verifying Drive Image Integrity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Mounting an Image to a Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Benefits of Image Mounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Characteristics of a Logically Mounted Image . . . . . . . . . . . . . . . . . . . . . . 109
Characteristics of a Physically Mounted Image . . . . . . . . . . . . . . . . . . . . . 109
Mounting an Image as Read-Only . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Mounting a Drive Image as Writable . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Unmounting an Image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111
Restoring an Image to a Disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111
Performing Final Carve Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111
Recovering Processing Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Chapter 8: Working with Static Evidence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Static Evidence Compared to Remote Evidence .
Acquiring and Preserving Static Evidence . . . . .
Adding Evidence . . . . . . . . . . . . . . . . . . . . .
Working with Evidence Groups . . . . . . . . . . . .
Table of Contents

113

. . . . . . . . . . . . . . . . . . . 113
. . . . . . . . . . . . . . . . . . . 114
. . . . . . . . . . . . . . . . . . . 114
. . . . . . . . . . . . . . . . . . . 117

| 9

Selecting Evidence Processing Options . .
Selecting a Language . . . . . . . . . . . . . .
Examining Data in Volume Shadow Copies

. . . . . . . . . . . . . . . . . . . . . . . 118
. . . . . . . . . . . . . . . . . . . . . . . 119
. . . . . . . . . . . . . . . . . . . . . . . 120

About Restore Point Processing Options . . . . . . . . . . . . . . . . . . . . . . 121
Managing Restore Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Viewing Restore Point Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

Using Additional Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Hashing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Carving . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Viewing the Status and Progress of Data Processing and Analysis .
Viewing Processed Items . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . 124
. . . . . . . 128
. . . . . . . 128
. . . . . . . 130
. . . . . . . 131

Chapter 9: Working with Live Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About Live Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

133
133

Types of Live Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
Adding Local Live Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

Methods of Adding Remote Live Evidence .

. . . . . . . . . . . . . . . . . . . . . . . 135

Requirements for Adding Remote Live Evidence . . . . . . . . . . . . . . . . . . 135

Adding Evidence with the Temporary Agent .

. . . . . . . . . . . . . . . . . . . . . . 136

Pushing the Temporary Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
Manually Deploying the Temporary Agent . . . . . . . . . . . . . . . . . . . . . . 137

Adding Data with the Enterprise Agent

. . . . . . . . . . . . . . . . . . . . . . . . . . 138

Methods of Deploying the Enterprise Agent . . . . . . . . . . . . . . .
Creating Self-signed Certificates for Agent Deployment . . . . . . . .
Configuring Communication Settings for the Enterprise Agent Push
Pushing the Enterprise Agent . . . . . . . . . . . . . . . . . . . . . . .
Removing the Enterprise Agent . . . . . . . . . . . . . . . . . . . . . .
Connecting to an Enterprise Agent . . . . . . . . . . . . . . . . . . . .
Adding Remote Data with the Enterprise Agent . . . . . . . . . . . . .
Acquiring Drive Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Acquiring RAM Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Importing Memory Dumps . . . . . . . . . . . . . . . . . . . . . . . . .
Unmounting an Agent Drive or Device . . . . . . . . . . . . . . . . . .

.
.
.
.
.
.
.
.
.
.
.

138
138
139
140
140
141
141
143
144
144
145

Chapter 10: Filtering Data to Locate Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

146
146

Types of Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
What You Can Do with Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

Understanding How Filters Work

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Viewing the Components of Filters . . . . . . . . . . . . . . . . . . . . . . . . . . 149
Viewing Details about Attributes that Filters use . . . . . . . . . . . . . . . . . . 149

Using Simple Filtering

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Using Global Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Table of Contents

| 10

Using Tab Filters . . . . . . . . . . . . . . . . . . . . . . .
How Global Filters and Tab Filters can work Together .
Using Filters with Category Containers . . . . . . . . . .
Using Filters with Reports. . . . . . . . . . . . . . . . . .
Viewing the Filters that you have Applied . . . . . . . .

Using Filtering with Searches

.
.
.
.
.

150
151
151
151
152

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153

Adding a Search Filter to a Live Searches . . . . . . . . . . . . . . . . . . . . . . 153
Adding a Search Filter to an Index Searches . . . . . . . . . . . . . . . . . . . . 153

Using Compound Filters.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

Applying Compound Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

Using Custom Filters .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

About Nested Filters . . .
Creating a Custom Filter
Copying Filters . . . . . .
Editing a Custom Filter .

.
.
.
.

Sharing, Importing, and Exporting Filters .

.
.
.
.

155
155
156
156

. . . . . . . . . . . . . . . . . . . . . . . . 157

Sharing Custom Filters Between Cases . . . . . . . . . . . . . . . . . . . . . . . 157
Importing Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Exporting Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

Types of Predefined Filters .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

Chapter 11: Working with Labels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
What You Can Do With Labels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Creating a Label . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Applying a Label . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Managing Labels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Managing Label Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 12: Decrypting Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About Decrypting Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

163
163
164
164
165
166
167
167

About the Encrypted File Passwords List . . . . . . . . . . . . . . . . . . . . . . 169

Identifying the Encrypted Files in a Case .
Using PRTK/DNA Integration . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . 171
. . . . . . . . . . . . . . . . . . . . . . . . 172

Decrypting Files Using the Automatic Decryption Processing Option . . . . . . 172
Decrypting Files Using Right-Click Auto Decryption . . . . . . . . . . . . . . . . 173

Recovering Unknown Passwords of Encrypted Files

. . . . . . . . . . . . . . . . . 174

About Recovering Passwords using the PRTK/DNA Integrated Tool with Examiner
174

Recovering Passwords using the PRTK/DNA Integrated Tool . . . . . . . . . . 174

Decrypting Other Encryption Types

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

Decrypting EFS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Decrypting Microsoft Office Digital Rights Management (DRM) Protected Files 177
Decrypting Lotus Notes Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

Table of Contents

| 11

Decrypting S/MIME Files . . . . . . . .
Decrypting Credant Files . . . . . . . .
Decrypting Bitlocker Partitions . . . . .
Decrypting Safeguard Utimaco Files .
Decrypting SafeBoot Files . . . . . . .
Decrypting Guardian Edge Files . . . .
Decrypting an Image Encrypted With
PGP® WDE . . . . . . . . . . . . .

Viewing Decrypted Files .

.
.
.
.
.
.

. . . . . . . . . . . . . . . . . . . . . . . . 184

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Chapter 13: Exporting Data from the Examiner. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Copying Information from the Examiner . . . . . . . . . . . . . . . . . . . . . . . . .
Exporting Files to a Native Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Exporting Files to an AD1 Image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Exporting an Image to an Image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Exporting File List Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Exporting a Word List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Exporting Recycle Bin Index Contents . . . . . . . . . . . . . . . . . . . . . . . . . .
Exporting Hashes from a Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Exporting Custom Groups from the KFF Library . . . . . . . . . . . . . . . . . . . .
Exporting All Hits in a Search to a CSV file . . . . . . . . . . . . . . . . . . . . . . .
Exporting Emails to PST . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 14: About Cerberus Malware Analysis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About Cerberus Malware Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About Cerberus Stage 1 Threat Analysis . . . . . . . . . . . . . . . . . . . . . . . . .
About Cerberus Score Weighting . . .
About Cerberus Override Scores . . .
About Cerberus Threat Score Reports
Cerberus Stage 1 Threat Scores . . .
Cerberus Stage 1 File Information . . .

About Cerberus Stage 2 Static Analysis.

.
.
.
.
.

187
187
189
191
193
195
196
196
197
197
198
199
200
200
201
201
201
202
204
206

. . . . . . . . . . . . . . . . . . . . . . . . . 207

About Cerberus Stage 2 Report Data . . .
Cerberus Stage 2 Function Call Data . . .
File Access Call Categories . . . . . . . .
Networking Functionality Call Categories
Process Manipulation Call Categories . .
Security Access Call Categories . . . . .
Windows Registry Call Categories . . . .
Surveillance Call Categories . . . . . . . .
Uses Cryptography Call Categories . . . .
Low-level Access Call Categories . . . . .
Loads a driver Call Categories . . . . . . .

Table of Contents

178
179
181
182
184
184

.
.
.
.
.
.
.
.
.
.
.

207
208
209
211
213
214
214
215
215
216
216

| 12

Subverts API Call Categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

Chapter 15: Running Cerberus Malware Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Running Cerberus Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About Reviewing Results of Cerberus . . . . . . . . . . . . . . . . . . . . . . . . . . .

217
217
219

Cerberus Columns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

Reviewing Results of Cerberus . . .
Using Index Search with Cerberus .
Exporting a Cerberus Report . . . .

Part 4: Reviewing Cases

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
. . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
. . . . . . . . . . . . . . . . . . . . . . . . . . . . 222

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223

Chapter 16: Using the Examiner Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About the Examiner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Creating Screen Captures in the Examiner . . . . . . . . . . . . . . . . . . . . . . .
Chapter 17: Exploring Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Explorer Tree Pane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
File List Pane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
The File Content Viewer Pane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
The Filter Toolbar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using QuickPicks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Caching Data in the File List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 18: Examining Evidence in the Overview Tab
Using the Overview Tab . . . . . . . . . . . . . . . .
Evidence Groups Container
File Items Container . . . . .
File Extension Container . .
File Category Container . . .
File Status Container . . . .

.
.
.
.
.

224
224
225
226
226
227
233
241
242
243

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
. . . . . . . . . . . . . . . . . . . . 244
.
.
.
.
.

.
.
.
.
.

244
244
245
245
246

Chapter 19: Examining Email . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using the Email Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

248
248

Email Status Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Email Archives Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Email Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

Chapter 20: Examining Graphics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using the Graphics Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

250
250

The Thumbnails Size Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
Moving the Thumbnails Pane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
Table of Contents

| 13

Evaluating Explicit Material .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Filtering EID Material . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
EID Scoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254

Using PhotoDNA to Compare Images .

. . . . . . . . . . . . . . . . . . . . . . . . . . 256

About Using PhotoDNA . . . . . . . . . . . . . . . .
About the PhotoDNA Library Management Page .
About the PhotoDNA Processing Option . . . . . .
About viewing the PhotoDNA results . . . . . . . .
Configuring a PhotoDNA Library . . . . . . . . . .
Comparing Images to the PhotoDNA Library . . .

.
.
.
.
.
.

256
256
256
257
257
258

Chapter 21: Examining Videos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Generating Thumbnails for Video Files . . . . . . . . . . . . . . . . . . . . . . . . . .
Creating Common Video Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using the Video Tree Pane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using the Video Thumbnails Pane . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Playing a Video from a Video Thumbnail . . . . . . . . . . . . . . . . . . . . . . . . .
The Thumbnail Size Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Moving the Thumbnails Pane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

260

Chapter 22: Examining Miscellaneous Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Identifying Processing-Generated Data . . . . . . . . . . . . . . . . . . . . . . . . . .
Relating Generated Files to Original Files . . . . . . . . . . . . . . . . . . . . . . . .
Viewing Windows Prefetch Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Viewing Data in Windows XML Event Log (EVTX) Files . . . . . . . . . . . . . . .

261
263
264
265
265
266
266
267
268
268
269
269

About Viewing EVTX Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269

Viewing IIS Log File Data . . . . . . . .
Viewing Registry Timeline Data . . . .
Viewing Log2Timeline CSV File Data
Identifying Document Languages . . .
Examining Internet Artifact Data . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . 271
. . . . . . . . . . . . . . . . . . . . . . . . . . . 273
. . . . . . . . . . . . . . . . . . . . . . . . . . . 275
. . . . . . . . . . . . . . . . . . . . . . . . . . . 278
. . . . . . . . . . . . . . . . . . . . . . . . . . . 280

About Extensible Storage Engine (ESE) Databases . . . . . . . . . . .
About Expanding Google Chrome and IE 9 Data . . . . . . . . . . . . .
About Expanding Data from Internet Explorer (IE) Version 10 or Later
Expanding Internet Artifact Data . . . . . . . . . . . . . . . . . . . . . . .
Viewing Internet Artifact Data . . . . . . . . . . . . . . . . . . . . . . . .

Performing Cluster Analysis . . . . . . . . .
Viewing Data in Volume Shadow Copies .

.
.
.
.
.

281
282
283
285
285

. . . . . . . . . . . . . . . . . . . . . . . . 287
. . . . . . . . . . . . . . . . . . . . . . . . 288

Chapter 23: Bookmarking Evidence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About Bookmarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

290
290

About Timeline Bookmarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291

Table of Contents

| 14

Creating a Bookmark . . . . . . .
Bookmarks Dialog Options . . .
Viewing Bookmark Information

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295

Creating a Timeline Bookmark Report . . . . . . . . . . . . . . . . . . . . . . . . 295

Using the Bookmarks Tab . . . . . . . . . . . . . . . . . . . . . . . .
Bookmarking Selected Text . . . . . . . . . . . . . . . . . . . . . .
Adding to an Existing Bookmark . . . . . . . . . . . . . . . . . . .
Creating Email or Email Attachment Bookmarks . . . . . . . . .
Adding Email and Email Attachments to Existing Bookmarks
Moving a Bookmark . . . . . . . . . . . . . . . . . . . . . . . . . . .
Copying a Bookmark . . . . . . . . . . . . . . . . . . . . . . . . . . .
Deleting a Bookmark . . . . . . . . . . . . . . . . . . . . . . . . . . .
Deleting Files from a Bookmark . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . 296
. . . . . . . . . . . 297
. . . . . . . . . . . 297
. . . . . . . . . . . 298
. . . . . . . . . . . 298
. . . . . . . . . . . 299
. . . . . . . . . . . 299
. . . . . . . . . . . 299
. . . . . . . . . . . 299

Chapter 24: Searching Evidence with Live Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Conducting a Live Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Live Text Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Live Hex Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Live Pattern Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

300
300
301
303
304

Using Pattern Searches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304

Predefined Regular Expressions

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307

Social Security Number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
U.S. Phone Number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
IP Address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308

Creating Custom Regular Expressions

. . . . . . . . . . . . . . . . . . . . . . . . . . 309

Chapter 25: Searching Evidence with Index Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Conducting an Index Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using Search Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Expanding Search Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Defining Search Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Exporting and Importing Index Search Terms . . . . . . . . . . . . . . . . . . . . . .
Selecting Index Search Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Viewing Index Search Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using dtSearch Regular Expressions . . . . . . . . . . . . . . . . . . . . . . . . . . .

311
312
313
313
314
314
315
316
317

TR1 Regular Expressions For Text Patterns . . . . . . . . . . . . . . . . . . . . . 317
TR1 Regular Expressions For Number Patterns . . . . . . . . . . . . . . . . . . 321

Documenting Search Results . . . . . . . . . . . . .
Using Copy Special to Document Search Results
Bookmarking Search Results . . . . . . . . . . . . .

Table of Contents

. . . . . . . . . . . . . . . . . . . 323
. . . . . . . . . . . . . . . . . . . 324
. . . . . . . . . . . . . . . . . . . 325

| 15

Chapter 26: Examining Volatile Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using the Volatile Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Viewing Memory Dump Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

326
327
329
330

Viewing Hidden Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330
Viewing Input/Output Request Packet Data . . . . . . . . . . . . . . . . . . . . . 330
Viewing Virtual Address Descriptor (VAD) Data . . . . . . . . . . . . . . . . . . . 330

Performing File Remediation from the Volatile Tab. . . . . . .
Killing a Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Wiping a File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Adding Hashes to KFF Library from the Volatile Tab . . . . .
Adding Hashes to Fuzzy Hash Library from the Volatile Tab
Creating a Memory Dump File . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . 332
. . . . . . . . . . . . 332
. . . . . . . . . . . . 333
. . . . . . . . . . . . 333
. . . . . . . . . . . . 334
. . . . . . . . . . . . 334

Chapter 27: Using Visualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About Visualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Launching Visualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About the Visualization page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About Visualization Time Line Views . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About the Base Time Line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

335
335
336
337
338
338

Setting the Base Time Line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340

Changing the View of Visualization .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 341

Modifying the Bar Chart Displays . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
Changing the Theme of Visualization . . . . . . . . . . . . . . . . . . . . . . . . . 341

Visualizing File Data

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342

Configuring Visualization File Dates .
Visualizing File Extension Distribution
Visualizing File Category Distribution .
Using the File Data List . . . . . . . . .

Visualizing Email Data .

.
.
.
.

342
343
345
346

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349

Narrowing the Scope with the Email Time Line . . . . . . . . . . . . . . . . . . . 349
Viewing Mail Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
Using the Email Details List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351

About the Detailed Visualization Time Line
Using the Detailed Visualization Time Line .

. . . . . . . . . . . . . . . . . . . . . . . 355
. . . . . . . . . . . . . . . . . . . . . . . 356

Understanding How Data is Represented in the Detailed Time Line . . . . .
About Time Bands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Modifying the Time Line Using Time Bands and Zoom . . . . . . . . . . . . .
Understanding How Grouping Works in the Detailed Visualization Time Line

Visualizing Browser History Data.
Visualizing Other Data . . . . . . . .

Table of Contents

.
.
.
.

356
357
359
359

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361

| 16

Chapter 28: Using Visualization Heatmap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

362

Chapter 29: Using Visualization Social Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About Social Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

364

Accessing Social Analyzer . . . . . . . . . . .
Social Analyzer Options . . . . . . . . . . . . .
Analyzing Email Domains in Visualization . .
Analyzing Individual Emails in Visualization .

.
.
.
.

364

.
.
.
.

366
367
368
368

Chapter 30: Using Visualization Geolocation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About Geolocation Visualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

369
369

Geolocation Workflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369
Geolocation Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369

Viewing Geolocation EXIF Data . . . . . .
Viewing Geolocation IP Locations Data .
Geolocation Panel . . . . . . . . . . . . . .
Geolocation Columns . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . 371
. . . . . . . . . . . . . . . . . . . . . . . . . 372
. . . . . . . . . . . . . . . . . . . . . . . . . 373
. . . . . . . . . . . . . . . . . . . . . . . . . 376

Using Geolocation Column Templates . . . . . . . . . . . . . . . . . . . . . . . . 378

Geolocation Facets .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378

Chapter 31: Customizing the Examiner Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About Customizing the Examiner User Interface . . . . . . . . . . . . . . . . . . . .
The Tab Layout Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Moving View Panels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Creating Custom Tabs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Managing Columns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Customizing File List Columns . . . . . . . . . . . . . . . . . . . .
Creating User-Defined Custom Columns for the File List view .
Deleting Custom Columns . . . . . . . . . . . . . . . . . . . . . .
Navigating the Available Column Groups . . . . . . . . . . . . .

.
.
.
.

379
380
381
383
384

.
.
.
.

384
385
387
387

Chapter 32: Working with Evidence Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Creating a Case Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Adding Case Information to a Report . . . . . . . . . . . . . . . . . . . . . . . . . . .
Adding Bookmarks to a Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Adding Graphics Thumbnails and Files to a Report . . . . . . . . . . . . . . . . . .
Adding a Video to a Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Adding a File Path List to a Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Adding a File Properties List to a Report . . . . . . . . . . . . . . . . . . . . . . . . .
Adding Registry Selections to a Report . . . . . . . . . . . . . . . . . . . . . . . . . .
Adding Screen Captures from Examiner . . . . . . . . . . . . . . . . . . . . . . . . .
Selecting the Report Output Options. . . . . . . . . . . . . . . . . . . . . . . . . . . .

389

Table of Contents

.
.
.
.

379

390
391
392
393
394
395
396
397
398
399

| 17

Customizing the Report Graphic

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400

Using Cascading Style Sheets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400

Viewing and Distributing a Report . . . . .
Modifying a Report . . . . . . . . . . . . . . .
Exporting and Importing Report Settings .
Writing a Report to CD or DVD . . . . . . .

Part 5: Reference

. . . . . . . . . . . . . . . . . . . . . . . . 401
. . . . . . . . . . . . . . . . . . . . . . . . 402
. . . . . . . . . . . . . . . . . . . . . . . . 402
. . . . . . . . . . . . . . . . . . . . . . . . 403

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404

Chapter 33: Using the Known File Filter (KFF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About KFF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

405
405

About KFF Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405

Process for Using KFF .
Configuring KFF Data .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407

About the KFF Admin page . . . . . . . . . . . . . . .
Importing KFF Data . . . . . . . . . . . . . . . . . . .
Manually Configuring KFF Libraries and Hash Sets
Adding and Managing KFF Hashes in a Library . .
Using KFF Groups . . . . . . . . . . . . . . . . . . . .
Managing KFF Groups . . . . . . . . . . . . . . . . .
Exporting KFF Groups. . . . . . . . . . . . . . . . . .

Configuring KFF Templates for Use in Cases .

.
.
.
.
.
.
.

407
409
410
411
414
415
415

. . . . . . . . . . . . . . . . . . . . . 416

About KFF Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416
Creating KFF Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416
Managing KFF Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417

Enabling KFF for a Case

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418

About Enabling and Configuring KFF . . . . . . . . . . . . . . . . . . . . . . . . . 418
Enabling and Configuring KFF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418

Reviewing KFF Results in a Case

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419

About KFF Data Shown in the Item List . . . . . . . . . . . . . . . . . . . . . . . 419
About KFF Filters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419
Using the KFF Information Quick Columns . . . . . . . . . . . . . . . . . . . . . 419

Viewing KFF Import Data Logs

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 420

Chapter 34: Installing KFF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
About KFF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Introduction to the KFF Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . .

424
424
424

Components of KFF Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425
About KFF Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426

How KFF Works . . . . . . . . . . . . . . . .
About the KFF Server and Geolocation .
Installing the KFF Server . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . 427
. . . . . . . . . . . . . . . . . . . . . . . . . 429
. . . . . . . . . . . . . . . . . . . . . . . . . 430

About Installing the KFF Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430
Table of Contents

| 18

About the KFF Server Application versions . . . . . . . . . . . . . . . . . . . . . 430
Installing the KFF Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431
Installing the KFF Server for CIRT2.x . . . . . . . . . . . . . . . . . . . . . . . . . 432

Configuring KFF Settings .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433

Configuring KFF Server Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . 433
Configuring the Location of the KFF Server . . . . . . . . . . . . . . . . . . . . . 435

Installing Pre-defined KFF Data Libraries.

. . . . . . . . . . . . . . . . . . . . . . . . 437

About Installing the NIST NSRL Data . .
Installing the NSRL Data Library. . . . .
Installing the NDIC Hashkeeper Library
Installing the DHS Library . . . . . . . . .
Installing the Geolocation (GeoIP) Data

Installing KFF Updates .
KFF Reference . . . . . .

.
.
.
.
.

437
437
438
438
438

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 440
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441

KFF Pre-Defined Hash Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441
Higher Level KFF Structure and Usage . . . . . . . . . . . . . . . . . . . . . . . 444
Hash Set Categories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445

Chapter 35: Working with Windows Registry Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Understanding the Windows Registry . . . . . . . . . . . . . . . . . . . . . . . . . . .
Windows 9x Registry Files . . . . . . . . . . . . .
Windows NT and Windows 2000 Registry Files
Windows XP Registry Files . . . . . . . . . . . . .
Possible Data Types . . . . . . . . . . . . . . . . .
Additional Considerations . . . . . . . . . . . . . .

Windows XP Registry Quick Find Chart.
System Information . .
Networking . . . . . . .
User Data . . . . . . . .
User Application Data .

.
.
.
.

.
.
.
.
.

446
446
447
447
448
449
449

. . . . . . . . . . . . . . . . . . . . . . . . . 451
.
.
.
.

.
.
.
.

Chapter 36: Supported File Systems and Drive Image Formats
File Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Whole Disk Encrypted Products . . . . . . . . . . . . . . . . .
Hard Disk Image Formats. . . . . . . . . . . . . . . . . . . . .
CD and DVD Image Formats. . . . . . . . . . . . . . . . . . .

.
.
.
.

451
452
452
453

. . . . . . . . . . . . . . . . . . . . . 454
. . . . . . . . . . . . . . 454
. . . . . . . . . . . . . . 455
. . . . . . . . . . . . . . 455
. . . . . . . . . . . . . . 456

Chapter 37: Recovering Deleted Material . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
FAT 12, 16, and 32 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
NTFS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Ext2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Ext3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
HFS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

458

Table of Contents

| 19

457
457
458
458
458

Chapter 38: Managing Security Devices and Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Installing and Managing Security Devices . . . . . . . . . . . . . . . . . . . . . . . .
Installing LicenseManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Starting LicenseManager . . . . . . . . . .
Using LicenseManager . . . . . . . . . . .
Updating Products . . . . . . . . . . . . . .
Sending a Dongle Packet File to Support

Virtual CodeMeter Activation Guide

.
.
.
.

Network License Server (NLS) Setup Guide .
.
.
.
.
.
.

.
.
.
.
.
.

.
.
.
.

459
463
463
464
470
470

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 472

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Setup for Online Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Setting up VCM for Offline Systems. . . . . . . . . . . . . . . . . . . . . .
Creating a Virtual CM-Stick with Server 2003/2008 Enterprise Editions
Additional Instructions for AD Lab WebUI and eDiscovery . . . . . . . .
Virtual CodeMeter FAQs . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Introduction . . . . . . . . .
Preparation Notes . . . . .
Setup Overview. . . . . . .
Network Dongle Notes . .
NLS Server System Notes
NLS Client System Notes .

.
.
.
.

459

.
.
.
.
.
.

.
.
.
.
.
.
.

472
472
472
473
473
474
475

. . . . . . . . . . . . . . . . . . . . . . 477
477
477
477
478
478
478

Chapter 39: Configuring for Backup and Restore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Configuration for a Two-box Backup and Restore . . . . . . . . . . . . . . . . . . .

480

.
.
.
.
.
.

.
.
.
.
.
.
.

.
.
.
.
.
.

Configuration Overview . . . . . . . . .
Create a Service Account . . . . . . . .
Share the Case Folder . . . . . . . . .
Configure Database Services . . . . .
Share the Backup Destination Folder .
Test the New Configuration . . . . . . .

.
.
.
.
.
.

.
.
.
.
.
.
.

.
.
.
.
.
.

480

.
.
.
.
.
.

480
480
481
482
482
482

Chapter 40: AccessData Distributed Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Distributed Processing Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . .
Installing Distributed Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Configuring Distributed Processing. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Using Distributed Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

484
484
486
488
490

Checking the Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490

Chapter 41: AccessData Oradjuster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Oradjuster System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
The First Invocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

491
491

Table of Contents

| 20

491

492

Subsequent Invocations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492
One-Box Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492
Two-Box Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493

Tuning for Large Memory Systems

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 494

Chapter 42: Installing the Windows Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Manually Installing the Windows Agent . . . . . . . . . . . . . . . . . . . . . . . . . .

496
496

Preparing the AD Enterprise Agent Certificate . . . . . . . . . . . . . . . . . . . 496
Installing the Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497
Configuring Execname and Servicename Values . . . . . . . . . . . . . . . . . . 499

Using Your Own Certificates . . . .
eDiscovery Additional Instructions

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502

Chapter 43: Installing the Unix / Linux Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Installing The Enterprise Agent on Unix/Linux . . . . . . . . . . . . . . . . . . . . .
Supported Platforms .
Uninstallation . . . . .
Configuration . . . . .
Starting the Service .
Stopping the Service .

.
.
.
.
.

503

.
.
.
.
.

503
504
504
504
504

Chapter 44: Installing the Mac Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

505

Configuring the AccessData Agent installer

.
.
.
.
.

503

. . . . . . . . . . . . . . . . . . . . . . . 505

Bundling a Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
Configuring the Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
Additional Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . . 506

Installing the Agent . .
Uninstalling the Agent

Table of Contents

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507

| 21

Part 1

Introducing Forensic Toolkit®
(FTK®)

This part contains introductory information about AccessData® Forensic Toolkit® (FTK®) and contains the
following chapters:
Introducing
Getting

AccessData® Forensic Toolkit® (FTK®) (page 23)

Started with the User Interface (page 29)

Introducing Forensic Toolkit® (FTK®)

| 22

Chapter 1

Introducing AccessData® Forensic Toolkit®
(FTK®)

AccessData® Forensic Toolkit® (FTK®) lets you do thorough computer forensic examinations. It includes
powerful file filtering and search functionality, and access to remote systems on your network.
AccessData forensic investigation software tools help law enforcement officials, corporate security, and IT
professionals access and evaluate the evidentiary value of files, folders, and computers.
This chapter includes the following topics
Overview

of Investigating Digital Evidence (page 23)

About

Acquiring Digital Evidence (page 24)

About

Examining Digital Evidence (page 25)

About

Managing Cases and Evidence (page 26)

What

You Can Do With the Examiner (page 27)

Overview of Investigating Digital Evidence
This section describes acquiring, preserving, analyzing, presenting, and managing digital evidence and cases.
Forensic digital investigations include the following process
Acquisition

Acquisition involves identifying relevant evidence, securing the evidence, and creating and storing a
forensic image of it.
About Acquiring Digital Evidence (page 24)
Analysis

Analysis involves creating a case and processing the evidence with tools to properly investigate the
evidence.
About Examining Digital Evidence (page 25)
Presentation

Presentation involves creating a case report that documents and synthesizes the investigation.
About Presenting Evidence (page 28)
Management

Management involves maintenance tasks such as backing up, archiving, detaching, attaching, restoring,
and deleting cases and evidence.
About Managing Cases and Evidence (page 26)

Introducing AccessData® Forensic Toolkit® (FTK®)

Overview of Investigating Digital Evidence

| 23

About Acquiring Digital Evidence
The admissibility of digital evidence in a court of law, can be dependent on preserving the integrity of the source
data when it is acquired.
When digital evidence is acquired, forensic examiners create clones of the digital evidence to prevent any
possibility of the digital evidence being changed or modified in any way. This acquired duplication is called a
forensic image. If there is question to the authenticity of the evidence, the image can be compared to the original
source data to prove or to disprove its reliability.
To create a forensic image, the data must be acquired in such a way that ensures that no changes are made to
the original data or to the cloned data. The acquired data must be an exact “bit-by-bit” duplication of the source
data. You can use AccessData’s Imager tool to acquire exact duplicates of digital evidence.
Preserving the evidence is accomplished both in the method of acquisition and the storage of the acquired data.
Creating an exact replica of the original source is critical in forensic investigations. Keeping that replica safe from
any source of corruption or unauthorized access involves both physical and electronic security. Once a case is
created and the evidence is added to it, the case becomes just as critical. Acquired 001, E01, S01, and AD1
images can be encrypted using AD Encryption.

Types of Digital Evidence
Digital evidence is data such as documents and emails that can be transmitted and stored on electronic media,
such as computer hard drives, mobile phones, and USB devices.
The following are types of digital evidence
Static

evidence
The data that is imaged before it is added to a case is known as static evidence because it stays the
same. Images can be stored and remain available to the case at all times because the image is an exact
replica of evidence data in a file format.

Live

evidence
Live evidence can be data that is acquired from a machine while it is running. It is often saved to an
image as it is acquired. Sometimes, this is necessary in a field acquisition. Other times, it can be an
original drive or other electronic data source that is attached to the investigation computer. All
connections to the evidence should be made through a hardware write-blocking device. Live evidence
that is attached to the investigation computer must remain connected throughout the entire investigation.
It is best to create an image of any evidence source outside of your network, rather than risk having the
source removed during the course of the investigation.

Remote

evidence
Another type of live evidence is data acquired directly from machines that are connected to your
corporate network. This live evidence is referred to as remote evidence. The process of adding it to your
case for investigation is known as Remote Data Acquisition.

Acquiring Evidence
Some aspects of acquiring evidence are dependent on local or federal law. Be aware of those requirements
before you acquire the evidence. You can utilize static evidence as well as acquire and use live and remote
evidence from computers on your network.

Introducing AccessData® Forensic Toolkit® (FTK®)

About Acquiring Digital Evidence

| 24

About Acquiring Static Evidence
For digital evidence to be valid, it must be preserved in its original form. The evidence image must be
forensically sound, in other words, identical in every way to the original. The data cannot be modified by the
acquisition method used.
The following tools can do such an acquisition
Hardware

Acquisition Tools
Duplicate, or clone, disk drives and allow read-only access to the hard drive. They do not necessarily use
a CPU, are self-contained, and are often hand-held.

Software

Acquisition Tools
Create a software duplication of the evidence called a disk image. Imager lets you choose the image file
format, the compression level, and the size of the data segments to use.

Imager is a software acquisition tool. It can quickly preview evidence. If the evidence warrants further
investigation, you can create a forensically sound disk image of the evidence drive or source. It makes a bit-bybit duplicate of the media, rendering a forensic disk image identical in every way to the original, including file
slack and allocated or free space.
You should use a write-blocking device when using software acquisition tools. Some operating systems, such as
Windows, make changes to the drive data as it reads the data to be imaged.
You can process static evidence, and acquire live data from local network machines for processing. You can also
view and preview evidence on remote drives, including CDs and DVDs.

About Acquiring Live Evidence
You can collect evidence from a live machine when you must. For criminal investigations, it is especially
important to be aware of the data compromises you will face in such a situation, however sometimes there is no
other choice. One such example is when the suspect drive is encrypted and you must acquire the image in-place
while the machine is running. Another example is when imaging a RAID array; it must be live to be properly
acquired.

About Acquiring Remote Evidence
You can acquire live evidence from your active networked computers, including information in RAM, and drive
data. In addition, using Remote Drive Management System (RDMS), you can mount any drive through a
mapping and browse its contents, then make a custom image of what you find. This type of evidence is known
as remote evidence because it is not stored on the examiner computer but is within your network.

About Examining Digital Evidence
Analyzing evidence is a process to locate and identify meaningful data to make it available to the appropriate
parties in an easy-to-understand medium.

Introducing AccessData® Forensic Toolkit® (FTK®)

About Examining Digital Evidence

| 25

After you have completed installation and created a case, you can add evidence for analysis. Evidence can
include images of hard drives, floppy drives, CDs and DVDs, portable media such as USB drives, and/or live
(un-imaged) data from any common electronic source.
The data can be hashed and indexed. You can run searches in the index for specific words like names and email
addresses, or you can run live searches.
You can use the Known File Filter (KFF) library to categorize specific information during evidence analysis. The
KFF lets you automatically assign files a status of Alert, Ignore, or Disregard.

About Managing Cases and Evidence
As you work with cases, it is a best practice to back up the cases and the evidence. Back up of evidence files is
as easy as copying them to a secure location on a secure media. Back up of cases can be more complicated,
but is equally important in the event of a crash or other catastrophic data loss.
Back up of a case requires the same amount of drive space as the case itself. This is an important consideration
when planning your network resources for investigations.
Some of the case management features include: Archive, Archive and Detach, and Attach. These features give
you control over your cases.
See Managing Global Features (page 43).

Introducing AccessData® Forensic Toolkit® (FTK®)

About Managing Cases and Evidence

| 26

What You Can Do With the Examiner
You can use tab views to locate data such as the following
The

Overview tab lets you narrow your search to look through specific document types, or to look for
items by status or file extension.

The

Graphics tab lets you quickly scan through thumbnails of the graphics in the case.

The

Email tab lets you view emails and attachments.

As you find items of interest, you can do the following
Create,
Use

assign, and view labels in a sorted file list view.

searches and filters to find relevant evidence.

Create

bookmarks to easily group the items by topic or keyword, find those items again, and make the
bookmarked items easy to add to reports.

Export

files as necessary for password cracking or decryption, then add the decrypted files back as
evidence.

Add

external, supplemental files to bookmarks that are not otherwise part of the case.

About Indexing and Hashing
During case creation and evidence import, you have the option to create an index of the data and to create hash
numbers of all the files contained in the data.
Indexing is the process of creating an index with a searchable list of the words or strings of characters in a case.
The index instantaneously provides results. However, it is sometimes necessary to use a live search to find
things not contained in the index.
Hashing a file or files refers to the process of using an algorithm to generate a unique value based on a file’s
contents. Hash values are used to verify file integrity and identify duplicate and known files. Known files can be
standard system files that can be ignored in the investigation or they can be files known to contain illicit or
dangerous materials. Ignore and alert statuses provide the investigator with valuable information at a glance.
Three hash functions are available: Message Digest 5 (MD5), Secure Hash Algorithms 1 (SHA-1), and Secure
Hash Algorithms 256 (SHA-256).
Typically, individual file hashes (each file is hashed as it is indexed and added to a case) compare the results
with a known database of hashes, such as the KFF. However, you can also hash multiple files or a disk image to
verify that the working copy is identical to the original.

About the Known File Filter Database
The Known File Filter (KFF) is an AccessData utility used to compare file hashes in a case against a database of
hashes from files known to be ignorable (such as known system and program files) or with alert status (such as
known contraband or illicit material), or those designated as disregard status (such as when a search warrant
does not allow inspection of certain files within the image that have been previously identified). The KFF allows
quick elimination or pinpointing of these files during an investigation.

Introducing AccessData® Forensic Toolkit® (FTK®)

What You Can Do With the Examiner

| 27

Files which contain other files, such as ZIP, CAB, and email files with attachments are called container files.
When KFF identifies a container file as either ignorable or alert, the component files are not extracted. If
extraction is desired, the files must be manually extracted and added to the case.
See Using the Known File Filter (KFF) on page 405.

About Searching
You can conduct live searches or index searches of acquired images.
A live search is a bit-by-bit comparison of the entire evidence set with the search term and takes slightly more
time than an Index search. Live searches allow you to search non-alphanumeric characters and to perform
pattern searches, such as regular expressions and hex values.
See Searching Evidence with Live Search (page 300)
The Index search compares search terms to an index file containing discrete words or number strings found in
both the allocated and unallocated space in the case evidence. The investigator can choose to generate an
index file during preprocessing.
See Searching Evidence with Index Search (page 311)
AccessData products use dtSearch, one of the leading search tools available, in the index search engine.
dtSearch can quickly search gigabytes of text.

About Bookmarking
As important data is identified from the evidence in the case, bookmarking that data enables you to quickly find
and refer to it, add to it, and attach related files, even files that are not processed into the case. These files are
called “supplementary files.” Bookmarks can be included in reports at any stage of the investigation and
analysis.
See Bookmarking Evidence (page 290)

About Presenting Evidence
You can present digital evidence by creating a case report containing the evidence and investigation results in a
readable, accessible format.
Use the report wizard to create and modify reports. A report can include bookmarks (information selected during
the examination), customized graphic references, and selected file listings. Selected files, such as bookmarked
files and graphics, can be exported to make them available with the report. The report can be generated in
several file formats, including HTML and PDF and can be generated in multiple formats simultaneously.
See Working with Evidence Reports (page 389).

Introducing AccessData® Forensic Toolkit® (FTK®)

What You Can Do With the Examiner

| 28

Chapter 2

Getting Started with the User Interface

You can use two primary interfaces to work with cases and evidence:
Case

Manager

Examiner

The Case Manager
You can use the Case Manager to manage application settings that apply to multiple cases.
The following is an example of the Case Manager:

See Introducing Case Management on page 48.

Getting Started with the User Interface

| 29

The Examiner
You can use the Examiner to locate and interpret case data.
The following is an example of the Examiner:

The Examiner

For more information, see the following
See

Introducing Case Management (page 48)

See

Using the Examiner Interface (page 224)

Getting Started with the User Interface

| 30

Part 2

Administrating Forensic
Toolkit® (FTK®)

This part contains information about administrating and configuring Forensic Toolkit® (FTK®) and contains the
following chapters:
Application

Administration (page 32)

Administrating Forensic Toolkit® (FTK®)

| 31

Chapter 3

Application Administration

This chapter includes topics that discuss administration tasks that you can do within the Case Manager
interface.
See the following
See

Creating an Application Administrator Account on page 33.

See

Changing Your Password on page 33.

See

Recovering a Password on page 33.

See

Setting Database Preferences on page 35.

See

Managing Database Sessions on page 35.

See

Optimizing the Database for Large Cases on page 35.

See

Managing Shared KFF Settings on page 36.

See

Recovering and Deleting Processing Jobs on page 36.

See

Restoring an Image to a Disk on page 37.

See

Database Integration with other AccessData Products on page 37.

See

Adding New Users to a Database on page 38.

See

About Assigning Roles to Users on page 39.

See

Restrictions to the Case Reviewer Role on page 40.

See

About Assigning Permissions to Users on page 41.

See

Assigning Users Shared Label Visibility on page 41.

See

Setting Additional Preferences on page 42.

See

Managing Global Features on page 43.

Important: It is strongly recommended to configure antivirus to exclude the database (PostgreSQL, Oracle
database, MS SQL) AD temp, source images/loose files, and case folders for performance and data
integrity.

Application Administration

| 32

Creating an Application Administrator Account
Before you can use the Case Manager, you must create an Application Administrator account and connect to the
database. The Case Manger lets you create other user accounts and perform other administrative tasks.

To create an Application Administrator account and connect to the database:
1.

Launch the program.

If an existing database connection is not detected, you are prompted to Add Database.

In the RDBMS drop-down menu, select the type of database that you are connecting to.

Enter the IP address or DNS host name of the server hosting the database in the Host field. If the
database is on the same computer as the Examiner, you can leave this field empty.

(Optional) In the Display name field give the database connection a nickname.

Unless you have a custom database configuration, do not change the values for Oracle SID,
PostgreSQL dbname, or Port number.

Click OK.

If the connection attempt to the database is successful, the database is initialized.

When the initialization process completes, create the Application Administrator account for that version
of the database schema. Enter the credentials for the account and click OK.

10. In the Please Authenticate dialog, enter the Application Administrator account credentials.

The Case Manager opens.

Changing Your Password
Once logged into the system, you can change your password.

To change your password
1.

In Case Manager, click Database > Change Password.

In the Change Password dialog box, enter your current password.

Enter your new password in the New Password text box.

Verify your new password by entering it again in the Re-enter text box.

Click OK.

Recovering a Password
You can recover an Administrator database password using a Password Reset File. Only the Administrator
logged into the program can create the reset file and only the Administrator that created the reset file can use the
file to reset the password. Before recovering your Administrator password, you will create a Password Reset
File. Once you reset a password, the Password Reset File you used is no longer valid.
There are two main components to recover an Administrator’s password:
See

Creating a Password Reset File on page 34.

See

Resetting your Password on page 34.

Application Administration

Creating an Application Administrator Account

| 33

Creating a Password Reset File
There are two ways to create a Password Reset file. You can create the file when creating/changing your
password or accessing the Create Password Reset File option in the Administer Users dialog.

When creating/changing your password
1.

After entering your previous password, your new password, and your password confirmation, click OK.

A prompt appears that asks you to create a Password Reset File. Click Yes.

Navigate to a secure location and enter the name of the Password Reset File.

Important: Choose a location for the Password Reset File that only you know and to which others do not
have immediate access. Keep its location confidential.
4.

Click OK.

From the Administer Users dialog
1.

In Case Manager, click Database > Administer Users.

Highlight your User Name (that is, the User Name under which you are logged in).

Click Create Password Reset File.

Navigate to a secure location and enter the name of the Password Reset File.

Important: Choose a location for the Password Reset File that only you know and to which others do not
have immediate access. Keep its location confidential.
5.

Click OK.

Resetting your Password
To reset your password, enter the Password Reset File you created previously.
Note: Any Password Reset Files that have already been used to reset passwords are no longer valid and will
not work. Password Reset Files from other users or other databases also will not work. Only the
Password Reset File that you created previously with your User Name and Password will work.

To enter the Password Reset File
1.

When prompted for your password, enter your User Name.

Click OK.
The Reset Password button appears in the Please Authenticate dialog.

Click Reset Password.

Locate the Password Reset File, highlight it, and click OK.

Enter a new password, verify the new password, and click OK.

Application Administration

Recovering a Password

| 34

Setting Database Preferences
The Preferences dialog lets you specify where to store the temporary file, the location of a network license and
whether you want to optimize the database after you process evidence.

To set database preferences
1.

In the Case Manager, click Tools > Preferences. Type in or browse to the folder you want temporary
files to be written to.

Select a location for the temporary file folder.
The Temporary File Folder stores temporary files, including files extracted from ZIP and email archives.
The folder is also used as scratch space during text filtering and indexing. The Temporary File Folder is
used frequently and should be on a drive with plenty of free space, and should not be subject to drive
space allocation limits.

If your network uses AccessData Network License Service (NLS), you must provide the IP address and
port for accessing the License Server.

Specify if you want to optimize the case database.
This is set to optimize by default. Unmark the check box to turn off automatic optimization. This causes
the option to be available in Additional Analysis for those cases that were processed with Optimize
Database turned off initially. The Restore Optimization option in Additional Analysis does not appear if
Database Optimization is set in the New Case Wizard to be performed following processing, or if it has
been performed already on the current case from either place.

In the Preferences dialog, click OK.

Managing Database Sessions
You can use the Sessions Management dialog to manage and track database sessions from within the Case
Manager. You can also use the Manage DB Sessions dialog to terminate cases that are open and consuming
sessions, but are inactive. This lets open file handles close so that processing can be restarted.
To open the Manage DB Sessions dialog, in the Case Manager, click Database > Session Management.

Optimizing the Database for Large Cases
Note: This feature currently only supports installations using PostgreSQL. If you are using Oracle, this feature is
disabled.
The database can be configured to optimize the handling of large cases. Specifically it may decrease the
processing time for large cases. However, if you choose to optimize the database, it will require additional disk
resources on the database host computer.

To optimize the database for large cases
1.

In the Case Manager, click Database > Configure.

Click Optimized for large cases.

Click Apply.

Application Administration

Setting Database Preferences

| 35

Managing Shared KFF Settings
The AccessData Known Files Filter can be managed from the Case Manager > Database menu. Click Manage
KFF to open the KFF Admin dialog box.
This functionality is also found in the Examiner main window under Manage menu. Click KFF > Manage to open
the KFF Admin dialog box.
The difference between the two is that sets and groups defined from Case Manager are automatically shared.
Those defined from the Examiner are local to the case. Otherwise, the functionality is the same.
Edit or delete existing custom defined groups or custom defined or imported sets, or add new groups; import a
selected group or set; export a group.

Recovering and Deleting Processing Jobs
Jobs that are started but unable to finish can be restarted or deleted.

To recover and delete processing jobs
1.

Click Tools > Recover Processing Jobs. If no jobs remain unfinished, an error message pops up.
Click Continue to see the Recover Processing Jobs dialog. It is be empty. Click Close. If there are jobs
in the list, you can choose whether to Restart or Delete those jobs.

Click Select All, Unselect All, or mark the check box for each job to be recovered.

Do one of the following:

Click

Restart. In the Recovery Type dialog, choose the recovery type that suits your needs.

Click

Delete. Click Yes to confirm that you want to delete the job permanently.

Click Close.

Application Administration

Managing Shared KFF Settings

| 36

Restoring an Image to a Disk
You can restore a disk image (001 (RAW/dd), E01, or S01) to a physical disk. The target disk must be the same
size or larger than the original, uncompressed disk.

To restore an image to a disk
1.

In the Case Manager or in the Examiner, click Tools > Restore Image to Disk. The Restore Image to
Disk dialog opens.

Browse to and select the source image (must be RAW-dd/001, E01, or S01).

Click the Destination drive drop-down to choose the drive to restore the image to.
If you have connected an additional target drive and it does not appear in the list, click Refresh to
update the list.

If the target (destination) drive is larger than the original, uncompressed data, and you don’t want the
image data to share the drive space with old data, mark the Zero-fill remainder of destination drive
check box.

If you need the operating system to see the target drive by drive letter, mark the Notify operating
system to rescan partition table when complete check box.

Click Restore Image.

Database Integration with other AccessData Products
You can use FTK® 5.0 or higher with the following products:
AccessData

CIRT 2.2 or higher

AccessData

Insight 5.x or higher

AccessData

Summation 5.x or higher

AccessData

eDiscovery 5.x or higher

If you are using these products, you can share the same database. When you install FTK®, you can specify the
same database that you are using for the other product. This lets you open and perform tasks on projects from
those cases in FTK®. You can do the following tasks with projects:
Open

a case

Backup
Add

and restore a case

and remove evidence

Perform
Search
Export

Additional Analysis

and index data
data

Application Administration

Restoring an Image to a Disk

| 37

Adding New Users to a Database
The Application Administrator can add new users to a database. The Add New User dialog lets you add users,
disable users, change a user’s password, set roles, and show disabled users.

To add a new user
1.

Click Database > Administer Users > Create User.

In the Add New User dialog, enter information for the following:

Field

Description

User Name

Enter the name that the user is known as in program logs and other system
information.

Full Name

Enter the full name of the user as it is to appear on case reports.

Password

Enter and verify a password for this user.

Role

Assign rights to the selected user name using roles. The default roles are:
 Application Administrator: Can perform all types of tasks, including adding and managing users.
 Case/Project Administrator: Can perform all of the tasks an Application
Administrator can perform, with the exception of creating and managing
users.
 Case Reviewer: Cannot create cases; can only process cases.

Click OK to apply the selected role to the new user.

Click OK to exit the Add New User dialog.

Application Administration

Adding New Users to a Database

| 38

About Assigning Roles to Users
A user can have two levels of roles assigned to him or her. A user can have initial roles granted that apply
globally across all cases in a database, and a user can also have specific roles granted for a specific case.
Roles can be granted as follows
Roles

that apply to all cases in a database are granted from the Database > Administer Users dialog.

Roles

that apply to a specific case are granted from the Case > Assign Users dialog.

The permissions that are applied through roles are cumulative, meaning that if you apply more than one, the
greatest amount of rights and permissions become available.
When you assign roles that apply globally across the database, you cannot reduce the rights on a case-by-case
basis.
AccessData recommends that when you first create a user account, save the account and close the dialog
without setting a role. Then click Case > Assign Users to assign roles on a case-by-case basis. You can also
assign all new users the Case Reviewer role for the database and, then selectively add additional roles as
needed on a case-by-case basis.

Assigning Initial Database-level Roles to Users
You can use the case manager to assign roles to users. Although the default roles can all be selected
concurrently, AccessData recommends that only one of these be selected for any user to avoid granting either
redundant or excessive permissions.

To assign initial database-level roles to users
1.

In the Case Manager, click Database > Administer Users.

Do one of the following:
If

the user does not yet exist in the system click Create User to create the user.

If

the user does exist in the system, select the user's name and click Set Roles.

Click Set Roles to assign a role that limits or increases database and administrative access.

To assign a default role, mark the check box next to that role. The default roles are as follows:
Application

Administrator: Can perform all types of tasks, including adding and managing users.

Case/Project

Administrator: Can perform all of the tasks an Application Administrator can perform,
with the exception of creating and managing users.

Case

Reviewer: Cannot create cases; can only process cases.

Click OK to apply the selected role to the new user, save the settings, and return to the Add New User
dialog.

Assigning Additional Case-level Roles to Users
You can use the Case Manager to assign specific roles to users on a case-by-case basis.

To assign additional case-level roles to users
1.

In the Case Manager, select the case for which you want to grant additional roles to a user.

Click Case > Assign Users.

In the Assigned Users pane, select the user that you want to grant additional roles to.

Click Additional Roles.

Application Administration

About Assigning Roles to Users

| 39

In the Additional Roles dialog, under Additional Roles for this Case, select the roles that you want to
grant.

Click OK.

Click Done.

Restrictions to the Case Reviewer Role
The case reviewer role does not have all of the permissions as the application administrator and the database
administrator.

Permissions Denied to Case Reviewer Users
Create, Add, or Delete cases

Use Imager

Administer Users

Use Registry Viewer

Data Carve

Use PRTK

Manually Data Carve

Use Find on Disk

Assign Users to Cases

Use the Disk Viewer

Add Evidence

View File Sectors

Access Credant Decryption from the
Tools Menu

Define, Edit, Delete, Copy, Export, or Import Filters

Decrypt Files from the Tools Menu

Export Files or Folders

Mark or View Items Flagged as
“Ignorable” or “Privileged”

Access the Additional Analysis Menu

Manage the KFF

Backup or Restore Cases

Enter Session Management

Create Custom Data Views

Application Administration

Restrictions to the Case Reviewer Role

| 40

About Assigning Permissions to Users
It is important to understand that when you create user accounts (Database > Administer Users) and assign
roles to users from that dialog, the roles you assign are global for this database; you cannot reduce their rights
on a case-by-case basis.
If you decide to limit a user’s rights by assigning a different role, you must return to the Database > Administer
Users dialog, select a user and choose Set Roles. Unmark the current role and click OK with no role assigned
here, or choose a different role that limits access, then click OK to save the new setting.
AccessData recommends that you first create the user account, save the account and close the dialog without
setting a role. Then, click Case > Assign Users to assign roles on a case-by-case basis.
Or you could assign all new users the global Case Reviewer role, then selectively add the Case/Project
Administrator or Application Administrator role as needed. The permissions that are applied through roles are
cumulative, meaning that if you apply more than one, the greatest amount of rights and permissions become
available.

Assigning Users Shared Label Visibility
Shared Labels give Application Administrators the added benefit of assigning visibility to only specific users on a
case-by-case basis.

To assign Label Visibility
1.

In Case Manager, click Case > Assign Users. The Assign Users for Case dialog opens, and a list of
users that have permissions in the currently selected case appears.

Highlight a User.

Click Label Visibility to open the Manage Label Visibility dialog.

To show or hide Labels
1.

Select a user in the User List pane. The Shared Labels dialog opens. Initially all are set as Visible.

Move labels as needed, based on the following:
Select
To

a label you want that user not to see in any case, and click the > button.

move a hidden label into the Visible Labels pane, select it, and click the < button.

Application Administration

About Assigning Permissions to Users

| 41

Setting Additional Preferences
Choosing a Temporary File Path
The Temporary File Folder stores temporary files, including files extracted from ZIP and email archives. The
folder is also used as scratch space during text filtering and indexing. The Temporary File Folder is used
frequently and should be on a drive with plenty of free space, and should not be subject to drive space allocation
limits.

To specify a location for the Temporary File Folder
1.

In the Case Manager, click Tools > Preferences. Type in or browse to the folder you want temporary
files to be written to.

Select the folder, then click OK.

In the Preferences dialog, verify the path is what you wanted.

In the Theme to use for Visualization section, you can also choose a color scheme to apply to the
visualization windows.

Click OK.

Providing a Network Security Device Location
If your network uses AccessData Network License Service (NLS), provide the IP address and port for accessing
the License Server.

Setting Theme Preferences for the Visualization Add on
To change the appearance of the Visualization window
1.

In the Case Manager, click Tools > Preferences.

In the Theme to use for Visualization section, select a color scheme to apply to the Visualization
windows.

Click OK.

Optimizing the Case Database
This is set to optimize by default. Unmark the check box to turn off automatic optimization. This causes the
option to be available in Additional Analysis for those cases that were processed with Optimize Database turned
off initially.
Note: The Restore Optimization option in Additional Analysis will not appear if Database Optimization was set
in the New Case Wizard to be performed following processing, or if it has been performed already on the
current case from either place.

Application Administration

Setting Additional Preferences

| 42

Managing Global Features
Several features that were previously available only in a case are now fully implemented for global application,
and are known as “Shared.” Since they are available globally, they are managed from the Case Manager
interface, under the Tools menu.
The Application Administrators manage all Shared features. It is a good practice to set these up to the extent you
are able, before you create your first case. Of course, new ones can be added at any time and copied to existing
cases. Shared features can be created within cases by both Application and Case Administrators, and Shared
(added to the global list).
Since each Shared feature has been documented to some extent in other chapters of the User Guide, only the
parts of the features that apply specifically to Application Administrators are explained here. Cross-references
are added to provide quick access to more complete information.

Managing Shared Custom Carvers
Carvers provide a comprehensive tool that allows you to customize the carving process to access hidden data
exactly the way you need it. You can create new, and edit or delete existing shared carvers. In addition, you can
import and export carvers, and copy carvers to cases that were previously processed without a particular custom
carver.
There are no default carvers listed in the Manage Shared Custom Carvers dialog. It contains only customdesigned carvers that are shared.
See also Data Carving (page 84)

To create a Shared Custom Carver
1.

In the Case Manager, click Manage > Carvers.

From the Manage Shared Custom Carvers dialog, click New.

Set the data carving options that you want to use.

Click Save when the new carver has been defined to meet your needs. You will see the new carver in
this list and when you mark the Carving option in the New Case Wizard.

In the Manage Shared Carvers dialog, click the appropriate button to:
Create
Edit

existing shared custom carvers

Delete

shared custom carvers

Import

shared custom carvers that have been exported from cases

Export

shared custom carvers

Copy

New shared custom carvers

shared custom carvers to a case

Click OK to close the Carving Options dialog.

Application Administration

Managing Global Features

| 43

Managing Custom Identifiers
Custom File Identifiers let you specify which file category or extension should be assigned to files with a certain
signature. While Custom Identifiers can be created and/or selected by a Case Administrator in the New Case
Wizard, Shared Custom Identifiers are created and managed from a separate menu.
See also Creating Custom File Identifiers (page 92).

To Create a Shared Custom Identifier
1.

In the Case Manager, click Manage > Custom Identifiers.
Initially, the Custom Identifiers List pane is empty, and the rest of the window is grayed-out.

Click Create New. The window activates.

Enter a name for the new Custom Identifier. The name you enter is added into the Custom Identifiers
List.

Enter a description to help define the identifier’s purpose.

Create the Custom Identifier by defining Operations and using the AND and OR buttons.

When you are done defining this Custom Identifier, click Apply.

You can also do the following
Click

Delete to delete an unwanted or outdated identifier.

Click

Export to save the selected identifier as a TXT file.

Click

Import to add an external identifier file.

Click

Close to close the Custom Identifiers dialog.

Managing Columns
Shared Columns use the same windows and dialogs that Local Columns use.

To create a Shared Column Template
1.

In Case Manager, click Manage > Columns.
The Manage Shared Column Settings dialog opens.

Highlight a default Column Template to use as a basis for a Custom Column Template.

Click New.

Enter a new name in the Column Template Name field.

Select the Columns to add from the Available Columns pane, and click Add >> to move them to the
Selected Columns pane.

Select from the Selected Columns pane and click Remove to clear an unwanted column from the
Selected Columns.

When you have the new column template defined, click OK.

See also Customizing File List Columns (page 384).

Managing File Extension Maps
Extension Maps can be used to define or change the category associated to any file with a certain file extension.
For example, files with BAG extension which would normally be categorized as “Unknown Type” can be

Application Administration

Managing Global Features

| 44

categorized as an AOL Bag File, or a files with a MOV extension that would normally be categorized as Apple
QuickTime video files can be changed to show up under a more appropriate category since they can sometimes
contain still images.

To create a Shared Custom Extension Mapping
1.

In the Case Manager, click Manage > File Extension Maps.

In the Custom Extension Mapping dialog, click Create New.

Enter a name for the new mapping.

Enter a description for easier identification.

In the Category pane, select a file type you want to map an extension to.

Click Add Extension.
The Add New Extension dialog box opens.

Enter the new extension to add.

Click OK.

You can also do the following:
Click

Delete to remove an unwanted or outdated mapping.

Click

Import to add an external Custom Extension Mapping file for Shared use.

Click

Export to save a Custom Extension Mapping file.

Click

Close to close the Custom Extension Mapping dialog.

See also Custom Case Extension Maps (page 93).

Managing Filters
Filters consist of a name, a description, and as many rules as you need. A filter rule consists of a property, an
operator, and one or two criteria. (You may have two criteria in a date range.)

To create a new Shared filter
1.

From Case Manager, click Manage > Filters.
The Manage Shared Filters dialog opens.

Do one of the following:
If

there is an existing filter in the Filters list that you want to use as a pattern, or template, highlight
that filter and click Copy.

If

there is no filter that will work as a pattern, Click New.

Enter a name and a short description of the new filter.

Select a property from the drop-down menu.

Select an operator from the Properties drop-down menu.

Select the applicable criteria from the Properties drop-down menu.

Each property has its own set of operators, and each operator has its own set of criteria. The possible
combinations are vast.

Select the Match Any operator to filter out data that satisfies any one of the filter rules or the Match All
operator to filter out data that satisfies all rules of the filter.
You can test the filter without having to save it first. Check the Live Preview box to test the filter as you
create it.

Application Administration

Managing Global Features

| 45

Application Administration

Managing Global Features

| 46

Part 3

Case Management

This part contains information about managing cases. It contains the following chapters:
Introducing
Creating

Case Management (page 48)

and Configuring New Cases (page 68)

Managing

Case Data (page 101)

Working

with Evidence Image Files (page 107)

Working

with Static Evidence (page 113)

Working

with Live Evidence (page 133)

Filtering

Data to Locate Evidence (page 146)

Working

with Labels (page 163)

Decrypting
Exporting
About

Files (page 167)

Data from the Examiner (page 187)

Cerberus Malware Analysis (page 200)

Running

Case Management

Cerberus Malware Analysis (page 217)

| 47

Chapter 4

Introducing Case Management

This chapter includes the following topics
About
The

Case Management (page 48)

User Interfaces (page 48)

About

the Cases List (page 49)

Menus

of the Case Manager (page 50)

Menus

of the Examiner (page 56)

About Case Management
Case management includes creating new cases, as well as backing up, archiving, detaching, restoring,
attaching, deleting cases from the database, and managing case and evidence files.
Case management tasks are performed from the Case Manager.
Note: Multiple user names in a case are automatically assigned to Original User Names when a case is
Archived, or Archived and Detached, and then restored. They can also be reassigned if necessary.
See Creating a Case (page 69)
See Managing Case Data (page 101)

The User Interfaces
The Case Manager lets you add and manage cases, users, roles and permissions, and do other management
tasks. You can use the Case Manager to apply settings globally to all cases in the system.
Menus of the Case Manager (page 50)
You can use the Examiner to locate, bookmark, and report on evidence.
Menus of the Examiner (page 56)

Introducing Case Management

About Case Management

| 48

About the Cases List
The Cases List shows all of the cases that are available to the currently logged in user. The right pane displays
information about the cases. The information that is shown for Case File, Description File, and Description are
determined by the either the Application Administrator or the Case Administrator.

Case Manager Cases List

Introducing Case Management

About the Cases List

| 49

Menus of the Case Manager
Case Manager Menus

More Information

File

The File menu lets you exit the Case Manager.
See Options of the Case Manager File Menu (page 50)

Database

The Database menu lets you administer users and roles.
See Options of the Case Manager Database Menu (page 51)

Case

The Case menu lets you create, backup, and delete cases. You can also assign users
to roles.
See Options of the Case Manager Case Menu (page 51)

Tools

The Tools menu lets you configure the processing engine, recover interrupted jobs and
restore images to a disk.
See Options of the Case Manager Tools Menu (page 53)

Manage

The Manage menu lets you administrate shared objects such as columns, labels and
carvers.
See Options of the Case Manager Manage Menu (page 54)

Help

The Help menu lets you access the user guide as well as view version and copyright
information.
See Options of the Case Manager Help Menu (page 55)

Options of the Case Manager File Menu

Options of the Case Manager ’s File Menu
Option

Description

Exit

Exits and closes the program.

Introducing Case Management

Menus of the Case Manager

| 50

Options of the Case Manager Database Menu
Case Manager Database Menu

Options of the Case Manager Database Menu
Option

Description

Opens the authentication dialog for users to log into the database. You can log out the
currently authenticated user without closing the program.

Change password

Opens the Change Password dialog. The currently authenticated user can change their
own password by providing the current password, then typing and re-typing the new
password.

Administer Users

Lets you manage user accounts. The Application Administrator can change users’
roles.

Manage KFF

Opens the KFF Admin dialog.

Session
Management

Opens the Manage Database Sessions dialog. Click Refresh to update the view of
current sessions. Click Terminate to end sessions that are no longer active.

Options of the Case Manager Case Menu
Case Manager Case Menu

Introducing Case Management

Menus of the Case Manager

| 51

Options of the Case Manager Case Menu
Option

Description

New

Start a new case with the currently authenticated user as the Case Administrator. Case
Reviewers cannot create a new case.
See Creating a Case (page 69)

Open

Opens the highlighted case with its included evidence.

Assign Users

Allows the Application Administrator or the Case Administrator to adjust or control the
rights of other users to access a particular case. Also allows the Administrator to control
which users can see which of the Shared Labels that are available.
See What You Can Do With Labels (page 163)

Backup

Opens a dialog for specifying names and locations for backup of selected cases. You
can select multiple cases in the Case Manager to backup.
Options are:
Backup
Archive
Archive and Detach

Restore

Opens a Windows Explorer instance for locating and restoring a selected, saved case.
Options are:
Restore an archived case
Attach an archived and detached case

Delete

Deletes the selected case. Pop-up appears to confirm deletion.

Copy Previous
Case

Copy a case from a previous version (4.2 or later) into the database.

Remove
Generated Index

This option lets you select a case and delete its index. If you remove a case’s index, you
cannot use index searches until you create a new index. To create a new index, in the
Examiner, click Evidence > Additional Analysis. Select dtSearch® Text Index and
click OK.

Refresh Case List

Right-click in the Case List area and select Refresh Case List, or click F5 to refresh the
case list with any new information.

The use of a UNC folder path is no longer required beginning with version 4.2 and
newer.
To use copy from previous case you don't backup the case in the previous version, you
simply use the "Copy Previous Case" feature. If you want to use Backup, you can
backup the case in a previous version, such as 4.2 then restore it to the new version.
Copy Previous Case doesn’t recognize backed-up cases.

Introducing Case Management

Menus of the Case Manager

| 52

Options of the Case Manager Tools Menu
Case Manager Tools Menu

Options of the Case Manager Tools Menu
Option

Description

Processing Engine
Config

Opens the Processing Engine Configuration dialog. Configure Remote Processing
Engines here. Specify Computer Name/IP Address, and Port. Add New, Remove,
Enable or Disable configured Processing Engines.

Recover Processing
Jobs

Allows you to recover jobs that were interrupted during processing so the processing
can be completed.

Show Progress
Window

Opens the Progress window so you can check the Processing Status.

Restore Image to
Disk

Copies a disk image to a disk other than the original.

Preferences

Opens Preferences dialog.

Introducing Case Management

Menus of the Case Manager

| 53

Options of the Case Manager Manage Menu
Case Manager Manage Menu

Options of the Case Manager Manage Menu
Option

Description

Carvers

Manage Shared Custom Carvers. Custom Carvers created here can be copied to
cases.

Custom Identifiers

Manage Shared Custom Identifiers. Custom Identifiers created here are automatically
made available to all new cases, but cannot be copied directly to earlier cases. They
must be exported and then imported into such cases.

Columns

Manage Shared Column Settings. Custom Columns created here can be copied to
cases.

File Extension
Maps

Manage Shared File Extension Mappings. File Extension Maps created here are
automatically made available to all new cases, but cannot be copied directly to earlier
cases. They must be exported and then imported into such cases.

Filters

Manage Shared Filters. Custom Filters created here can be copied to cases.

Labels

Manage Shared Labels. Custom Labels created here can be copied to cases.

KFF

Lets you access advanced KFF management options such as creating groups and
sets.

Introducing Case Management

Menus of the Case Manager

| 54

Options of the Case Manager Help Menu
Case Manager Help Menu

Options of the Case Manager Help Menu
Option

Description

User Guide

Opens the user guide in PDF format.

About

Provides version and build information, copyright and trademark information, and other
copyright and trade acknowledgements.

Introducing Case Management

Menus of the Case Manager

| 55

Menus of the Examiner
When a case is created and assigned a user, the Examiner window opens with the following menus:

Examiner Menus
Menu

Description

File

See Options of the Examiner File Menu (page 56)

Edit

See Options of the Examiner Edit Menu (page 58)

View

See Options of the Examiner View Menu (page 59)

Evidence

See Options of the Examiner Evidence Menu (page 61)

Filter

See Options of the Examiner Filter Menu (page 63)

Tools

See Options of the Examiner Tools Menu (page 64)

Manage

See Options of the Examiner Manage Menu (page 66)

Help

See Options of the Examiner Help Menu (page 67)

Options of the Examiner File Menu
Examiner File Menu

Options of the Examiner File Menu
Option

Description

Export

Exports selected files and associated evidence to a designated folder.

Introducing Case Management

Menus of the Examiner

| 56

Options of the Examiner File Menu (Continued)
Option

Description

Export to Image

Exports one or more files as an AD1 image to a storage destination.
When exporting to AD1 the image's file path is added under a root directory. This
speeds the process of gathering data for the AD1, and for shortening the path to
AD1 content.

Export File List Info

Exports selected file information to files formatted as the Column List in CSV, TSV,
and TXT formats.

Export Word List

Exports the words from the cases index as a text file. You can use this word list to
create a dictionary in the AccessData PRTK and DNA products.
See Exporting a Word List (page 196)

Report

Opens the Report Options dialog for creating a case report.
See Creating a Case Report (page 390)

Volatile Data Report

Opens a Volatile Data Report created from live data collected remotely and added
to this case. This option is grayed out unless Volatile Data has been added to the
case.

Closes the Examiner and returns to the Case Manager window.

Exit

Closes both the Examiner and Case Manager windows.

Introducing Case Management

Menus of the Examiner

| 57

Options of the Examiner Edit Menu
Examiner Edit Menu

Options of the Examiner Edit Menu
Option

Description

Copy Special

Duplicates information about the object copied as well as the object itself, and
places the copy in the clipboard.
See Copying Information from the Examiner (page 187)

Introducing Case Management

Menus of the Examiner

| 58

Options of the Examiner View Menu
Examiner View Menu

Options of the Examiner View Menu
Option

Description

Refresh

Reloads the current view with the latest information.

Filter Bar

Inserts the filter toolbar into the current tab. These features are also available from
the Filter menu.

Time Zone Display

Opens the Time Zone Display dialog.

Thumbnail Size

Selects the size of the thumbnails displayed from the Graphics tab. Select from the
following:





Tab Layout

Large-default
Medium
Small
Tiny

Manages tab settings. The user can lock an existing setting, add and remove
settings, and save settings one tab at a time or all at once. The user can also
restore previous settings or reset them to the default settings.
These options are in the following list:








Introducing Case Management

Save
Restore
Reset to Default
Remove
Save All Tab Layouts
Lock Panes
Add New Tab Layout

Menus of the Examiner

| 59

Options of the Examiner View Menu (Continued)
Option

Description

FIle List Columns

Specifies how to treat the current File List. Options are:





File Content Tabs
Switching

Save As Default
Save All as Default
Reset to Factory Default
Reset All To Factory Default

Specifies the behavior of file content when a different tab is selected. Options are:



Auto
Manual

Explore Tree

Displays the Explore Tree in the upper-left pane.

Graphics Tree

Displays the Graphics Tree in the upper-left pane.

Overview Tree

Displays the Overview Tree in the upper-left pane.

Email Tree

Displays the Email Tree in the upper-left pane.

Bookmark Tree

Displays the Bookmark Tree in the upper-left pane.

Index Searches

Displays the Index Search Results pane in the upper-left pane.

Live Searches

Displays the Live Search Results pane in the upper-left pane.

Bookmark Information

Adds the Bookmark Information pane into the current tab.

File List

Adds the File List pane into the current tab.

File Content

Adds the File Content pane into the current tab.

Email Attachments

Displays the attachments to email objects found in the case. Available only in the
Email and Overview tabs.

Properties

Inserts the Object Properties pane into the current tab view.

Hex Value Interpreter

Displays a pane that provides an interpretation of Hex values selected from the
Hex View pane.

Thumbnails

Displays a pane containing thumbnails of all graphics found in the case.

Progress Window

Opens the Progress dialog, from which you can monitor tasks and/or cancel them.

Introducing Case Management

Menus of the Examiner

| 60

Options of the Examiner Evidence Menu
Examiner Evidence Menu

Options of the Examiner Evidence Menu
Option

Description

Add/Remove

Opens the Manage Evidence dialog, used to add and remove evidence. From
Manage Evidence, choose from the following:
Time Zone — Choose Time Zone for evidence item
Refinement Options — Select Evidence Refinement Options
Language Setting — Choose the language of the evidence item
Define and Manage Evidence Groups
Select Case KFF Options

Add Remote Data

Opens the Add Remote Data dialog from which you can remotely access volatile,
memory, and/or drive data and add it to the case. To Collect remote data from
another computer on the network, provide the following:
Remote IP Address
Remote Port
Select any or all of the following:
Physical Drives (Can be mapped using RDMS)
Logical Drives (Can be mapped using RDMS)
Memory Analysis
Click OK or Cancel.

Introducing Case Management

Menus of the Examiner

| 61

Options of the Examiner Evidence Menu (Continued)
Option

Description

Additional Analysis

Opens the Additional Analysis dialog with many of the same processing options
available when the evidence was added. Allows the user to reprocess using
available options not selected previously.
See Using Additional Analysis (page 124).

Process Manually
Carved Items

Initiates the processing of items that have been manually carved, using the
selected options.

Manage Evidence
Groups

Opens the dialog where you can create and manage Evidence Groups.

Import Memory Dump

Opens the Import Memory Dump File dialog which allows you to select memory
dumps from other case files or remote data acquisitions, and import them into the
current case. The memory dump file must have been previously created.
See Working with Live Evidence (page 133)

Import Custom
Column File

When a Custom Column Settings file has been created, import it into your case
using this tool.

Delete Custom
Column Data

If you have imported or created a Custom Column Settings file, use this tool to
delete the associated column and its data from the view.

Merge Case Index

This option has been removed. The processing engine does this automatically and
no longer needs user interaction to select the merge.

Introducing Case Management

Menus of the Examiner

| 62

Options of the Examiner Filter Menu
Examiner Filter Menu

Options of the Examiner Filter Menu
Option

Description

New

Opens the Filter Definition dialog to define a temporary filter.

Duplicate

Duplicates a selected filter. A duplicated filter serves as a starting point for
customizing a new filter.

Delete

Deletes a selected filter.

Applies the selected filter globally in the application. The File List changes color to
indicate that the filter is applied.

Import

Opens the Windows file manager allowing the user to import a pre-existing filter.

Export

Opens the Windows File Manager allowing the user to save a filter.
The name of the filter cannot have any special or invalid characters or the export
will not work.

Tab Filter

Introducing Case Management

Allows the selection of a filter to apply in the current tab.

Menus of the Examiner

| 63

Options of the Examiner Tools Menu
Examiner Tools Menu

Options of the Examiner Tools Menu
Option

Description

Decrypt Files

Decrypts EFS and Office files using passwords you enter.
See Decrypting Files (page 167)

Credant Decryption

Opens the Credant Decryption dialog where you enter the decryption information.
See Decrypting Credant Files (page 179)

Verify Image Integrity

Generates hash values of the disk image file for comparison.
See Verifying Drive Image Integrity (page 107)

Restore Image to Disk

Restores a physical image to a disk. If the original drive was on a bootable
partition, the restored image may also be bootable. This feature is disabled for
Case Reviewers.

Mount Image to Drive

Allows the mounting of a physical or logical image for read-only viewing. Logically
mounting images allows them to be viewed as a drive-letter in Windows Explorer.
Mounted logical drives now show the user the correct file, even when a deleted file
with the same name exists in the same directory.
See Mounting an Image to a Drive (page 108)

Disk Viewer

Opens a hex viewer that allows you to see and search contents of evidence items.
Search Text for a term using Match Case, ANSI, Unicode, Regular Expression or
Search Up instead of down; Search Hex using Search Up. Specify a logical sector
or a cluster.

Other Applications

Opens other AccessData tools to complement the investigational analysis.

Configure Agent Push

Opens configuration dialog for pushing the agent to remote machines for data
acquisition.

Introducing Case Management

Menus of the Examiner

| 64

Options of the Examiner Tools Menu (Continued)
Option

Description

Push Agents

Push, or install, an Agent to a remote machine. You can Add, Remove, Import, or
Export a single machine or a list of machines here.

Manage Remote
Acquisition

Opens the Remote Acquisition dialog. Set the drive acquisition retry options here
to set compression levels, balance speed of transfers with the amount of
bandwidth usage, and set compression levels for remote data transfers.

Unmount Agent Drive

Unmount a remote drive that is mounted through RDMS.

Disconnect Agent

Disconnect a remote agent.

Recover Processing
Jobs

Restarts processing so jobs that were interrupted can be completed.

Visualization

Lets you launch the Visualization add on module for the data that you currently
have displayed in the File List Pane. Visualization is only available from the
Explore, Overview, and Email Tabs.
See Using Visualization on page 335.

Execute SQL

Executes a user-defined SQL script from within the interface.

Launch

Runs Oradjuster.EXE to temporarily optimize the available memory on the
Examiner & database machine for those using an Oracle database. This utility
does not work on a two-box configuration.

‘oradjuster.EXE’

See (page 491)

Introducing Case Management

Menus of the Examiner

| 65

Options of the Examiner Manage Menu
Examiner Manager Menu

Options of the Examiner Manage Menu
Tool Type

Description

KFF

Manage Known File Filter (KFF) Library, sets, and groups.
See Using the Known File Filter (KFF) (page 405).

Labels

Manage Local and Shared Labels as well as Label Groups.
See What You Can Do With Labels (page 163).

Carvers

Manage Local and Shared Custom Carvers.
See Data Carving (page 84).

Filters

Manage Local and Shared Filters.
See Filtering Data to Locate Evidence (page 146).

Columns

Manage Local and Shared Columns.
See Customizing File List Columns (page 384).

Introducing Case Management

Menus of the Examiner

| 66

Options of the Examiner Help Menu

Options of the Examiner Help Menu
Option

Description

User Guide

Opens the user guide in PDF format.

Case Folder

Opens the folder that contains the case data.

About

Provides version and build information, copyright and trademark information, and other
copyright and trade acknowledgements.

Introducing Case Management

Menus of the Examiner

| 67

Chapter 5

Creating and Configuring New Cases

This chapter explains how to create a new case and configure the case options. If you have cases that were
created in version 2.2 or later, you can convert them to the latest version.
This chapter includes the following topics
Opening

an Existing Case (page 68)

Creating

a Case (page 69)

Configuring
Evidence
Adding

Detailed Options for a Case (page 70)

Processing Options (page 76)

Evidence to a New Case (page 100)

Converting

a Case from Version 2.2 or Newer (page 100)

Opening an Existing Case
You can open a case that has previously been created and closed.

To open an existing case
1.

Open the Case Manager.

In the Case Manager, highlight and double-click a case to open it.

Note: If you attempt to open a case you have not been assigned to, you will receive a message saying, “You
have not been assigned to work on this case.” This is because you must be authenticated to open the
case.

Creating and Configuring New Cases

Opening an Existing Case

| 68

Creating a Case
Case information is stored in a database, and allows case administration as each new case is created.

To start a new case
1.

Open the Case Manager.

Click Case > New. The New Case Options dialog opens.

Enter a name for the case in the Case Name field.

(Optional) Enter any specific reference information in the Reference field.

(Optional) Enter a short description of the case in the Description field.

You can use the Description File option to attach a file to the case. For example you can use this field to
attach a work request document or a warrant to the case.

In the Case Folder Directory field specify where to store the case files. If you wish to specify a different
location for the case, click the Browse button.
Note: If the case folder directory is not shared, an error occurs during case creation.

(Optional) In the Database Directory field you can specify a location for where to store database
directory files. You can check the In the case folder option to save the database directory in the case
folder. If you do not specify these options, the database directory is saved to the default location of the
database.
Note: The location that you specify for Database Directory is relative to your database computer. If you
intend to specify a location that is on a different computer than your database, for example in a
multi-box scenario, then you must enter a network path.

Important: If using a UNC path for the case folder, and selecting the In the case folder option for the
database directory, and if the database process isn't running as a network user, it will not be able to
access the UNC path and will therefore fail to create the database files.
9.

Configure the default processing options for the case by either using a processing profile or using
custom settings.
See Configuring Detailed Options for a Case on page 70.

10. If you wish to open the case as soon as it is created, mark Open the case.
11. Click OK to create the new case.

Creating and Configuring New Cases

Creating a Case

| 69

Configuring Detailed Options for a Case
When you configure Detailed Options for a case, there are options for doing the following:
Configuring

Evidence Processing Options (page 70)

Configuring

Evidence Refinement (Advanced) Options (page 94)

Selecting
Managing

Index Refinement (Advanced) Options (page 96)
Custom Identifiers (page 44)

Configuring Evidence Processing Options
About Processing Options
To help you in investigating the evidence in a case, the evidence data is processed. When evidence is
processed, data about the evidence is created and stored in the database. You can view the processed data in
the Examiner.
Evidence is processed at the following times:
When
After

adding evidence to a case

the initial processing, when performing an additional analysis

There are many different types of processing options. You can choose which processing options are relevant to
your case.
The following are some examples of how your data can be processed:
Generate

hash values for all of the files in the evidence.

Categorize

the types of files in your evidence, such as graphics, office documents, encrypted files, and so

on.
Expand

the contents of compound files, such as ZIP or TAR files.

Create

an index of the words that are in the evidence files for quick searches and retrieval.

Create

thumbnails for the graphics and videos in the evidence.

Decrypt

encrypted files.

Compare

files in your evidence against a list of known files that you may want to be alerted about (such
as contraband images) or files that you want to ignore (such as Windows system files).

You can select processing options at the following times:
When

you create a case (Detailed Options) -- these become the default options for the case.
See Evidence Processing Options (page 76)

When

you add evidence to an existing case (Refinement Options) -- you can either use or override the
case defaults.
See Configuring Evidence Refinement (Advanced) Options (page 94)

When

you perform an Additional Analysis on a case.
See Using Additional Analysis (page 124)

Each processing option that you enable increases the time that it take to process the evidence. Depending on
your situation, you may want to select more or fewer options.
For example, in one scenario, you may want to process the evidence as quickly as possible. In this case, you
can use a pre-defined “Field Mode” that deselects almost all processing options and therefore takes the shortest

Creating and Configuring New Cases

Configuring Detailed Options for a Case

| 70

amount of time. After the initial processing, you can perform an Additional Analysis and enable additional
processing options.
In another scenario, you may want to take the time to categorize and index files during the initial processing, so
you can enable those options. This will take a significant amount of time for a large evidence set.

Configuring Default Processing Options for a Case
When you create a case, you define the default processing options that are used whenever evidence is added to
that case. By specifying default processing options for a case, you do not have to manually configure the
processing options each time you add new evidence. The case-level defaults can be overridden and customized
when you add new evidence or when you perform an additional analysis.
You configure the default processing options for a case in one of the following ways:
Using

Processing Profiles (page 72)

Manually

Customizing a set of Detailed Options (page 75)

Note: One factor that may influence which processing options to select is your schedule. If you disable
indexing, it shortens case processing time. The case administrator can return at a later time and index the
case if needed. The fastest way to create a case and add evidence is to use Field Mode.

Creating and Configuring New Cases

Configuring Detailed Options for a Case

| 71

Using Processing Profiles
About Processing Profiles
As an investigator, you may want to be able to save a set of processing options as a profile so that they can be
easily reused. Processing profiles are a saved list of processing options that are stored in the database.
Processing profiles are created at the global level and are available anytime you create a case.
For example, you may need to focus on certain types of data in a case, such as images and videos. In this
example, you can create a processing profile that enables the following processing options:
KFF
Expand
Flag

Compound Files

Bad Extensions

Create

Thumbnails for Graphics

Create

Thumbnails for Video

Generate
Explicit

Common Video File

Image Detection

PhotoDNA

Each time you create this kind of case, you can use a profile with these options set as default and you won't
need to manually specify them again.
Processing profiles are used at the case level. Specifically, when you create a case, you can select a processing
profile from a drop-down list as the default processing options for that case. Any time that you add evidence to
that case, the profile's setting will be the default "Refinement Options". This saves you time by not having to
reconfigure processing options each time you add evidence to the case. However, when you add evidence to a
case, you can modify the processing options for that evidence set. The profile is simply a set of default settings
for the case.
Processing profiles are stored in the database. It is important to note that the profile itself does not get saved
with the case but only the processing options that are in the profile.
There are two pre-configured processing profiles:
AD

Standard (these were the Factory Defaults in version 4.x and earlier)

AD

Field Mode
See About Pre-configured Processing Profiles on page 73.

When you create a case, you can use one of the pre-configured profiles or create/select a custom profile. If you
create a custom profile, you can save it with a unique name so that you can re-use it in a different case.
See Creating a Custom Processing Profile (page 73)
Important: When you create a custom profile, the settings for Custom File Identification or Event Audit Log
options are not stored in the processing profile. The Send Email Alert and Decrypt Credant Files
settings on the Evidence Processing tab are also not stored in the processing profile.
You can also edit, delete, import, or export processing profiles.
See Managing Processing Profiles (page 74)
You can also set custom processing options for a case without saving them to a profile.

Creating and Configuring New Cases

Configuring Detailed Options for a Case

| 72

See Manually Customizing a set of Detailed Options on page 75.

About Pre-configured Processing Profiles
There are two pre-configured processing profiles. You cannot edit these profiles. However, you can use them as
a template for a new custom profile.
The following are the pre-configured profiles.
AD Standard

AD Standard includes the following processing options:










MD5 Hash
SHA-1 Hash
SHA-256 Hash
Expand common compound files
This will expand many types of compound files.
See Expanding Compound Files (page 79)
File Signature Analysis
dtSearch Test Index
Create Thumbnails for Graphics
Include Deleted Files

This list of processing options is the same as the Factory Defaults in version 4.x.
For a description of processing options, see Evidence Processing Options (page 76)
Field Mode

Field Mode disables the standard processing options when processing evidence. This speeds up
processing. You can then re-enable processing options through Additional Analysis.

See Using Additional Analysis (page 124)
The Job Processing screen always shows 0 for Queued when Field Mode is enabled, because
items move directly from Active Tasks to Completed.

Creating a Custom Processing Profile
You can create a processing profile by selecting a set of processing options and then saving them as a profile.
You can create a processing profile at one of the following times:
Before
While

creating a case

configuring processing options for a new case

To create a custom processing profile
1.

From the Case Manager do one of the following:
To

1a.

Click Manage > Evidence Processing Profiles.

1b.

Click New Profile.

To

create a profile before creating a case, do the following:

create a profile while creating a new case, do the following:

1a.

Click Case > New.

1b.

Next to the Processing Profile field, click Custom.

You can use the Profile dropdown to select an existing profile as a template.

Creating and Configuring New Cases

Configuring Detailed Options for a Case

| 73

Do the following:
3a.

Click the Evidence Processing icon in the left pane, and select the processing options to be the
default options for the case. For more information, see Evidence Processing Options (page 76).

3b.

Click the Evidence Refinement (Advanced) icon to select the evidence refinement options to use
on this case. For more information, see Configuring Evidence Refinement (Advanced) Options
(page 94).

3c.

Click the Index Refinement (Advanced) icon to select the index refinement options to use on this
case. For more information, see Selecting Index Refinement (Advanced) Options (page 96).

3d.

Click the Evidence Lab/eDiscovery icon to select the advanced options to use on this case. For
more information, see Selecting Lab/eDiscovery Options (page 98).

Important: When you create a custom profile, the settings for Custom File Identification or Event Audit Log
options are not stored in the processing profile. When you configure these options, the Save As...
profile button is grayed out to signify that they are not saved as part of a profile.
See Managing Custom Identifiers (page 44).
4.

When you are satisfied with your options, click Save to Profile... to create the profile.

Enter a name for the profile.
To

create a new profile, enter a unique name.
You cannot use AD Standard, AD Field Mode, or Custom.

To

update an existing custom profile, enter the profile name.

(Optional) Enter a description of the profile.

Click Save.

Managing Processing Profiles
You can do the following to manage processing profiles.
Edit

You can edit an existing custom profile. You cannot edit the AD Standard or AD Field Mode
pre-configured profiles.
To edit a profile, you select an existing profile, make the desired changes, save the profile, and
confirm that you want to replace the existing profile.

Set as Default

You can set a processing profile as the global default. Whenever you create a new case, the
default profile is listed.
The default profile is denoted by a green check mark.

Delete

You can delete an existing custom profile. You cannot delete the AD Standard or AD Field
Mode pre-configured profiles.
If you delete a custom profile that has been selected as the default, the profile is deleted and
the AD Standard profile becomes the default.

Export

You can export a profile so that you can archive it or use it on a different computer. The
exported settings are saved in xml format.

Import

You can import a profile that has been previously exported.

To manage processing profiles
1.

In the Case Manager, click Manage > Evidence Processing Profiles.

In the Manage Evidence Processing Profiles dialog, select a profile to manage.

Select an action to perform on the profile.

Click Close.

Creating and Configuring New Cases

Configuring Detailed Options for a Case

| 74

Manually Customizing a set of Detailed Options
You can configure default processing options for a case without saving it as a profile.

To manually customize the evidence processing options
1.

From the New Case Options dialog, click Custom.
1a.

Click the Evidence Processing icon in the left pane, and select the processing options to be the
default options for the case. For more information, see Evidence Processing Options (page 76).

1b.

Click the Evidence Refinement (Advanced) icon to select the evidence refinement options to use
on this case. For more information, see Configuring Evidence Refinement (Advanced) Options
(page 94).

1c.

Click the Index Refinement (Advanced) icon to select the index refinement options to use on this
case. For more information, see Selecting Index Refinement (Advanced) Options (page 96).

1d.

Click Custom File Identification to configure Custom Identifiers. For more information, see
Managing Custom Identifiers (page 44).

Click OK.
In the Processing Profile field, it will display Custom to show that you did not save the options as a
profile.

When you are satisfied with your evidence refinement options, click OK to create the case and continue
to the Evidence Processing screen.

Creating and Configuring New Cases

Configuring Detailed Options for a Case

| 75

Evidence Processing Options
The following table outlines the Evidence Processing options.

Evidence Processing Options
Process

Description

MD5 Hash

Creates a digital fingerprint using the Message Digest 5 algorithm, based on the
contents of the file. This fingerprint can be used to verify file integrity and to
identify duplicate files.

SHA-1 Hash

Creates a digital fingerprint using the Secure Hash Algorithm-1, based on the
contents of the file. This fingerprint can be used to verify file integrity and to
identify duplicate files.

SHA-256 Hash

Creates a digital fingerprint using the Secure Hash Algorithm-256, based on the
contents of the file. This fingerprint can be used to verify file integrity and to
identify duplicate files. SHA-256 is a hash function computed with 32-bit words,
giving it a longer digest than SHA-1.

Flag Duplicate Files

Identifies files that are found more than once in the evidence. This is done by
comparing file hashes.

KFF

Enables the Known Fle Filter (KFF) that lets you identify either known
insignificant files that you can ignore or known illicit or dangerous files that you
want to be alerted to.
When you enable KFF, you must select a KFF Template to use. You can select
an existing KFF Template from the drop-down menu or click ... to create a new
one.
See Using the Known File Filter (KFF) on page 405.

PhotoDNA

Enables PhotoDNA which lets you compare images in your evidence against
known images in a library.
See Using PhotoDNA to Compare Images on page 256.

Expand Compound Files

Automatically opens and processes the contents of compound files such as ZIP,
email, and OLE files.
See Expanding Compound Files on page 79.
The option File Signature Analysis is not forced to be selected. This lets you
initially see the contents of compound files without necessarily having to process
them. Processing can be done later, if it is deemed necessary or beneficial to the
case by selecting File Signature Analysis.

Include Deleted Files

Checked by default. Un-check to exclude deleted files from the case.

File Signature Analysis

Analyzes files to indicate whether their headers or signatures match their
extensions. This option must be selected if you choose Registry Summary
Reports.

Flag Bad Extensions

Identifies files whose types do not match their extensions, based on the file
header information. This option forces the File Signature Analysis option to be
checked.

Entropy Test

Identifies files that are compressed or encrypted.
Compressed and encrypted files identified in the entropy test are not indexed.

Creating and Configuring New Cases

Evidence Processing Options

| 76

Evidence Processing Options (Continued)
Process

Description

dtSearch® Text Index

Stores the words from evidence in an index for quick retrieval. Additional space
requirement is approximately 25% of the space required for all evidence in the
case.
Click Indexing Options for extensive options for indexing the contents of the
case.
Generated text that is the result of a formula in a document or spreadsheet is
indexed, and can be filtered.

Create Thumbnails for
Graphics

Creates thumbnails for all graphics in a case.
Thumbnails are always created in JPG format, regardless of the original graphic
file type.
See Examining Graphics on page 250.

Create Thumbnails for
Videos

Creates thumbnails for all videos in a case.
You can also set the frequency for which video thumbnails are created, either by
a percent (1 thumbnail every “n”% of the video) or by interval (1 thumbnail every
“n” seconds.
See Examining Videos on page 260.

Generate Common
Video File

When you process the evidence in your case, you can choose to create a
common video type for videos in your case. These common video types are not
the actual video files from the evidence, but a copied conversion of the media
that is generated and saved as an MP4 file that can be previewed on the video
tab.
See Examining Videos on page 260.

HTML File Listing

Creates an HTML version of the File Listing in the case folder.

CSV File Listing

The File Listing Database is now created in CSV format instead of an MDB file
and can be added to Microsoft Access.

Data Carve

Carves data immediately after pre-processing. Click Carving Options, then
select the file types to carve. Uses file signatures to identify deleted files
contained in the evidence. All available file types are selected by default.
For more information on Data Carving, see Data Carving (page 84).

Meta Carve

Carves deleted directory entries and other metadata. The deleted directory
entries often lead to data and file fragments that can prove useful to the case,
that could not be found otherwise.

Optical Character
Recognition (OCR)

Scans graphics files for text and converts graphics-text into actual text. That text
can then be indexed, searched and treated as any other text in the case.
For more detailed information regarding OCR settings and options, see Running
Optical Character Recognition (OCR) (page 89).

Explicit Image Detection

Click EID Options to specify the EID threshold for suspected explicit material
found in the case.
See Evaluating Explicit Material on page 253.
EID is an add-on feature. Contact your sales representative for more information.

Registry Reports

Creates Registry Summary Reports (RSR) from case content automatically. Click
RSR Directory to specify the location of the RSR Templates. When creating a
report, click the RSR option in the Report Wizard to include the RSR reports
requested here. RSR requires that File Signature Analysis also be selected. If
you try to select RSR first, an error will pop up to remind you to mark File
Signature Analysis before selecting RSR.

Include Deleted Files

Enabled by default; to force exclusion of deleted files, unmark this check box.

Creating and Configuring New Cases

Evidence Processing Options

| 77

Evidence Processing Options (Continued)
Process

Description

Cerberus Analysis

Lets you run the add on module for Cerberus Malware Triage. You can click
Cerberus Options to access additional options.
For more information see About Cerberus Malware Analysis (page 200)

Send Email Alert on Job
Completion

Opens a text box that allows you to specify an email address where job
completion alerts will be sent.
Outgoing TCP traffic must be allowed on port 25.

Decrypt Credant Files

See Decrypting Credant Files on page 179.
If you select to decrypt Credant files, the File Signature Analysis option will
automatically be selected as well.

Process Browser
History for Visualization

Processes internet browser history files so that you can see them in the detailed
visualization timeline.
See Visualizing Browser History Data on page 294.

Cache Common Filters

Disabled by default. Caches commonly viewed files in the File List.
See Caching Data in the File List on page 243.

Perform Automatic
Decryption

Disabled by default. Attempts to decrypt files using a list of passwords that you
provide
See Decrypting Files Using PRTK/DNA Integration on page 181.

Language Identification

Disabled by default. Analyzes the first two pages of every document to identify
the languages contained within. The user will be able to filter by a Language field
within review and determine who needs to review which documents based on the
language contained within the document.
See Identifying Document Languages on page 278.

If you expand data, you will have files are are generated when the data was processed and was not part of the
original data. There are tools to help you identify generated data.
See Identifying Processing-Generated Data on page 268.
See Relating Generated Files to Original Files on page 268.

Creating and Configuring New Cases

Evidence Processing Options

| 78

Expanding Compound Files
You can expand individual compound file types. This lets you see child files that are contained within a container
such as ZIP files. You can access this feature from the Case Manager’s new case wizard, or from the Add
Evidence or Additional Analysis dialogs.
See Evidence Processing Options on page 76.
Unless noted, the following file types are expanded by default.
If you expand data, you will have files that are generated when the data was processed and were not part of the
original data. There are tools to help you identify generated data.
See Identifying Processing-Generated Data on page 268.
See Relating Generated Files to Original Files on page 268.
You can expand the following compound files:
7-ZIP
Active Directory
AOL Files
Blackberry IPD backup file
BZIP2
Chrome Bookmarks

Not expanded by default. See About Expanding Google Chrome and IE
9 Data on page 282.

Chrome Cache

Not expanded by default. See About Expanding Google Chrome and IE
9 Data on page 282.

Chrome SQLite

Not expanded by default. See About Expanding Google Chrome and IE
9 Data on page 282.

DBX
ESE DB

Expands ESE (Extensible Storage Engine) databases. See About
Extensible Storage Engine (ESE) Databases on page 281.

EMFSPOOL
EVTX

Not expanded by default. See Viewing Data in Windows XML Event Log
(EVTX) Files on page 269.

EXIF
GZIP
IE Recovery

Not expanded by default. Expands IE Recovery data that was stored
when access to a Web site was lost.
See Expanding Internet Artifact Data on page 285.

IE WebCache

Not expanded by default. Expands the Web cache data for IE 10 and
later IE versions. See About Expanding Data from Internet Explorer (IE)
Version 10 or Later on page 283.

IIS log files

Not expanded by default. See Viewing IIS Log File Data on page 271.

Internet Explorer Files

Expands Internet Explorer internet artifact data.
See Expanding Internet Artifact Data on page 285.

Creating and Configuring New Cases

Evidence Processing Options

| 79

Log2t CSV

Not expanded by default. This processing option will recognize CSV files
that are in the Log2timeline format and parses the data within the single
CSV into individual records within the case. The individual records from
the CSV will be interspersed with other data, giving you the ability to
perform more advanced timeline analysis across a very broad set of
data. In addition you can leverage the visualization engine to perform
more advanced timeline based visual analysis.
See Viewing Log2Timeline CSV File Data on page 275.

Lotus Notes (NSF)
MBOX
Mail.ru Chat

Parses Mail.RU Agent chat history files and email (mra.dbs).
Examining Internet Artifact Data (page 280)

Microsoft Exchange
MS Office, OLE and OPC documents
MSG
PDF
PKCS7 and S/MIME Files
PST
RAR
Registry

Not expanded by default. See Viewing Registry Timeline Data on
page 273.

RFC822 Email
SQLite Databases
TAR
Windows Thumbnails
ZIP, including ZIPX
Be aware of the following before you expand compound files:
If

you have labeled or hashed a family of files, then later choose to expand a compound file type that is
contained within that label or family, the newly expanded files do not inherit the labeling from the parent,
and the family hashes are not automatically regenerated.

Many

Lotus Notes emails, *.NSF, are being placed in the wrong folders in the Examiner.
This is a known issue wherein Lotus Notes routinely deletes the collection indexes. Lotus Notes client
has the ability to rebuild the collections from the formulas, but Examiner cannot. So if Lotus Notes data is
acquired shortly after the collections have been cleared, then the Examiner does not know where to put
the emails. These emails are all placed in a folder named "[other1]."
To work around: Open the NSF file in the Lotus Notes client, and then close (you may need to save), then
acquire the data and process it. The emails will all be in the right folder because the view collections are
recreated.

Compound

file types such as AOL, Blackberry IPD Backup, EMFSpool, EXIF, MSG, PST, RAR, and ZIP
can be selected individually for expansion. This feature is available from the Case Manager new case
wizard, or from the Add Evidence or Additional Analysis dialogs.

the file types selected are expanded. For example, if you select ZIP, and a RAR file is found within
the ZIP file, the RAR is not expanded.

Only

Creating and Configuring New Cases

Evidence Processing Options

| 80

To expand compound files
1.

Do one of the following:
For

new cases, in the New Case Options dialog click Detailed Options.

For

existing cases, in the Examiner, click Evidence > Additional Analysis.

Select Expand Compound Files.
The option File Signature Analysis is no longer forced to be checked when you select Expand
Compound Files. This lets you see the contents of compound files without necessarily having to
process them. You can choose to process them later, if it is deemed necessary or beneficial to the case.

Select Include Deleted Files if you also want to expand deleted compound files.

Click Expansion Options.

In the Compound File Expansions Options dialog do the following:
If

you do not want to expand office documents that do not have embedded items, select Only
expand office documents with embedded items.

Select

the types of compound files that you want expand.
Only the file types that you select are expanded. For example, if you select ZIP, and a RAR file is
contained within the ZIP file, then the RAR is not expanded.

Note: The option File Signature Analysis is not forced to be selected. This lets you initially see the
contents of compound files without necessarily having to process them. Processing can be done
later, if it is deemed necessary or beneficial to the case by selecting File Signature Analysis.
6.

In the Compound File Expansions Options dialog, click OK.

Click OK.

Using dtSearch Text Indexing
You can use the following indexing options to choose from when creating a new case.

Indexing a Case
All evidence should be indexed to aid in searches. Index evidence when it is added to the case by checking the
dtSearch Text Index box on the Evidence Processing Options dialog, or index after the fact by clicking and
specifying indexing options.
Scheduling is another factor in determining which process to select. Time restraints may not allow for all tasks to
be performed initially. For example, if you disable indexing, it shortens the time needed to process a case. You
can return at a later time and index the case if needed.

dtSearch Indexing Space Requirements
To estimate the space required for a dtSearch Text index, plan on approximately 25% of the space needed for
each case’s evidence.

Creating and Configuring New Cases

Evidence Processing Options

| 81

Configuring Case Indexing Options
Case Indexing gives you almost complete control over what goes in your case index. These options can be
applied globally from Case Manager.
Note: Search terms for pre-processing options support only ASCII characters.
These options must be set prior to case creation.

To set Indexing Options as the global default
1.

In Case Manager, click Case > New > Detailed Options.

In the Evidence Processing window, mark the dtSearch Text Index check box.

Click Indexing Options to bring up the Indexing Options dialog box.

Set the options using the information in the following table:

dtSearch Indexing Options
Option

Description

Letters

Specifies the letters and numbers to index. Specifies Original, Lowercase,
Uppercase, and Unaccented. Choose Add or Remove to customize the list.
You may need to add characters to this list for specific index searches to function
properly. For example, you may want to do an index search for
‘name@domain.com’. By default, the @ symbol is treated as a space and is not
indexed.
See Spaces on page 83.
To have the @ symbol included in the index, you would need to do two things:
 Remove the @ from the Spaces list.
Add the @ to the Letters list.

Noise Words

A list of words to be considered “noise” and ignored during indexing. Choose Add
or Remove to customize the list.

Hyphens

Specifies which characters are to be treated as hyphens. You can add standard
keyboard characters, or control characters. You can remove items as well.

Hyphen Treatment

Specifies how hyphens are to be treated in the index. Options are:
 Ignore
Hyphens will be treated as if they never existed. For example, the term “counter-culture” would be indexed as “counterculture.”
 Hyphen
Hyphens will be treated literally. For example, the term “counter-culture”
would be indexed as “counter-culture.”
 Space
Hyphens will be replaced by a non-breaking space. For example the term
“counter-culture” would be indexed as two separate entries in the index being
“counter” and “culture.”
 All
Terms with hyphens will be indexed using all three hyphen treatments. For
example the term “counter-culture” will be indexed as “counterculture”, “counter-culture”, and as two separate entries in the index being “counter” and “culture.”

Creating and Configuring New Cases

Evidence Processing Options

| 82

dtSearch Indexing Options (Continued)
Option

Description

Spaces

Specifies which special characters should be treated as spaces. Remove
characters from this list to have them indexed as any other text. Choose Add or
Remove to customize the list.
You may need to remove characters from this list for specific index searches to
function properly. For example, you may want to do an index search for
‘name@domain.com’. By default, the @ symbol is treated as a space and is not
indexed.
To have the @ symbol included in the index, you would need to do two things:
 Remove the @ from the Spaces list.
Add the @ to the Letters list.

Ignore

Specifies which control characters or other characters to ignore. Choose Add or
Remove to customize the list.

Max Word Length

Allows you to set a maximum word length to be indexed.

Index Binary Files

Specify how binary files will be indexed. Options are:
 Index all
 Skip
 Index all (Unicode)

Enable Date Recognition

Choose to enable or disable this option.

Presumed Date Format
For Ambiguous Dates

If date recognition is enabled, specify how ambiguous dates should be formatted
when encountered during indexing. Options are:
 MM/DD/YY
 DD/MM/YY
 YY/MM/DD

Set Max Memory

Allows you to set a maximum size for the index.

Auto-Commit Interval
(MB)

Allows you to specify an Auto-Commit Interval while indexing the case. When the
index reaches the specified size, the indexed data is saved to the index. The size
resets, and indexing continues until it reaches the maximum size, and saves
again, and so forth.

Note: The Indexing Options dialog does not support some Turkish characters.
5.

When finished setting Indexing Options, click OK to close the dialog.

Complete the Detailed Options dialog.

Click OK to close the Detailed Options dialog.

Specify the path and filename for the Default Options settings file.

Click Save.

10. In the Case Manager, click Case > New.
11. Proceed with case creation as usual. There is no need to click Detailed Options again in creating the

case to select options, unless you wish to use different settings for this case.
In addition to performing searches within the case, you can also use the Index to export a word list to use as a
source file for custom dictionaries to improve the likelihood and speed of password recovery related to case files
when using the Password Recovery Toolkit (PRTK). You can export the index by selecting File > Export Word
List. See also Searching Evidence with Index Search (page 311)

Creating and Configuring New Cases

Evidence Processing Options

| 83

Data Carving
Data carving is the process of looking for data on media that was deleted or lost from the file system. Often this
is done by identifying file headers and/or footers, and then “carving out” the blocks between these two
boundaries.
AccessData provides several specific pre-defined carvers that you can select when adding evidence to a case.
In addition, Custom Carvers allow you to create specific carvers to meet your exact needs.
Data carving can be selected in the New Case Wizard as explained below, or from within the Examiner. In
addition, because Custom Carvers are now a Shared feature, they can be accessed through the Manage menu.
These are explained below.

Pre-defined Carvers
The following pre-defined carvers are available. Some carvers are enabled by default.

Pre-defined Carvers
Carver

Enabled by default?

AOL bag files

Yes

BMP files

Yes

EMF files

Yes

GIF files

Yes

HTML files

Yes

JPEG files

Yes

LNK files

Yes

OLE files (MS Office)

Yes

PDF files

Yes

PNG files

Yes

TIFF files

Yes

ZIP files

Yes

AIM Chat Logs

Facebook Status Updates

Facebook Chat

Facebook Email Artifact

Facebook Mail Snippets

Facebook Fragment

Gmail Email Message

Gmail Parsed Email

Google Talk Chats

Hotmail Email Artifact

Bebo Chat

Firefox Form History

Firefox Places

Creating and Configuring New Cases

Evidence Processing Options

| 84

Pre-defined Carvers (Continued)
Firefox Session Store

Frostwire Props Files

GigaTribe Chat

IE8 Recovery URL

Limewire Props

Limewire/Frostwire Keyword Search

mIRC Chat Log

MySpace Chat

Twitter Status

Windows Messenger Plus w/chat logging

MSN/WLM Chat

Yahoo Diagnostic

Yahoo Webmail Chat

Yahoo Mail

Yahoo Group Chat Recvd

Yahoo Group Chat Sent

Yahoo Chat

Yahoo Chat UnAllocated

Yahoo Unencrypted Active

Ares P2P

Chrome History

Dropbox

eMule

Facebook

Flickr

Google Docs

Google Drive

Google Plus

Google Plus Chat

Hotmail

ICQ 7M Chat History

Explorer 10

Safari

Shareaza

SkyDrive

Skype, Skype 3

Torrent

Twitter

World of Warcraft

Creating and Configuring New Cases

Evidence Processing Options

| 85

Selecting Data Carving Options
If you are unfamiliar, please review Creating a Case (page 69) and Configuring Detailed Options for a Case
(page 70) before beginning this section.
When you are in the New Case Wizard in Detailed Options > Evidence Processing, click Data Carve >
Carving Options to open the dialog shown below.
If you already have a case open with evidence added and processed, click the following:
Evidence

> Additional Analysis > Data Carve > Carving Options

Standard Data Carving gives you a limited choice of which file types to carve.
Choose which types of data to carve according to the information below.

To set Data Carving options
1.

Select Data Carve.

Click Carving Options.

Select the types of files you want carved.
Click

Select All to select all file types to be carved.

Click

Clear All to unselect all file types.

Click

on individual file types to toggle either selected or unselected.

Note: It may help to be aware of the duplicate files and the number of times they appear in an evidence
set to determine intent.
4.

Depending on the file type highlighted, the Selected Carver Options may change. Define the optional
limiting factors to be applied to each file:
Define

the minimum byte file size for the selected type.

Define

the minimum pixel height for graphic files.

Define

the minimum pixel width for graphic files

Mark the box, Exclude KFF Ignorable files if needed.

If you want to define Custom Carvers, click Custom Carvers. (Custom Carvers are explained in the
next section.) When you are done with Custom Carvers, click Close.

In the Carving Options dialog, click OK.

Custom Carvers
The Custom Carvers dialog allows you to create your own data carvers in addition to the built-in carvers. Custom
Carvers can be created and shared from within a case, or from the Case Manager.
Application Administrators have the necessary permissions to access the Manage Shared Carvers dialog. Case
Administrators can manage the Custom Carvers in the cases they administer. Case Reviewers are not allowed
to manage Custom Carvers.
Shared Custom Carvers are automatically available globally; but can be copied to a case when needed. Carvers
created within a case are automatically available to the case, but can be shared and thus made available
globally.

Creating and Configuring New Cases

Evidence Processing Options

| 86

To access Manage Custom Carvers dialogs, click Manage > Carvers > Manage Custom Carvers (or Manage
Shared Carvers if you are an Application Administrator).
The Manage Shared Custom Carvers and Manage Custom Carvers dialogs are very similar. The difference is
whether you can copy the carvers to a case or make the carvers shared.
The Custom Carvers dialog allows you to define carving options for specific file types or information beyond
what is built-in. Once defined, these carving options files can be Shared with the database as well as exported
and imported for use in other cases. The original, local copy, remains in the case where it was created, for local
management.

To create a Custom Data Carver
1.

Click New.

Complete the data fields for the Custom Carver you are creating. Options are as follows:
Name

Name of the Carver

Author

Name of the Creator

Description

Summarizes the intended use of the carver

Minimum File Size (Optional)
in bytes
Maximum File Size (Optional) The default Custom Carver Maximum File Size is 2147483647 bytes.
in bytes
The carver Max File Size in bytes must be populated with any size larger than the
defined Minimum File Size in bytes (default is 0). A Maximum File Size equal to or
less than the minimum size, or , results in an error prompting for a valid
number to be entered.
File extension

Defining the extension of the carved file helps with categorization, sorting, and
filtering carved files along with other files in the case.

Key Signatures(s) Enter the ASCII text interpretation of the file signature as seen in a hex viewer.
and Other
Many can be defined, but at least one key signature must be present in the file in
Signatures(s)
order to be carved.
Click the + icon to begin defining a new Key Signature or Other Signature.
Click the - icon to remove a defined Key Signature or Other Signature.

File Category

The File Category the carved item will belong to once it is carved. The specified
category must be a leaf node in the Overview tab.

Offset

Use decimal value.

Length

The length in bytes.

Little Endian

If not marked, indicates Big Endian.

Signature

Enter the ASCII text interpretation of the file signature as seen in a hex viewer.

Case Insensitive

Default is case sensitive. Mark to make the end File Tag Signature not case
sensitive.

When done defining the Custom Carver, click Close.
Note: When adding signatures to a carver, the Signature is case sensitive check box is used when
carving for signatures that can be both upper or lower case. For example, and

Creating and Configuring New Cases

Evidence Processing Options

| 87

are both acceptable headers for HTML files, but each of these would have a different signature in
hex, so therefore they are case sensitive.
The

objects and files carved from default file types are automatically added to the case, and can be
searched, bookmarked, and organized along with the existing files.
However, custom carved data items are not added to the case until they are processed, and they
may not sort properly in the File List view. They are added to the bottom of the list, or at the top
for a Z-to-A search, regardless of the filename.

Creating and Configuring New Cases

Evidence Processing Options

| 88

Running Optical Character Recognition (OCR)
The Optical Character Recognition (OCR) process lets you extract text that is contained in graphics files. The
text is then indexed so that it can be, searched, and bookmarked.
Running OCR against a file type creates a new child file item. The graphic files are processed normally, and
another file with the parsed text from the graphic is created. The new OCR file is named the same as the parent
graphic, [graphicname.ext], but with the extension OCR, for example, graphicname.ext.ocr.
You can view the graphic files in the File Content View when it is selected in the File List View. The Natural tab
shows the graphic in its original form. The Filtered tab shows the OCR text that was added to the index.
Before running OCR, be aware of the following:
OCR

is only a helpful tool for the investigator to locate images from index searches. OCR results should
not be considered evidence without further review.

OCR

can have inconsistent results. OCR engines by nature have error rates. This means that it is
possible to have results that differ between processing jobs on the same machine with the same piece of
evidence.

Some

large images can cause OCR to take a very long time to complete. Under some circumstances,
they may not generate any output.

Graphical

images that have no text or pictures with unaligned text can generate bad output.

OCR

is best on typewritten text that is cleanly scanned or similarly generated. All other picture files can
generate unreliable output that can vary from run to run.

To run Optical Character Recognition
1.

Do one of the following:
For

new cases, in the New Case Options dialog click Detailed Options.

For

existing cases, in the Examiner, click Evidence > Additional Analysis.

Select Optical Character Recognition. OCR requires File Signature Analysis and dtSearch Indexing
to be selected. When Optical Character Recognition is marked, the other two options are automatically
marked and grayed-out to prevent inadvertent mistakes, and ensure successful processing.

Click OCR Options.

In the OCR Options dialog, select from the following options:

TABLE 5-1
Options

Description

File Types

Lets you specify which file types to include in the OCR process during case
processing. For PDF files, you can also control the maximum filtered text size
for which to run OCR against.

Filtering Options

Lets you specify a range in file size to include in the OCR process. You can
also specify whether or not to only run OCR against black and white, and
grayscale. The Restrict File Size option is selected by default. By default, OCR
file generation is restricted to files larger than 5K. If you do not want to limit the
size of OCR files, you must disable this option.

Engine

Lets you choose the OCR engine to use.

In the OCR Options dialog, click OK.

In the Evidence Processing dialog, click OK.

Creating and Configuring New Cases

Evidence Processing Options

| 89

Using Explicit Image Detection
About Explicit Image Detection
Explicit Image Detection (EID) is an add-on feature. Contact your sales representative for more information. EID
reads all graphics in a case and assigns both the files and the folders they are contained within a score
according to what it interprets as being possibly illicit content. The score ranges are explained later in this
section.

To add EID evidence to a case
1.

Click Evidence > Add/Remove.

In the Detailed Options > Evidence Processing dialog, ensure that File Signature Analysis is
marked.

Select Explicit Image Detection

Click EID Options.The three EID options are profiles that indicate the type of filtering that each one
does. You can choose between any combination of the following profiles depending on your needs:

TABLE 5-2
Profile
Name

Level

Description

X-DFT

Default
(XS1)

This is the most generally accurate. It is always selected.

X-FST

Fast (XTB)

This is the fastest. It scores a folder by the number of files it contains that meet
the criteria for a high likelihood of explicit material.
It is built on a different technology than X-DFT and does not use “regular” DNAs.
It is designed for very high volumes, or real-time page scoring. Its purpose is to
quickly reduce, or filter, the volume of data to a meaningful set.

X-ZFN

Less False
Negatives
(XT2)

This is a profile similar to X-FST but with more features and with fewer false
negatives than X-DFT.
You can apply this filter after initial processing to all evidence, or to only the
folders that score highly using the X-FST option. Check-mark or highlight those
folders to isolate them for Additional Analysis.
In Additional Analysis, File Signature Analysis must be selected for EID options to
work correctly.

When the profile is selected, click OK to return to the Evidence Processing dialog and complete your
selections.

AccessData recommends that you run Fast (X-FST) for folder scoring, and then follow with Less False
Negatives (X-ZFN) on high-scoring folders to achieve the fastest, most accurate results.
After you select EID in Evidence Processing or Additional Analysis, and the processing is complete, you must
select or modify a filter to include the EID related columns in the File List View.

Creating and Configuring New Cases

Evidence Processing Options

| 90

Including Registry Reports
The Registry Viewer supports Registry Summary Report (RSR) generation as part of case processing.

To generate Registry Summary Reports and make them available for the case report
1.

Ensure that File Signature Analysis is marked.

Mark Registry Reports.

Click RSR Directory.

Browse to the location where your RSR templates are stored.

Click OK.

Send Email Alert on Job Completion
You can select to send an email notification when a job completes.
This option is also available from Evidence > Additional Analysis. Enter the email address of the recipient in
the Job Completion Alert Address box, then click OK.
Note: Outgoing TCP traffic must be allowed on port 25.

Custom File Identification Options
Custom File Identification provides the examiner a way to specify which file category or extension should be
assigned to files with a certain signature. These dialogs are used to manage custom identifiers and extension
maps specific to the case.
In Detailed Options, the Custom File Identification dialog lets you select the Custom Identifier file to apply to the
new case. This file is stored on the system in a user-specified location. The location can be browsed to, by
clicking Browse, or reset to the root drive folder by clicking Reset.

Creating and Configuring New Cases

Evidence Processing Options

| 91

Creating Custom File Identifiers
Custom File Identifiers are used to assign categories to files that may or may not already be automatically
categorized in a way that is appropriate for the case. For example, a file that is discovered, but not categorized,
will be found under the “Unknown Types” category. You can prevent this categorization before the evidence is
processed by selecting a different category and sub-category.
Custom Identifiers provide a way for you to create and manage identifiers, and categorize the resulting files into
any part of the category tree on the Overview tab. You can select from an existing category, or create a new one
to fit your needs.
You can define identifiers using header information expected at a specific offset inside a file, as is now the case,
but in addition, you can categorize files based on extension.
Note: PDF files are now identified through the PDF file system and will no longer be identified through Custom
File Identification.

To create a Custom Identifier file
1.

In the Case Manager, click Case > New > Detailed Options.

Click Custom File Identification.

Below the Custom Identifiers pane on the left of the Custom File Identification dialog, click New. The
Custom Identifier dialog opens.

Fill in the fields with the appropriate values. The following table describes the parameters for Custom
File Identifiers:

TABLE 5-3
Parameter

Description

Name

The value of this field defines the name of the sub-category that will appear below the
selected Overview Tree category and the category column.

Description

Accompanies the Overview Container’s tree branch name.

Directory

Windows
Desktop
IE

Live Server

Search (Vista and Windows 7)

10 Web Data (for example, history, cookies, cache, and so forth)

SRS

(Site Replication Service) Template

Windows

Help Center

Windows

Update

Windows

System Update

Windows

Server Security

Windows

Server WINS

Windows

Server DHCP

NT

File Replication Service

These ESE databases are expanded when processing evidence (if selected in the Expansion Options) and
displayed in Evidence Groups. Most of the ESE databases appear in File Category > Databases. The exception
is Exchange ESE databases, which appear in File Category > Email.
Internet Explorer version 10 or later also use ESE databases to store data like the internet history, cookies,
cache, and so forth. (See About Expanding Data from Internet Explorer (IE) Version 10 or Later on page 283.)

To expand the ESE Databases into individual records
1.

In the Examiner, click Evidence > Additional Analysis.
See Using Additional Analysis on page 124.

Click Miscellaneous

Under Miscellany, select Expand Compound Files.

Select Expand Compound Files.

Click Expansion Options.

Verify that ESE DB is selected.

Click OK to save the expansion settings.

Click OK to process the evidence to expand the files.

Examining Miscellaneous Evidence

Examining Internet Artifact Data

| 281

About Expanding Google Chrome and IE 9 Data
There are advanced processing options that will expand the basic Google Chrome and Internet Explorer data.
You can do the following:
Expand

Google Chrome SQLite tables and IE 9 IE .DAT files to create individual records.
This provides investigators the ability to bookmark specific records from within the tables. For example, if
you are looking for a specific Top Site record, you can more easily find and bookmark the record you
need.

Reconstruct

web pages .
When viewing either Cache or History entries, if enough data is stored in the cache, you can see the
reconstructed web page that was cached when the user was browsing the respective web site.

The following table lists the expanded data that you can view:

Internet Artifact Expanded Data

Browser type

Expanded Browser Data

Chrome









Internet Explorer 9







Cache Index Data
Cookies
Downloads
History
Top Sites
Key Words
Web AUtofill Data
IE Cache Entries
IE Cookies Entries
IE History Entries
IE Download Entries
MSIE Recovery dat Entries

When viewing the expanded data, you can use the following columns in the File List to display detailed data.

Internet History Columns
















Action URL
Autofill Name
Autofill Value
Bytes Downloaded
Cookie Name
Cookie Path
Cookie Value
Count
Duration
Encrypted Card Number
End Time
Expiration Month
Expiration Time
Expiration Year
File Path


















Examining Miscellaneous Evidence

Google Profile Address
Google Profile City
Google Profile Company Name
Google Profile Country
Google Profile Country Code
Google Profile Email Address
Google Profile First Name
Google Profile Last Name
Google Profile Middle Name
Google Profile Phone Number
Google Profile State
Host Key
Last Updated Time
Last Visit Time
Name on Card
Offline User Email


















Opened
Origin URL
Password Element
Password Value
Rank
Redirects to
Start TIme
Terms
This Visit Time
Types Times
URL
URL has HTML
Username Element
Username Value
Visit TImes
Zip Code

Examining Internet Artifact Data

| 282

See Managing Columns on page 384.
See Icons of the File List Tool Bar on page 229.
If you expand internet artifact data, you will have files are are generated when the data was processed and was
not part of the original data. There are tools to help you identify generated data.
See Identifying Processing-Generated Data on page 268.
See Relating Generated Files to Original Files on page 268.

About Expanding Data from Internet Explorer (IE) Version 10 or Later
Data from Internet Explorer (IE) 10 is stored in a database called WebCacheV01.dat. This file is an ESE
(Extensible Storage Engine) database that points to IE 10’s cached files. When expanded in Examiner, you can
view the following data:

Internet Artifact Expanded Data

Browser type

Expanded Browser Data

Internet Explorer 10










IE Web Cache Compatibility Entries
IE Web Cache Content Entries
IE Web Cache Cookie Entries
IE Web Cache DOM Store Entries
IE Web Cache Download Entries
IE Web Cache RSS Feed Entries
IE Web Cache History Entries
Other Web Cache Entries

This data displays in the Overview tab under Internet/Chat Files or in the Internet/Chat tab.

IE 10 (and later) WebCache Data on a Live System
You cannot expand or display Internet Explorer 10 (or later) WebCache data from a live system. WebCache data
is locked by the Windows operating system and does not display correctly in the Examiner.

About Internet Artifact Processing Options
To expand internet artifact data, you enable processing options either when you add the evidence or later by
using Additional Analysis.
Note: The IE WebCache contains many files and can take additional time to expand. Therefore, IE WebCache
is not selected by default.
Important: Expanding internet artifact data can add a significant amount of data to your evidence.
See Evidence Processing Options on page 76.

Examining Miscellaneous Evidence

Examining Internet Artifact Data

| 283

See Using Additional Analysis on page 124.

Internet Artifact Processing Options
Browser

Options

De fu a lt value

Chrome

Expand Compound Files > Chrome Bookmarks

unselected by default

Expand Compound Files > Chrome Cache

unselected by default

Expand Compound Files > Chrome SQLite

unselected by default

Internet Explorer 9 or Expand Compound Files > Internet Explorer
earlier
Expand Compound Files > IE Recovery
This lets you expand IE Recovery data that was
stored when access to a Web site was lost.
Internet Explorer 10 Expand Compound Files > IE WebCache
or later

selected by default
unselected by default

unselected by default

About Viewing Internet Artifact Data
After you have expanded the artifact data, you can view the data in the Examiner. You can view expanded data
in one of the following ways:
Clicking

an individual file and viewing the contents in the Natural view.
For most items, you will see the data displayed in a table.
Viewing

Reconstructed web pages
For history and cache entries, if enough data exists, the reconstructed web page will be shown. If
enough data is not available, informational data will be displayed instead.
You can use the URL has HTML column to help you determine which files can be reconstructed.

Adding

columns to the File List that displays expanded data.
You can add columns for all of the expanded items that is generated. A sample is listed in the Internet
History Columns table above.
You can view a list of all of the Internet History columns by looking at the Internet History column group in
the column manager.
See Managing Columns on page 384.

In the Internet/Chat files folder, the files are organized as follows:
Chrome:
Original
The

Chrome artifact files are stored under the Chrome Browser Files folder

expanded data is stored under the Chrome Browser Data folder.

IE
Original
The

IE artifact files are stored under the Internet Explorer Browser Files folder

expanded data is stored under the Internet Explorer Browser Data folder.

Examining Miscellaneous Evidence

Examining Internet Artifact Data

| 284

Expanding Internet Artifact Data
To expand internet artifact data
1.

When either adding evidence to a case or performing Additional Analysis, access the processing
options.
See Evidence Processing Options on page 76.
See Using Additional Analysis on page 124.

Select the option to Expand Compound Files.

Click Expansion Options.

Select one or more of the following options:
Chrome:
 Chrome

Bookmarks
 Chrome SQLite
IE:
 Internet

Explorer Files
Recovery
See About Internet Artifact Processing Options on page 283.
 IE

Process your data.

Viewing Internet Artifact Data
To view expanded internet data in the Natural view
1.

In the examiner, open one of the following: (Both tabs display the same data.)
The

Overview tab > File Category > Internet/Chat Files

Note: Chrome SQLite files are also located in Internet/Chat Files.
The

Internet/Chat tab

For Chrome files, expand Chrome Browser > Chrome Browser Data.

For IE files, expand Internet Explorer Browser > Internet Explorer Browser Data.

Select a folder, such as Cookies.

Click an item in the File List.
The cookie’s data is displayed in the Natural view.

Click History.

Click an item in the File List.
If possible, the reconstructed web page will be shown. If insufficient data exists, informational data will
be shown instead.

You can perform a search for a specific value in the Natural view by clicking CTRL-F.

To view expanded internet data using columns
1.

In the examiner, open one of the following: (Both tabs display the same data.)
The

Overview tab > File Category > Internet/Chat Files

The

Internet/Chat tab

Click the Column Settings icon.
See Managing Columns on page 384.

Examining Miscellaneous Evidence

Examining Internet Artifact Data

| 285

Either create a new column template or edit an existing one.

In the Available Columns list, expand Data.

Add the desired columns to the template.
For example, to add columns for Chrome browser history data, use the following:
URL
Visit

TImes

Typed

Times

Last

VIsit Time

This

Visit Time

Duration

Click OK.

Select the template name you just configured.

Click Apply.
This applies the template to the File List.

Click Close.

10. Expand Chrome Browser > Chrome Browser Data.
11. Click History.

In this example, you will see the history data in the columns for each record.

Examining Miscellaneous Evidence

Examining Internet Artifact Data

| 286

Performing Cluster Analysis
Depending on the license, that you own, you can perform an analysis of files to determine related documents
and email threads. If there are files that are similar, one document is identified as the pivot, and then the other
related files are given a score that shows how closely they are related to the Pivot. If a score is 100, it is a perfect
match.
You perform the Cluster Analysis by enabling the Cluster Analysis processing option.
See Identifying Processing-Generated Data on page 268.
See Relating Generated Files to Original Files on page 268.
When you enable Cluster Analysis, you have the following options:
Document

Types to process - You can select to process the following file types:

Documents
Presentation
Spreadsheets
Email
Similarity

Threshold - Determines the level of similarity required for documents to be considered related
or near duplicates.

After processing is complete, you can add the Review Set Pivot and the Distance to Pivot columns in the File List
in the Examiner. You will also use the standard Item # column to identify the Pivot file.
See Managing Columns on page 384.

To Perform Cluster Analysis
1.

When either adding evidence to a case or performing Additional Analysis, access the processing
options.
See Selecting Lab/eDiscovery Options on page 98.
See Using Additional Analysis on page 124.

Select the option for Cluster Analysis.

Click NDA Options.

Select the document types to process and the similarity threshold.

Process your data.

To view Cluster Analysis data using columns
1.

In the examiner, view the file types that you selected.

Click the Column Settings icon.
See Managing Columns on page 384.

Either create a new column template or edit an existing one.

Add the following columns to the template.
Item

Review

Set Pivot

Distance

to Pivot

Click OK.

Examining Miscellaneous Evidence

Performing Cluster Analysis

| 287

Select the template name you just configured.

Click Apply.
This applies the template to the File List.

Click Close.
The Review Set Pivot shows the Item # of the Pivot file, or the file that other files are compared to.
If a file was identified as being a near duplicate, it will show a Distance to Pivot score. A perfect match
has a score of 100.

Viewing Data in Volume Shadow Copies
You can examine data that is contained in NTFS Volume Shadow Copies.
See Examining Data in Volume Shadow Copies on page 120.

Examining Miscellaneous Evidence

Viewing Data in Volume Shadow Copies

| 288

Examining Miscellaneous Evidence

Viewing Data in Volume Shadow Copies

| 289

Chapter 23

Bookmarking Evidence

This chapter includes the following topics
About

Bookmarks (page 290)

About

Timeline Bookmarks (page 291)

Using

the Bookmarks Tab (page 296)

Creating
Viewing

a Bookmark (page 291)

Bookmark Information (page 295)

Bookmarking
Adding

Selected Text (page 297)

to an Existing Bookmark (page 297)

Creating

Email or Email Attachment Bookmarks (page 298)

Adding

Email and Email Attachments to Existing Bookmarks (page 298)

Moving

a Bookmark (page 299)

Copying

a Bookmark (page 299)

Deleting

a Bookmark (page 299)

Deleting

Files from a Bookmark (page 299)

About Bookmarks
A bookmark is a group of files that you want to reference in your case. These are user-created and the list is
stored for later reference, and for use in the report output. You can create as many bookmarks as needed in a
case. Bookmarks can be nested within other bookmarks for convenience and categorization purposes.
Bookmarks help organize the case evidence by grouping related or similar files. For example, you can create a
bookmark of graphics that contain similar or related graphic images. The Bookmarks tab lists all bookmarks that
have been created in the current case.
Cases only apply to the case that they are created in.
When you create a case,

Bookmarking Evidence

About Bookmarks

| 290

About Timeline Bookmarks
When creating bookmarks, you can also create a Timeline type of bookmark. A Timeline bookmark lets you
show the chronological relationships of the files in your case. When you create a Timeline bookmark, you can
record the Create Date, Accessed Date, and Modified Date for files as individual items. You can then export that
data to a CSV report file. Each action (create, accessed, modified) for each file is a separate item in the report.
When sorted by the date and time, the CSV report file presents a chronological timeline of the actions of the
evidence files in your case.
For example, you can create a bookmark of files that were downloaded from the internet. The report shows
when the files were downloaded (created) and the time interval between then and wthey were last accessed.
You can also see if and when the files were modified.
You can also add manual timeline data. Manual timeline data lets you add items to your timeline that may not be
represented by the files in your case. For example, you may have phone logs that show when relevant phone
calls were placed. You can add those phone calls as manual timeline items so that they appear in your report
along with the file information in the case.
You can use the exported CSV file produce you own chronological timeline of the evidence in the case. This can
present a clearer view of how certain events happened which can help investigators communicate to the jurors
and judge on their case.
The CSV report file includes the following data as columns:
The

date/time stamp of the file action

The

type of file action (Modified, Accessed, Created, or Other)
The Other category is used for manual timeline entries.

The

bookmark name

The

filename

Any

comments that you manually entered for each item

A bookmark can either be a timeline bookmark or a regular bookmark, but not both.

Creating a Bookmark
To create a bookmark
1.

In the File List view , select the files that you want to add to the bookmark.
You can either highlight the files that you want to include, check the boxes of the files that you want to
include, or do nothing to include all files.

Right-click on a selected file in the File List view and click Create Bookmark.

Enter the information about the bookmark.
See Bookmarks Dialog Options on page 292.

Click OK.
Note: Applying filters to a group of listed files for bookmarking can speed the process. The All
Highlighted setting does not work in this instance. Enabling this feature would significantly slow
the response of the program. Instead, use either the Checked Files filter, or the All Files Listed
filter.

Bookmarking Evidence

Creating a Bookmark

| 291

Bookmarks Dialog Options
Options of the Bookmark Information Pane
Fields

Descriptions

Bookmark Name

The name of the bookmark.

Bookmark Comment

Comments about the bookmark or its contents.

Files to Include

Specify which files in the File List to include in this bookmark. You can
select one of the following:
 All Highlighted - Includes only the highlighted items.
 All Checked - Includes only the checked items.

All Listed - Includes all items in the File List.

Timeline Bookmark

Select this option to make this a Timeline bookmark. If you select the
Timeline tab, this options is selected automatically.
A bookmark can either be a timeline bookmark or a regular bookmark,
but not both.

Select Existing Bookmark

Select the parent bookmark under which you would like to save the
bookmark.
A default shared tree for bookmarks available to all investigators is
created, and a bookmark tree specific to the case owner is created.
If the bookmark is related to an older bookmark it can be added under
the older bookmark, with the older bookmark being the parent, or it can
be saved as a peer.

Comments
tab

This lets you configure elements of a standard bookmark.
File Comments

You can assign a comment to each file in the bookmark.

Supplementary
Files

You can add external, supplementary files associated with the
bookmark. Options are:
 Attach: Allows the investigator to add external supplementary files to
the bookmark. The attached files appear in the Supplementary Files
pane and are copied to the case folder.
 Remove: Removes a selected supplementary file from the bookmark.

Bookmarking Evidence

Bookmarks Dialog Options

| 292

Options of the Bookmark Information Pane (Continued)
Fields

Descriptions
Also include

If applicable, you can include the following:
Parent index.dat
The option to include Parent index.dat is only available if you have
selected to bookmark an index entry, for example a cookie. This
option includes the entry’s parent index.DAT file in the bookmark.
 Email Attachments - If one of the items selected is an email with
attachments, this will include all of the attachments that the email
has.
 Parent Email - If one of the items selected is an email attachment
object, selecting this option will include the parent email.
 Exclude Selected OCR Extractions
The Exclude Selected OCR Extractions check box appears only
when OCR- extracted files have been selected when creating a new
or adding to an existing bookmark. If, instead, you have selected
graphic files, and have not selected their OCR counterparts, the
check box for OCR Extractions of selected Graphics will be active
and available.
 Actual Source File
This option lets you include the parent child of a processing-generated file.
See Relating Generated Files to Original Files on page 268.


Bookmark
Selection in File

Timeline tab

Check this item to have the highlighted text in a file automatically
highlighted when the bookmark is re-opened. The highlighted text also
prints in the report.
The selected text that will be included displays in the text box below the
check box.
This lets you configure elements of a Timeline bookmark.

Create Date

Select this option to record the date and time that the file was created.

Accessed Date

Select this option to record the date and time that the file was last
accessed.

Modified Date

Select this option to record the date and time that the file was last
modified.

Object Timeline
Comments

You can assign a comment to each file timestamp in the bookmark.
The timeline comments are shown in the timeline report anchored to
each date, and each date being used will crate a new row in the text
report.

Manual
Timeline Data

In this section, you can add manual timeline entries that are not available
as items in the File List.
For example, you may have access to phone records and you can add
call histories as individual manual entries.
You enter the date and time of the items and then in the CSV, they are
displayed chronologically with the other items in your bookmark.
Note: Manual items are listed as Other in the report.

Manual
Timeline
Comments

(Optional) Enter a comment or description to enter a Manual Timeline
item.

Manual Date

Enter the date of the Manual Timeline item.
You can click the drop-down arrow to open a calendar.

Bookmarking Evidence

Bookmarks Dialog Options

| 293

Options of the Bookmark Information Pane (Continued)
Fields

Descriptions
Manual Time

Enter the time of the Manual Timeline item.

Add

Click Add to save the Manual Timeline item.
The item is added to the Manual Timeline Entries list.

Remove

Highlight a Manual Timeline entry and click Delete to remove it from the
list.

Manual
Timeline Entries

The list Manual Timeline items that you have added.

Select Bookmark Parent

Bookmarking Evidence

Select the parent bookmark under which you would like to save the
bookmark.
There are two default bookmark parents:
 A Shared tree that is available to all investigators
 A bookmark tree specific to the logged-in-user
Administrators and Case Administrators can see and use all bookmarks
in a case.
If the bookmark is related to an older bookmark it can be added under
the older bookmark, with the older bookmark being the parent, or it can
be saved as a peer.

Bookmarks Dialog Options

| 294

Viewing Bookmark Information
The Bookmark Information pane displays information about the selected bookmark and the selected bookmark
file. The data in this pane is editable by anyone with sufficient rights.
Select a bookmark in the Bookmarks tree view of the Bookmarks tab, or in the Bookmarks node in the tree of the
Overview tab to view information about a bookmark. The Overview tab view provides limited information about
the bookmarks in the case. The Bookmark tab provides all information about all bookmarks in the case. In the
Bookmark tab, the Bookmark Information pane displays the Bookmark Name, Creator Name, Bookmark
Comment, and Supplementary files. When selected, a list of files contained in the bookmark displays in the File
List. If you select a file from the File List, the comment and selection information pertaining to that file displays in
the Bookmark Information pane.
Bookmarked files display in a different color in the File List pane than non-bookmarked files for easy
identification.
Change any of the information displayed from this pane. Changes are automatically saved when you change the
bookmark selection.
In the File List, bookmarked items display in a different color for easy identification. You may need to refresh the
view to force a rewrite of the screen for the different color to display. Forcing a rewrite would impact the overall
performance of the program.

Creating a Timeline Bookmark Report
After you have created Timeline Bookmarks, you can crate Timeline Bookmark Reports. The reports are in CSV
format. You can specify one or more Timeline Bookmarks for each report. You specify one or more Timeline
Bookmarks for each report. You specify the location and name of the saved CSV report.
See About Timeline Bookmarks on page 291.

To create a timeline Bookmark Report
1.

In the Examiner, click File > Timeline > Report.

Select one or more Timeline Bookmarks to use for the report.

(Optional) Select one of the following
Select
Clear

All Children - This selects all of the children of the selected bookmarks in the bookmark tree.

All Children - This clears all of the children of the selected bookmarks in the bookmark tree.

Click Select to select an output folder.
4a.

Select the folder to save the report in.

4b.

Specify the name of the report or use the default Timeline Report name.

Click Generate to save the report.

Bookmarking Evidence

Viewing Bookmark Information

| 295

Using the Bookmarks Tab
Options of the Bookmark Information Pane
Fields

Descriptions

Bookmark Name

The name of the bookmark. Click Save Changes to store any changes made to this field.

Creator Name

Displays the non-editable name of the user who created the bookmark.

Bookmark Comment The investigator can assign a text comment to the bookmark. Click Save Changes to store
any changes made to this field at any time.
Comments tab

Bookmarking Evidence

This lets you configure elements of a standard bookmark.
Supplementary Files

Displays a list of external, supplementary files associated with
the bookmark. Options are:
 Attach: Allows the investigator to add external supplementary
files to the bookmark, these files are copied to a subdirectory
within the case folder and referenced from there.
 Remove: Removes a selected supplementary file from the
bookmark.

File Comments

The investigator can assign a different comment to each file in
the bookmark. Click Save Changes to store any changes made
to this field.

Selection Comments

Each file within the bookmark may contain an unlimited number
of selections, each of which the investigator may assign a
comment. These comments can be edited.
 Save Changes: Stores any changes made to this Selection
Comments field.
 Clear Changes: Clears any unsaved changes made to the
bookmark information.

Selections

Displays a list of stored selections within the selected file.
 Add Selection: Stores the selection boundaries of the swept
text in the File Content pane. This button does not store
selection information for the Web tab.
 Remove Selection: Removes the highlighted selection from
the Selections list.

Using the Bookmarks Tab

| 296

Bookmarking Selected Text
Bookmarked selections are independent of the view in which they were made. Select hex data in the Hex view of
a bookmarked file and save it; bookmark different text in the Filtered view of the same file and save that
selection as well.

To add selected text in a bookmark
1.

Open the file containing the text you want to select.

From the Natural, Text, Filtered or Hex views, make your selection.
Note: If the file is a graphic file, you will not see, nor be able to make selections in the Text or the
Natural views.

Click Create Bookmark in the File List toolbar to open the Create New Bookmark dialog.

When creating your bookmark, check Bookmark Selection in File.

To save selected content, choose the view that shows what you want to save, then highlight the content
to save.

Right-click on the selected content. Click Save As.

In the Save As dialog, provide a name for the selection and click Save.
The selection remains in the bookmark.

Adding to an Existing Bookmark
Sometimes additional information or files are desired in a bookmark.

To add to an existing bookmark
1.

Select the files to be added to the existing bookmark.

Right-click the new files.

Click Add to Bookmark.

When available (depending on the type of files you are adding), make selections for Files to Add, Also
Include, OCR Extractions of Selected Graphics, and Bookmark Selection in File.

Open the parent bookmark tree.

Select the child bookmark to add the file or information to.

Click OK.

Bookmarking Evidence

Bookmarking Selected Text

| 297

Creating Email or Email Attachment Bookmarks
When bookmarking an email, you can also add and bookmark any attachments. You can also include a parent
email when you bookmark an email attachment.
To create a bookmark for an email, follow the steps for creating a bookmark. Select the email to include in the
bookmark. Right-click and choose Create Bookmark. Note that by default, the Email Attachments box is
active, but unmarked. If only the parent email is needed, the Email Attachments box should remain unselected.
Complete the bookmark creation normally by naming the bookmark, selecting the bookmark parent, then
clicking OK.
If you need to bookmark only an attachment of the email, select and right-click on the attachment. Choose
Create Bookmark. For more information on creating bookmarks, see, Creating a Bookmark (page 291).
Notice that the Parent Email box is automatically active, allowing you to include the parent email if it is not part of
the selection you have already made. If the Parent Email box is checked, and there is more than one
attachment, the Email Attachments box becomes active as well, allowing you to also include all attachments to
the parent email. To add only the originally selected attachment to the bookmark, do not check the Parent Email
box.

Adding Email and Email Attachments to Existing
Bookmarks
To add an email to a bookmark, select the email to add, then right-click on the email and choose Add To
Bookmark. Note that if emails are selected, but their attachments are not selected, the Email Attachments box
is active, but not marked. If only the parent email is needed, the Email Attachments box can remain unselected.
If you have selected only the attachment, include the attachment’s parent email by marking the Parent Email
box.
One way to be sure to find the exact items you want is to highlight an interesting item in the File List view in one
tab, then right-click on it and select View This Item in a Different List. Click on Email and you are taken to the
Email tab with the selected email highlighted in the File List view, and displayed in the Natural tab in the File
Content pane. In the Email Attachments pane on the right that file is displayed, along with its role; whether it is a
parent email, part of the email thread, or an attachment.
If only an attachment of an email is needed to be added to the bookmark, select the attachment and follow the
instructions for adding to a bookmark.

Bookmarking Evidence

Creating Email or Email Attachment Bookmarks

| 298

Moving a Bookmark
To move a bookmark
1.

From either the Bookmark tab or the Overview tab, select the bookmark you want to move.

Drag the bookmark to the desired location and then release the mouse button.

Copying a Bookmark
To copy a bookmark
1.

From either the Bookmark tab or the Overview tab, select the bookmark you want to copy.

Using the right mouse button, drag the bookmark to the desired location and release the mouse button.

Deleting a Bookmark
To delete a bookmark
1.

In the Bookmark tab, expand the bookmark list and highlight the bookmark to be removed.

Do one of the following:
Press

the Delete key.

Right-click

on the bookmark to delete, and click Delete Bookmark.

Deleting Files from a Bookmark
To delete files from a bookmark
1.

From either the Overview tab or the Bookmarks tab, open the bookmark containing the file you want to
delete.

Right-click the file in the Bookmark File List pane.

Do one of the following:
Select

Remove from Bookmark.

Press

the Delete key on your keyboard. You will be prompted, “Are you sure you want to delete files
from this bookmark?” Click Yes.

Deleting

Bookmarking Evidence

a file from a bookmark does not delete the file from the case.

Moving a Bookmark

| 299

Chapter 24

Searching Evidence with Live Search

Searching evidence for information pertaining to a case can be one of the most crucial steps in the examination.
An index search gives rapid results, and a live search includes options such as text searching and hexadecimal
searching. You can view search results from the File List and File Contents views of the Search tab.

The Live Search is a process involving a bit-by-bit comparison of the entire evidence set with the search term.
This chapter includes the following topics
Conducting

a Live Search (page 300)

Live

Text Search (page 301)

Live

Hex Search (page 303)

Live

Pattern Search (page 304)

Using

Pattern Searches (page 304)

Predefined
Creating

Regular Expressions (page 307)

Custom Regular Expressions (page 309)

Conducting a Live Search
The live search takes slightly more time than an index search because it involves a bit-by-bit comparison of the
search term to the evidence. A live search is flexible because it can find patterns of non-alphanumeric
characters, including those that are not generally indexed. It is powerful because you can define those patterns
to meet your needs in an investigation.

Searching Evidence with Live Search

Conducting a Live Search

| 300

Live Text Search
A Text search finds all strings that match an exact entry, such as a specific phone number (801-377-5410).
When conducting a Live Text Search, there are no arrows to click for operand selection.
A Live Text Search gives you options such as ANSI, Unicode with UTF-16 Little Endian, UTF-16 Big Endian, and
UTF-8. The latter two are always case-sensitive. You can also choose from a list of other Code Pages to apply to
the current search. In addition, you can select Case Sensitivity for any Live Text Search.
Note: When entering Chinese characters into search, you must have both ANSI and Unicode options selected.
The difference between a Pattern search and a Text search is that a text search searches for the exact typed
text, there are no operands so the results return exactly as typed. For example, a simple Pattern search allows
you to find all strings that match a certain pattern, such as for any 10-digit phone number (nnn-nnn-nnnn), or a
nine-digit social security number (nnn-nn-nnnn).
More complex Pattern searches (“regex”) require specific syntax. See Live Pattern Search (page 304).
Search terms can be entered then exported as XML files, then imported at any time, or with any case. Text files
can be imported and used in Live Search, however the Live Search Export feature supports only XML format.
Note: When importing TXT files that the search of those terms depend on the specific tab your in. (ie If I have a
few hex terms and import the TXT list into Live Search in the Patterns tab), the search is run as a pattern
search and not hex.

To Conduct a Live Text search
1.

In the Live Search tab, click the Text tab.
In the Text or Pattern tabs, you can check the character sets to include in the search.

If you want to include sets other than ANSI and Unicode, check Other Code Pages and click Select.

Select the needed sets.

Click to include EBCDIC, Mac, and Multibyte as needed.

Click OK to close the dialog.

Check Case Sensitive if you want to search specifically uppercase or lowercase letters as entered.
Case is ignored if this box is not checked.

Enter the term in the Search Term field.

Click Add to add the term to the Search Terms window.

Click Clear to remove all terms from the Search Terms window.

10. Repeat Steps 7, 8, and 9 as needed until you have your search list complete.

When you have added the search terms for this search, it is a good idea to export the search terms to a
file that can be imported later, saving the time of re-entering every item, and the risk of errors. This is
particularly helpful for customized pattern searches.
11. In the Max Hits Per File field, enter the maximum number of search hits you want listed per file. The

default is 200. The range is 1 to 65,535. If you want to apply a filter, do so from the Filter drop-down list
in the bar below the Search Terms list. Applying a filter speeds up searching by eliminating items that do
not match the filter. The tab filter menu has no effect on filtering for searches.
12. Click Search.
13. Select the results to view from the Live Search Results pane. Click the plus icon (+) next to a search line

to expand the branch. Individual search results are listed in the Live Search Results pane, and the

Searching Evidence with Live Search

Live Text Search

| 301

corresponding files are listed in the File List. To view a specific item, select the hit in the search results.
Selected hits are highlighted in the Hex View tab.
14. When a search is running you can click View > Progress Window to see how the job is progressing.

Note: In the progress window, you can Pause, Resume, and Cancel jobs, in addition to closing the
window. (Pause and Resume are the same button, but the label changes depending on
processing activity.)

Note: Mark the Remove when finished check box to take completed jobs off the list for housekeeping
purposes.
15. When processing is complete, return to the Live Search tab to review the results.

Right-click on a search result in the Live Search Results pane to display more options. The available
right-click options are as follows:

TABLE 24-1
Option

Description

Create Bookmark

Opens the Create New Bookmark dialog.

Copy to Clipboard

Opens a new context-sensitive menu. Options are:





Export to File

All Hits In Case
All Hits In Search
All Hits In Term
All Hits In File





All File Stats In Case
All File Stats In Search
All File Stats In Term

Opens a new context-sensitive menu. Options are:





All Hits In Case
All Hits In Search
All Hits In Term
All Hits In File





All File Stats In Case
All File Stats In Search
All File Stats In Term

Set Context Data Width

Opens the Data Export Options window. Allows you to set a context width from 32
to 2000 characters within which it can find and display the search hit.

Export Search Term

Select to export a search term list that can be imported into this or other cases.

Delete All Search
Results

Deletes all search results from the Live Search Results pane.

Delete this Line

Deletes only the highlighted search results line from the Live Search Results pane.

Searching before the case has finished processing will return incomplete results. Wait to search until the case
has finished processing and the entire body of data is available.
Note: Search terms for pre-processing options support only ASCII characters.

Searching Evidence with Live Search

Live Text Search

| 302

Live Hex Search
Hexadecimal (Hex) format includes pairs of characters in a base 16 numeric scheme, 0-9 and a-f. Hex searching
allows you to search for repeating instances of data in Hex-format, and to save Hex-format data search strings to
an XML file and re-use it in this or other cases.
Click the Hex (Hexadecimal) tab to enter a term by typing it directly into the search field, by clicking the
Hexadecimal character buttons provided, or by copying hex content from the hex viewer of another file and
pasting it into the search box. Click Add to add the hex string to the search terms list.
The instructions for conducting a live search on the hex tab are similar to conducting searches on the Pattern
tab. Remember, when searching for hexadecimal values, a single alphabetic or numeric text character is
represented by hex characters in pairs.

To do a Hex search
1.

In the Live Search tab, click the Hex tab.

Add Hex search strings using the keyboard or using the Alpha-numeric bar above the Search Terms
box.

Click Add to add the term to the Search Terms window.

Click Clear to remove all terms from the Search Terms window.

Repeat Steps 2, 3, and 4 as needed until you have your search list complete.

When you have added the search terms for this search, it is a good idea to export the search terms to a
file that can be imported later, saving the time of re-entering every item, and reduces the risk of errors.
This is particularly helpful for customized pattern searches.

In the Max Hits Per File field, enter the maximum number of search hits you want listed per file. The
default is 200. The range is 1 to 65,535. If you want to apply a filter, do so from the Filter drop-down list
in the bar below the Search Terms list. Applying a filter speeds up searching by eliminating items that do
not match the filter. The tab filter menu has no effect on filtering for searches.

Click Search.

Select the results to view from the Live Search Results pane. Click the plus icon (+) next to a search line
to expand the branch. Individual search results are listed in the Live Search Results pane, and the
corresponding files are listed in the File List. To view a specific item, select the file in the search results.
All search results are highlighted in the Hex View tab.

Searching Evidence with Live Search

Live Hex Search

| 303

Live Pattern Search
The more complex Live Pattern “Regex” style search can be used to create pattern searches, allowing forensics
analysts to search through large quantities of text information for repeating strings of data such as:
Telephone
Social

Security Numbers

Computer
Credit

Numbers
IP Addresses

Card Numbers

In the Live Search tab, click the Pattern tab. Each has different options.
The patterns consist of precise character strings formatted as mathematical-style statements that describe a
data pattern such as a credit card or social security number. Pattern searches allow the discovery of data items
that conform to the pattern described by the expression, rather than what a known and explicitly entered string
looks for.
These pattern searches are similar to arithmetic expressions that have operands, operators, sub-expressions,
and a value. For example, the following table identifies the mathematical components in the arithmetic
expression, 5/((1+2)*3).

Regex Pattern Search Components
Component

Example

Operands

5, 1, 2, 3

Operators

/, ( ), +, *

Sub-Expressions

(1+2), ((1+2)*3)

Value

Approximately 0.556

Like the arithmetic expression in this example, pattern searches have operands, operators, sub-expressions,
and a value.
Note: Unlike arithmetic expressions, which can only have numeric operands, operands in pattern searches can
be any characters that can be typed on a keyboard, such as alphabetic, numeric, and symbol characters.

Using Pattern Searches
A pattern search can consists of operands. The search engine searches left to right.
Operators let regular expressions search patterns of data rather than for specific values. For example, the
operators in the following expression enable the search engine to find all Visa and MasterCard credit card
numbers in case evidence files:

\<((\d\d\d\d)[\– ]){3}\d\d\d\d\>

Searching Evidence with Live Search

Live Pattern Search

| 304

Without the use of operators, the search engine could look for only one credit card number at a time.

Visa and MasterCard Regular Expressions
Example

Operands

\–, spacebar space

Operators

\, \<, <, ( ), [ ], {3}, \>

Sub-expressions

(\d\d\d\d), ((\d\d\d\d)[\– ])

Value

Any sequence of sixteen decimal digits that is delimited by three hyphens and bound on
both sides by non-word characters

(xxxx–xxxx–xxxx–xxxx).

As the pattern search engine evaluates an expression in left-to-right order, the first operand it encounters is the
backslash less-than combination (\<). This combination is also known as the begin-a-word operator. This
operator tells the search engine that the first character in any search hit immediately follows a non-word
character such as white space or other word delimiter.
Note: A precise definition of non-word characters and constituent-word characters in regular expressions is
difficult to find. Consequently, experimentation may be the best way to determine if the forward slash lessthan (\<) and forward slash greater-than (\>) operators help find the data patterns relevant to a specific
searching task. The hyphen and the period are examples of valid delimiters or non-word characters.
The begin-a-word operator illustrates one of two uses of the backslash or escape character ( \ ), used for the
modification of operands and operators. On its own, the left angle bracket (<) would be evaluated as an operand,
requiring the search engine to look next for a left angle bracket character. However, when the escape character
immediately precedes the (<), the two characters are interpreted together as the begin-a-word operator by the
search engine. When an escape character precedes a hyphen (-) character, which is normally considered to be
an operator, the two characters (\-) require the search engine to look next for a hyphen character and not apply
the hyphen operator (the meaning of the hyphen operator is discussed below).
The parentheses operator ( ) groups together a sub-expression, that is, a sequence of characters that must be
treated as a group and not as individual operands.
The \d operator, which is another instance of an operand being modified by the escape character, is interpreted
by the search engine to mean that the next character in search hits found may be any decimal digit character
from 0-9.
The square brackets ([ ]) indicate that the next character in the sequence must be one of the characters listed
between the brackets or escaped characters. In the case of the credit card expression, the backslash-hyphenspacebar space ([\-spacebar space]) means that the four decimal digits must be followed by either a hyphen or a
spacebar space.
The {3} means that the preceding sub-expression must repeat three times, back to back. The number in the
curly brackets ({ }) can be any positive number.
Finally, the backslash greater-than combination (\>), also known as the end-a-word operator, means that the
preceding expression must be followed by a non-word character.
Sometimes there are ways to search for the same data using different expressions. It should be noted that there
is no one-to-one correspondence between the expression and the pattern it is supposed to find. Thus the
preceding credit card pattern search is not the only way to search for Visa or MasterCard credit card numbers.

Searching Evidence with Live Search

Live Pattern Search

| 305

Because some pattern search operators have related meanings, there is more than one way to compose a
pattern search to find a specific pattern of text. For instance, the following pattern search has the same meaning
as the preceding credit card expression:

\<((\d\d\d\d)(\–| )){3}\d\d\d\d\>
The difference here is the use of the pipe (|) or union operator. The union operator means that the next character
to match is either the left operand (the hyphen) or the right operand (the spacebar space). The similar meaning
of the pipe (|) and square bracket ([ ]) operators give both expressions equivalent functions.
In addition to the previous two examples, the credit card pattern search could be composed as follows:

\<\d\d\d\d(\–| )\d\d\d\d(\–| )\d\d\d\d(\–| )\d\d\d\d\>
This expression explicitly states each element of the data pattern, whereas the {3} operator in the first two
examples provides a type of mathematical shorthand for more succinct regular expressions.

Searching Evidence with Live Search

Live Pattern Search

| 306

Predefined Regular Expressions
Many predefined regular expressions are provided for pattern searching.

Examples of Predefined Regular Expressions


U.S. Social Security Numbers



IP Addresses



U.S. Phone Numbers



Visa and MasterCard Numbers



U.K. Phone Numbers



Computer Hardware MAC Addresses

Social Security Number
The pattern search for Social Security numbers follows a relatively simple model:

\<\d\d\d[\– ]\d\d[\– ]\d\d\d\d\>
This expression reads as follows: find a sequence of text that begins with three decimal digits, followed by a
hyphen or spacebar space. This sequence is followed by two more decimal digits and a hyphen or spacebar
space, followed by four more decimal digits. This entire sequence must be bounded on both ends by non-word
characters.

U.S. Phone Number
The pattern search for U.S. phone numbers is more complex:

((\<1[\–\. ])?(\(|\<)\d\d\d[\)\.\–/ ] ?)?\<\d\d\d[\.\– ]\d\d\d\d\>
The first part of the above expression,

((\<1[\–\. ])?(\(|\<)\d\d\d[\)\.\–/ ] ?)?,
means that an area code may or may not precede the seven digit phone number. This meaning is achieved
through the use of the question mark (?) operator. This operator requires that the sub-expression immediately to
its left appear exactly zero or one times in any search hits. This U.S. Phone Number expression finds telephone
numbers with or without area codes.
This expression also indicates that if an area code is present, a number one (1) may or may not precede the
area code. This meaning is achieved through the sub-expression (\<1[\–\. ])?, which says that if there is a “1”
before the area code, it will follow a non-word character and be separated from the area code by a delimiter
(period, hyphen, or spacebar space).
The next sub-expression, (\(|\<)\d\d\d[\)\.\–/ ] ?, specifies how the area code must appear in any search
hits. The \(|\<) requires that the area code begin with a left parenthesis or other delimiter. The left parenthesis
is, of necessity, escaped. The initial delimiter is followed by three decimal digits, then another delimiter, a right
parenthesis, a period, a hyphen, a forward slash, or a spacebar space. Lastly, the question mark (?) means that
there may or may not be one spacebar space after the final delimiter.
The latter portion of this expression, \<\d\d\d[\.\– ]\d\d\d\d\>, requests a seven-digit phone number with a
delimiter (period, hyphen, or spacebar space) between the third and fourth decimal digit characters. Note that
typically, the period is an operator. It means that the next character in the pattern can be any valid character. To
specify an actual period (.), the character must be escaped ( \ .). The backslash period combination is included in
the expression to catch phone numbers delimited by a period character.

Searching Evidence with Live Search

Predefined Regular Expressions

| 307

IP Address
An IP address is a 32-bit value that uniquely identifies a computer on a TCP/IP network, including the . Currently,
all IP addresses are represented by a numeric sequence of four fields separated by the period character. Each
field can contain any number from 0 to 255. The following pattern search locates IP addresses:

\<[1-2]?[0-9]?[0-9]\.[1-2]?[0-9]?[0-9]\.[1-2]?[0-9]?[0-9]\.[1-2]?[0-9]?[0-9]\>
The IP Address expression requires the search engine to find a sequence of data with four fields separated by
periods (.). The data sequence must also be bound on both sides by non-word characters.
Note that the square brackets ([ ]) still behave as a set operator, meaning that the next character in the sequence
can be any one of the values specified in the square brackets ([ ]). Also note that the hyphen (-) is not escaped;
it is an operator that expresses ranges of characters.
Each field in an IP address can contain up to three characters. Reading the expression left to right, the first
character, if present, must be a 1 or a 2. The second character, if present, can be any value 0–9. The square
brackets ([ ]) indicate the possible range of characters and the question mark (?) indicates that the value is
optional; that is, it may or may not be present. The third character is required; therefore, there is no question
mark. However, the value can still be any number 0–9.
You can build your own regular expressions by experimenting with the default expressions. You can modify the
default expressions to fine-tune your data searches or to create your own expressions.
Visit the AccessData website, www.accessdata.com, to find a technical document on Regular Expressions.

Searching Evidence with Live Search

Predefined Regular Expressions

| 308

Creating Custom Regular Expressions
Create your own customized regular expressions using the following list of common operators

Common Regular Expression Operators
Operator

Description

A period matches any character.

Matches the preceding sub-expression one or more times. For example, “ba+” will find all
instances of “ba,” “baa,” “baaa,” and so forth; but it will not find “b.”

Matches the end of a line.

Matches the preceding sub-expression zero or more times. For example, “ba*” will find all
instances of “b,” “ba,” “baa,” “baaa,” and so forth.

Matches the preceding sub-expression zero or one times.

[]

Matches any single value within the square brackets. For example, “ab[xyz]” will find “abx,”
“aby,” and “abz.”

A hyphen (-) specifies ranges of characters within the brackets. For example, “ab[0-3]” will
find “ab0,” “ab1,” “ab2,” and “ab3.” You can also specify case specific ranges such as [a-r],
or [B-M].

”

(Back quote) Starts the search at the beginning of a file.

‘

(Single quote or apostrophe) Starts the search at the end of a file.

Matches the beginning of a word. In other words, the next character in any search hit must
immediately follow a non-word character.

Matches the end of a word. In other words, the last character in any search hit must be
immediately followed by a non-word character.

Matches the sub-expression on either the left or the right. For example, A|u requires that the
next character in a search hit be “A” or “u.”

Positions the cursor between characters and spaces.

Matches anything not at a word boundary. For example, will find Bob in the name Bobby.

Matches any single decimal digit.

Matches any lowercase letter.

Matches a new line.

Matches a return.

Matches any whitespace character such as a space or a tab.

Matches a tab.

Matches any uppercase letter.

Matches any whole character [a-z A-Z 0-9].

Matches the start of a line.

[[:alpha:]]

Matches any alpha character (short for the [a-z A-Z] operator).

Searching Evidence with Live Search

Creating Custom Regular Expressions

| 309

Common Regular Expression Operators (Continued)
Operator

Description

[[:alnum:]]

Matches any alpha numerical character (short for the [a-z A-Z 0-9] operator).

[[:blank:]]

Matches any whitespace, except for line separators.

{n,m}

Matches the preceding sub-expression at least n (number) times, but no more than m
(maximum) times.

Searching Evidence with Live Search

Creating Custom Regular Expressions

| 310

Chapter 25

Searching Evidence with Index Search

Searching evidence for information pertaining to a case can be one of the most crucial steps in the examination.
Index Search gives instantaneous results, and Live Search supports modes like text and hexadecimal. Search
results are viewed from the File List and File Contents views in the Search tab.

This chapter details the use of the Index Search feature. It includes the following topics
Conducting
Using

an Index Search (page 312)

Search Terms (page 313)

Defining

Search Criteria (page 314)

Exporting

and Importing Index Search Terms (page 314)

Selecting

Index Search Options (page 315)

Viewing
Using

Index Search Results (page 316)

dtSearch Regular Expressions (page 317)

Documenting
Using

Search Results (page 323)

Copy Special to Document Search Results (page 324)

Bookmarking

Search Results (page 325)

Searching Evidence with Index Search

| 311

Conducting an Index Search
The Index Search uses the index to find the search term. Evidence items may be indexed when they are first
added to the case or at a later time. Whenever possible, AccessData recommends indexing a case before
beginning analysis.
Index searches are instantaneous. In addition, in the Index Search Results List, the offset of the data in the hit is
no longer listed in the hit. You will see it when you look at the hit file in Hex view.
Running an Index search on large files or Index Searches resulting in a large number of hits may make the scroll
bar appear not to work. However, it will return when the search is complete. For more information about indexing
an evidence item, see Indexing a Case (page 81).
The Search Criteria pane shows a cumulative total of all listed or all selected terms, based on the And or the Or
operator. The cumulative total displays at the bottom of the Search Terms list. This functionality has been added
to match the way the Search Terms list functioned in previous versions.
Select none, one, several, or all search terms from the list, click either And or Or, then click either All or
Selected to see cumulative results. You can see this feature at work in the figure below.
Important: If you start an index search and then refresh the interface before the search finishes, the search will
cancel and restart. This will cause a sizeable delay when searching in large or very large cases.
The Index contains all discrete words or number strings found in both the allocated and unallocated space in the
case evidence.
You can configure how special characters, spaces and symbols are indexed. This is not done by default,
however. One benefit is that you can easily search on an exact email address using username@isp (the
extension, such as COM or NET, is not included automatically because a period (.) is not indexed.
In addition to performing searches within the case, you can also use the index to export a word list to use as a
source file for custom dictionaries to improve the likelihood of and speed of password recovery related to case
files when using the Password Recovery Toolkit (PRTK). You can export the index by selecting File > Export
Word List.
Note: Performing a search using Unicode only works with Live Search, not Index Search.
UTF encoded documents can be searched using dtSearch.
Note: dtSearch has been updated which changes some of the search functionality and results. The search is
now filtering Windows and Linux executables (EXE, BIN, OCF, and ELF). This may reduce the number of
search results and reduce certain items from being shown in the filtered text. For example, the text in a
header of an application may include “This program cannot be run in DOS mode”. Becuase it is now
filtered it will not longer show in Filtered text.

Searching Evidence with Index Search

Conducting an Index Search

| 312

Using Search Terms
Type the word or term in the Search Term field. The term and terms like it appear in the Indexed Words column
displaying the number of times that particular term was found in the data. Click Add or press Enter to place the
term in the Search Terms list, or double-click the term in the indexed words column to add it to the Search Terms
list.

Expanding Search Terms
When performing an Index Search, you can use the Term Browser to build a search using terms that are related
to one or more keywords. You then select which words you want to include in the search.
To expand terms, a third-party lexical database called WordNet ® is used. When you expand terms, you can use
the following lists: Synonyms, Related, Specific, General.
For example, you may start with a keyword of “delete.” By using the Term Browser, it will suggest synonyms,
such as “erase” and “cancel”. It will also suggest related terms, such as “cut,” “deletion,” and “excision”. It will
also suggest general related terms, such as “censor,” “remove,” “take,” and “withdraw.” It will also suggest
specific related terms, such as “strike,” “excise,” “scratch,” and “expunge”. You can select which of those words
to include in your search.
The first time that you use this feature, the WordNet dictionary must be initialized. This is a one-time event and
can take 5-15 minutes for it to complete. You are prompted before the initialization begins.

To search for terms using related words
1.

In the Examiner, click Index Search.

Enter one or more keywords to the search terms.

Select one or more search terms that you want to expand.

Click Expand Terms.
A list of synonyms is generated.
To add other related words, select the Include Related, Include Specific, and Include General check
boxes.

You can add terms to the term list, separated by a comma, and click Expand.

Select the words that you want to include in the search.

To build a search including the words that you selected, click Add to Search.

Searching Evidence with Index Search

Using Search Terms

| 313

Defining Search Criteria
Refine a search even more by using the Boolean operators AND and OR. You can specify the terms to use in an
index search by selecting specific entries, or by searching against all entries.
You can also use the NOT operator to force the search criteria to exclude terms. To do this, in the Index Search
tab, in the Terms field, type NOT before the term that you want to exclude from the search criteria and then click
Add.
For example, if you do not want to include files with the term “apple” in your search, enter NOT apple into the
search criteria.
The Search Terms list now shows you a cumulative total for the search terms, individually, combined, or total.
You can use the operators All and Selected to see more specific results. This is helpful when refining lists and
terms to limit the results to a manageable number.
You can import a list of search terms to save having to type them multiple times. This is especially helpful when
the list is long, or the terms are complex. When you create a search terms document, each term begins on a new
line, and is followed immediately by a hard return. Save the file in TXT format in any text editor and save it for
future use.
Important: When creating your search criteria, try to focus your search to bring up the smallest number of
meaningful hits per search.

Exporting and Importing Index Search Terms
You can export a list of search terms you have added to the list of search terms to save for later use.

To export a set of search terms
1.

Highlight the search terms to export to a file.

Click Export.

Provide a filename and location for the file (the TXT extension is added automatically).

Click Save.

To import a saved search terms file
1.

Click Import to import a set of search terms.

Select the search terms file you previously saved.

Click Open.
Note: An imported term cannot be edited, except to delete a term and re-add it to your satisfaction.

Searching Evidence with Index Search

Defining Search Criteria

| 314

Selecting Index Search Options
To refine an index search, from the Index Search tab, in the Search Criteria area click Options.
Important: The Search Options, Stemming, Phonic, and Synonym cannot be combined. You may choose only
one at a time.

Index Search Options
Option

Result

Stemming

Words that contain the same root, such as raise and raising.

Phonic

Words that sound the same, such as raise and raze.

Synonym

Words that have similar meanings, such as raise and lift.

Index Result Options
Max Files to List

Maximum number of files with hits that are to be listed in the results field. You can change
this maximum number in the field. Searches limited in this way will be indicated by an
asterisk (*) and the text “(files may be limited by “Max files to list” option)” which may be
cut off if the file name exceeds the allowed line length. The maximum number of possible
files with hits per search is 65,535. If you exceed this limit, the remaining hits will be
truncated, and your search results will be unreliable. Narrow your search to limit the
number of files with hits.
Note: Limiting the number of files to display does not work with some images. This is
caused by dtSearch counting the chunks of files as individual files that are coming from
the breaking of large unallocated space files into 10MB chunks. Since Those chunks
are combined back into single files, the resulting file count will be less.

Max Hits per File

Maximum number of hits per file. You can change the maximum number in this field.
Searches limited in this way will be indicated by an asterisk (*) and the text “(files may be
limited by “Max hits per file” option)” which may be cut off if the file name and this text
together exceed the allowed line length. The maximum number of possible hits per file is
10,000.

Max Words to
Return

The maximum number of words to be returned by the search.

Files to Search
All Files

Searches all the files in the case.

File Name Pattern

Limits the search to files that match the filename pattern.
Operand characters can be used to fill-in for unknown characters. The asterisk (*) and
question-mark (?) operands are the only special characters allowed in an index search.
The pattern can include “?” to match any single character or “*” to match an unknown
number of continuous characters.
For example, if you set the filename pattern to “d?ugl*”, the search could return results
from files named douglas, douglass, or druglord.
To enter a filename pattern:
 Check the File Name Pattern box.
 In the field, enter the filename pattern.
Note: Search by date range is now limited to be between Jan 1, 1970 and Dec 31, 3000.

Files Saved
Between

Beginning and ending dates for the time frame of the last time a file was saved.
 Check the Files Saved Between box.
 In the date fields, type the beginning and ending dates that you want to search
between.
Note: Search by date range is limited to be between Jan 1, 1970 and Dec 31, 3000.

Searching Evidence with Index Search

Selecting Index Search Options

| 315

Files to Search (Continued)
Files Created
Between

Beginning and ending dates for the time frame of the creation of a file on the suspect’s
system.
 Check the Files Created Between box.
 In the date fields, enter the beginning and ending dates that you want to search
between.
Note: Search by date range is now limited to be between Jan 1, 1970 and Dec 31, 3000.

File Size Between

Minimum and maximum file sizes, specified in bytes.
 Check the File Size Between box.
 In the size fields, enter the minimum and maximum file size in bytes that you want to
search between.

Save as Default

Check this box to make your settings apply to all index searches.

Click Search Now when search criteria are prepared and you are ready to perform the search.

Viewing Index Search Results
Index Search results are returned instantaneously. The Index Search Results pane displays the results of your
query in a tree-type view. The tree expands to show whether the resulting items were found in allocated or
unallocated space. Further, when found in allocated space, the results are separated by file category. They are
then sorted by relevancy, a percentage of the hits found per search term.

Searching Evidence with Index Search

Viewing Index Search Results

| 316

Using dtSearch Regular Expressions
You can use regular expression searching capabilities in the dtSearch index search tab. This functionality does
not use RegEx++ that is used in the Live Search tab. dtSearch utilizes the TR1 (Technical Report 1) regular
expressions.
Regular expressions in dtSearch provide a powerful syntax for searching for complicated patterns in text, such
as one of several possible sequences of letters followed by a sequence of numbers. Regular expressions can
also be used to express spelling variations of individual words. Regular expression patterns are arbitrary (i.e.,
supplied by the user dynamically) and cannot be pre-indexed.
Regular expression searching in dtSearch is limited to a single whole word. A regular expression included in the
dtSearch box must be quoted and must begin with ##. An example of this is:
Apple and "##199[0-9]" - will find Apple and 1990 through 1999
Apple and "##19[0-9]+" - will find Apple and 190 through 199
However, if you want to look for Apple Pie, you cannot use "##app.*ie" since this is two words. Only letters and
numbers are searchable. You cannot search for any of the non-indexed characters as defined in the Index
Search Settings in the Detailed Options section of a case creation. Also, dtSearch does not store information
about line breaks so any searches that are made that include the beginning of a line or the end of a line will not
work.
Search considerations using the wildcard character "*" in a regular expression does have an effect on search
speed: the closer to the front of a word the expression is, the more it will slow searching. "Appl.*" will be nearly
as fast as "Apple", while ".*pple" will be much slower.
Note: Advanced searching for Social Security Numbers and Credit Card Numbers and other number patterns
can be achieved, however modifications to the dtSearch engine must be made before processing the
case. For more details, see Advanced Searching on page 7 of this paper.?
For more information, see:
Regular
MSDN:

Expressions - dtSearch Support. http://support.dtsearch.com/webhelp/dtsearch/regular_.htm
TR1 Regular Expressions. http://msdn.microsoft.com/en-us/library/bb982727.aspx

TR1 Regular Expressions For Text Patterns
Element Terms
Characters and target sequences are referred to as an Element and can be one of the following:
A

literal character typed as the actual letter or number ( a or 1).

A

'.' (period) is any single character.

An

'*' (asterisk) is a wildcard character.

(a)

is a capture group.

\d

is a decimal character.

For

hex searches, \xhh matches a hex entry (ie - \x0f).

Searching Evidence with Index Search

Using dtSearch Regular Expressions

| 317

{2}
A

is a repetition character.

',' (comma) is a minimum character.

(aa?)
An

is a target sequence.

alternation character search is 'this|that'.

A

concatenation sequence is '(a){2,3}(b){2,3}(c)'.

A

back reference is '((a+)(b+))(c+)\3'.

(?:subexpression)

matches the sequence of characters in the target sequence that is matched by the
patter between the delimiters.

(?!:subexpression)

matches any sequence of characters in the target sequence that does not match the
pattern listed in the subexpression)

A

bracket or range expression of the form "[expr]", which matches a value or a range, similar to a "set" in
the Live Pattern Search.

Examples:
"##a"
"##."

matches the target sequence "a" but does not match the target sequences "b", or "c", and so on.
matches a single character such as "a", "b", and "c",and so on.

"##sal*"

matches the target 'sale' and the target "salt' and so on.

"##(a)"

capture group, matches the target sequence "a" but does not match the target sequences "b", or
"c", and so on.

"##\d\d\d\d"
"##aa?"
"##ab"

matches the target sequence of four digits "1234".

or {0,1} matches the target sequence of "aa" and the target sequence of "aaa".

matches the target sequence "ab."

"##[b-z]"

or range, matches the target sequences "b" and "c" but does not match the target sequences

"a".
"##tom|jerry"
"##\d{4}"

matches the target sequence of 'tom' or 'jerry'.

or repetition, matches the target sequence of four digits "1234".

"##(?:aa)"

or target sequence, matches the target sequence of "aa" and the target sequence of "aaa",

and so on.

Ordinary Character
By entering actual ASCII characters, the search will return that set of characters after the element(s) are
entered. By entering ordinary characters, "##nick", you would find said characters. However, if you wanted to
look for Nick Davis, you could not use "##nick davis" since this is two words.

Single "Any" Character and Wildcard
The use of the any character element can be used if a letter or letters may be different, such as difference in
spelling (example 'marijuana' and 'marihuana'). The wildcard is used to find any combination of characters after
an element is entered.
Examples:
"##(a*)"
"##a*"

matches the target sequence "a", the target sequence "aa", and so on.

Searching Evidence with Index Search

Using dtSearch Regular Expressions

| 318

"##(a.)"

matches the target sequence "aa", the target sequence "ab", but will not find the target sequence
the target sequence "aaa".

"##a."

matches the target sequence "aa", the target sequence "ab", but will not find the target sequence
the target sequence "aaa".

"##.*ick"

matches the target sequence "nick", the target sequence "click", and so on.

"##mari.uana"

matches the target sequence "marijuana" and the target sequence "marihuana".

Capture Group
A capture group marks its contents as a single unit in the regular expression and labels the target text that
matches its contents. The label that is associated with each capture group is a number, which is determined by
counting the opening parentheses that mark capture groups up to and including the opening parenthesis.
Examples:
"##(ab)*"

matches the target sequence "ab", the target sequence 'abab", and so on.

"##(a+)(b+)"

matches the target sequence "ab, the target sequence "aab", the target sequence "abb",

and so on.
"##ab+"

matches the target sequence "abb" but does not match the target sequence "abab."

"##(ab)+"

matches the target sequence "abab" but does not match the target sequence "abb."

"##((a+)(b+))(c+)"

matches the target sequence "aabbbc" and associates capture group 1 with the
subsequence "aabbb", capture group 2 with the subsequence "aa", capture group 3 with "bbb", and
capture group 4 with the subsequence "c".

Repetition
Any element can be followed by a repetition count.
Examples:
"##(a{2})"

matches the target sequence "aa" but not the target sequence "a" or the target sequence

"aaa".
"##(a{2,})"

matches the target sequence "aa", the target sequence "aaa", and so on, but does not match
the target sequence "a".

A repetition count can also take the following form:
"?"

- Equivalent to "{0,1}".

Examples:
"a?"

matches the target sequence "" and the target sequence "a", but not the target sequence "aa".

"##(aa?)(bbbb?)(c)"

matches the target sequence "aabbbbc" and the target sequence "abbbc".

Decimal Character
You can locate any set of decimals by using the '\d" character element in the expression.
Examples:
"##\d\d\d\d"
"##\d[3}

matches the target sequence "1234".

matches the target sequence "123".

Searching Evidence with Index Search

Using dtSearch Regular Expressions

| 319

"##\d{3}\d\d\d\d"
Visa

matches the target sequence '1234567".

and "##\d{4}" will match any files that contain the word 'visa' and any four digits.

Alternation
A concatenated regular expression can be followed by the character '|' and another concatenated regular
expression. Any number of concatenated regular expressions can be combined in this manner. The resulting
expression matches any target sequence that matches one or more of the concatenated regular expressions.
Example:
"##(nick|houston)"

matches the target sequence "nick", or the target sequence "houston".

Concatenation
Regular expression elements, with or without repetition counts, can be concatenated to form longer regular
expressions. The resulting expression matches a target sequence that is a concatenation of the sequences that
are matched by the individual elements.
Examples:
"##(a){2,3}(b){2,3}(c)"
"##(\d{4}){4}"

matches the target sequence "aabbc", the target sequence "aaabbbc".

matches the target sequence of "1234123412341234" (16 digits - no spaces).

Back Reference
A back reference marks its contents as a single unit in the regular expression grammar and labels the target text
that matches its contents. The label that is associated with each capture group is a number, which is determined
by counting the opening parentheses that mark capture groups up to and including the opening parenthesis that
marks the current capture group. A back reference is a backslash that is followed by a decimal value N. It
matches the contents of the Nth capture group. The value of N must not be more than the number of capture
groups that precede the back reference.
Example:
"((a+)(b+))(c+)\3"

matches the target sequence "aabbbcbbb". The back reference "\3" matches the text in
the third capture group, that is, the "(b+)". It does not match the target sequence "aabbbcbb".
The

first capture group is ((a+)(b+))

The

second capture group is (a+)

The

third capture group is (b+)

The

fourth capture group is (c+)

Bracket or Character Range
A character range in a bracket expression adds all the characters in the range to the character set that is defined
by the bracket expression. To create a character range, put the character '-' between the first and last characters
in the range. Doing this puts into the set all characters that have a numeric value that is more than or equal to the
numeric value of the first character, and less than or equal to the numeric value of the last character.

Searching Evidence with Index Search

Using dtSearch Regular Expressions

| 320

Examples:
"[0-7]"

represents the set of characters { '0', '1', '2', '3', '4', '5', '6', '7' }. It matches the target sequences "0",
"1", and so on, but not "a".

"[h-k]"

represents the set of characters { 'h', 'i', 'j', 'k' }.

"[0-24]"
"[0-2]"

represents the set of characters {'0', '1', '2', '4' }.

represents the set of characters { '0', '1', '2' }.

An individual character in a bracket expression adds that character to the character set that is defined by the
expression. If the bracket expression begins with a "^" then this defines that the expression will consider all
characters except for those listed.
Examples:
"[abc]"

matches the target sequences "a", "b", or "c", but not the sequence "d".

"[^abc]"

matches the target sequence "d", but not the target sequences "a", "b", or "c".

"[a^bc]"

matches the target sequences "a", "b", "c", or "^", but not the target sequence "d".

TR1 Regular Expressions For Number Patterns
If order to achieve dtSearch capability in FTK for search strings such as Social Security Numbers, Credit Card
Numbers, Employee Identification Numbers, Telephone Numbers, and so on, where a period or hyphen is
present, certain steps must be done during the pre-processing phase of the case.
Note: NOTE: Currently, you cannot include search patterns with spaces.

Normal dtSearch strings for credit card numbers or social security numbers
The normal dtSearch wildcard string can be utilized as long as the hyphen is set to be indexed as a space:
Social

Security Numbers - === == ====

Returns
Will
Credit

"123-45-6789"

not return "123 45 6789"

Card Numbers (16 digits) - ==== ==== ==== ====

Returns
Will

"1234-1234-1234-1234"

not return "1234 1234 1234 1234"

Number Patterns
You can use dtSearch TR1 Regular Expression to find number patterns as you can in Live Searches for such
things as Credit Card Numbers, Social Security Numbers, xxxxxxxx. Certain pre-processing options MUST be
completed before this function will work.

Searching Evidence with Index Search

Using dtSearch Regular Expressions

| 321

Configuring Pre-Processing Options
If you to utilize the dtSearch TR1 Regular Expression functions for looking for number patterns, you must
complete the following pre-processing options:
1.

Start a new case.

Click Custom processing profile.

Click Indexing Options next to dtSearch Text Index.

On the Indexing Options dialog window set the following:
For

Hyphen Treatments - set to Hyphen

In

the Spaces section - remove the period

In

the Spaces section - remove the left and right parenthesis

In

the Letters section - click Add and in all 4 spaces, type a "." period and repeat for the left and right
parenthesis, then click OK.

Process the case.

Examples of TR1 Regular Expressions for Number Patterns
For

Credit Card Numbers:

"##(\d{4}[\.\-])(\d{4}[\.\-])(\d{4}[\.\-])(\d{4})"

The first three groups are composed of - (\d{4}[\.\-]). The expression is looking for four digits followed
by a period, or hyphen. This group is repeated three times and followed by the group looking for the
ending 4 digits.
We can shorten that expression by writing it "##((\d{4})[\.\-]){3}(\d{4})".
This will find 1234-5678-1234-5678 or 1234.5678.1234.5678
For

Social Security Numbers -

"##(\d{3}[\.\-])(\d{2}[\.\-])(\d{4})".
This
For

will find 123-45-6789 or 123.45.6789

U.S. Telephone Numbers -

"##(\d[\-\.])?(\(?\d{3}[\-\.\)])?([\-\.]?\d{3}[\-\.])(\d{4})"

This will find:
567-8901
234-567-8901
1-234-567-8901
(234)567-8901
(234)-567-8901
567.8901
234.567.8901
1.234.567.8901
(234)567.8901
(234).567.8901

Searching Evidence with Index Search

Using dtSearch Regular Expressions

| 322

Documenting Search Results
Once a search is refined and complete, it is often useful to document the results.
Right-click an item in the Search Results list to open the quick menu with the following options:
Create

Bookmark: Opens the Create Bookmark dialog. For more information on creating and using
Bookmarks, see Using the Bookmarks Tab (page 296).

Copy

to Clipboard: Copies the selected data to the clipboard (buffer) where it can be copied to another
Windows application, such as an Excel (2003 or earlier) spreadsheet.
Note: The maximum number of lines of data that can be copied to the clipboard is 10,000.

Export

to File: Copies information to a file. Select the name and destination folder for the information file.
Uses the same criteria as Copy to Clipboard.

Set

Context Data Width: Context data width is the number of characters that come before and after the
search hit.

Delete

All Search Results: Use this to clear all search results from the Index Search Results pane.

Copy or Export Search Results
Option

Description

All Hits in Case

Saves all the current search terms’ hits found from the entire case.

All Hits in Search

Saves all the search hits found in each search branch.

All Hits in Term

(Live search only) saves the instances of individual terms found from the list of search
terms.
For example, if a live search consisted of the list “black,” “hole,” “advent,” and “horizon,”
this option would copy information on each of the terms individually.

All Hits in File

Records the instances of the search term in the selected file only.

All File Stats in Case Creates a CSV file of all information requested in the case.
All File Stats in
Search

Creates a CSV file of the information requested in the search.

All File Stats in Term (Live search only) Creates a CSV file of the instances of individual terms found from the
list of search terms.
After the information is copied to the clipboard, it can be pasted into a text editor or spreadsheet and saved.
Choose Export to File to save the information directly to a file. Specify a filename and destination folder for the
file, and then click OK
Search results can then be added to the case report as supplementary files.
Important: When exporting Index Search result hits to a spreadsheet file, the hits are exported as a CSV file in
UTF-16LE data format. When opening in Excel, use the Text to Columns function to separate the
Index Search hit values into columns.

Searching Evidence with Index Search

Documenting Search Results

| 323

Using Copy Special to Document Search Results
The Copy Special feature copies specific information about files to the clipboard.

Method 1 to copy information about the files in your search results
1.

Click in the search results list.

From the menu bar, select Edit > Copy Special.

Method 2 to copy information about the files in your search results
1.

Find that file highlighted in the File List view.

Right-click on the desired file.

Select Copy Special.

Choose the column settings template to use from the drop-down list. Click Column Settings to define a
new column settings template.
4a.

Modify the column template in the Column Settings Manager. For more information on customizing
column templates, see Customizing File List Columns (page 384).

4b.

Click Apply to return to the Copy Special dialog.

Select the customized column template if you created one.

Choose whether you want to include the header row in the file.

Under File List Items to Copy, select the option that best fits your needs:
All

Highlighted to copy only the items currently highlighted in the list.

All

Checked to copy all the checked files in the case.

Currently
All

Listed to copy all currently listed items, but no others.

to copy all items in the case.

The dialog states the number of files that your selection contains.

Click OK.

Searching Evidence with Index Search

Using Copy Special to Document Search Results

| 324

Bookmarking Search Results
To keep track of particular search results, add them to new or existing bookmarks. Search results in the file list
can be selected and added to a newly-created bookmark, or added to an existing bookmark as with any other
data.

To create a bookmark from the file list
1.

Select the files you want to include in the bookmark.

Right-click any of the selected files and select Create Bookmark.

Complete the Create New Bookmark dialog.

Click OK.
The bookmark appears in the Bookmark tab.

Searching Evidence with Index Search

Bookmarking Search Results

| 325

Chapter 26

Examining Volatile Data

This chapter includes the following topics
Using

the Volatile Tab (page 327)

Understanding
Viewing

Memory Dump Data (page 330)

Performing
Killing

Memory (page 329)

File Remediation from the Volatile Tab (page 332)

a Process (page 332)

Wiping

a File (page 333)

Adding

Hashes to KFF Library from the Volatile Tab (page 333)

Adding

Hashes to Fuzzy Hash Library from the Volatile Tab (page 334)

Creating

a Memory Dump File (page 334)

Examining Volatile Data

| 326

Using the Volatile Tab
The Volatile tab provides tools for viewing, finding, and comparing data gathered from the memory of live agent
systems in your network. Other data acquired remotely, such as from a Mounted Image Drive or a Mounted
Device is viewable from other tabs. The Volatile tab is specifically for remote memory data acquired as a
memory dump. It can be added directly to a case upon acquisition, or saved as a dump file to be added to any
case at a later time.
See Working with Live Evidence (page 133).
When you have acquired volatile (Memory) data as a dump file the resulting acquisition data is displayed in the
Volatile tab.

There are three main areas in the Volatile tab:
1.

Tabbed Data View

Detail List View

Detailed Information View

It is important to remember that the views relate clockwise. When an item is selected in the Tabbed Data view,
the related information is displayed in the Detail List view. An item selected in the Detail List view will display
relevant information in the Detailed Information view, within the data tab that relates to the type of item that is
selected.

The Tabbed Data view has three tabs:
Snapshot
Find
Difference

Examining Volatile Data

Using the Volatile Tab

| 327

Each Tabbed Data View displays a summary of acquired volatile data.

Data View Sort Options
Button

Description
Sort acquired volatile data by Operation Type, such as those selectable from the Evidence > Add
Remote Evidence > Selection Information dialog box. Found on Snapshot, Find, and Difference
tabs.
Sort acquired volatile data by the Time of Acquisition, displayed in the local machine’s time. Found
on Snapshot, Find, and Difference tabs.
Sort acquired volatile data by the Source Machine or Agent. Found on Snapshot, Find, and
Difference tabs.

Display saved comparisons. When a comparison of found data is done, the results can be saved
and viewed later. Found only on the Difference tab

Geolocation. This button on the Volatile tab that will launch Geolocation for volatile data.
See Viewing Geolocation IP Locations Data on page 372.
The Detail List View provides information specific to the item currently selected in the Data View. The content of
the Detail List changes as different items are selected.
The Detailed Information View shows more specific information about the item in the Data View, and its selected
component in the Detail List view.

Examining Volatile Data

Using the Volatile Tab

| 328

Understanding Memory
Memory can include the physical “sticks” of memory that we put into the machine, commonly referred to as
physical memory. However, video cards, network cards, and various other devices use memory that the
Operating System (OS) must be able to access in order for the devices to work properly. Both physical memory
and device memory are organized by the OS in a linear address map. For 32-bit operating systems, the linear
address map is naturally 4GB. Traditionally the OS will put physical memory at the bottom of this map and the
device memory at the top.
When a system has a full 4GB of physical memory, using all 4GB wouldn’t leave any room to address the device
memory.
Since the OS can’t function without access to the device memory, it simply doesn’t use all 4GB of physical
memory. Evidence of this fact can be seen on the main Properties window of My Computer. If you have a 32-bit
Windows XP system with 4GB of physical memory, you may notice that the Properties window will show that you
have only 3.25GB of physical RAM. That limitation allows for addressing of devices within the 4GB address
space.
Most acquisition products check how much physical memory is available (4GB using our example above), open
a handle to the OS’s memory map (referred to as \Device\PhysicalMemory) and start reading, one page at a
time. Thus, in an attempt to read all of the physical memory, what they are actually reading is the OS’s linear
address map of both physical and device memory. However, some device memory is not meant to be read and
the simple act of reading it could cause system instability. In fact, if the OS is 64-bit, this algorithm would miss
the physical memory that was placed beyond the 4GB range.
The approach AccessData takes is to query the OS’s memory map for the regions that correspond to physical
memory and only acquire those regions - filling the other regions with zeros. This method not only avoids any
issue with system instability but also guarantees that it acquires all the physical memory that the OS is able to
use — the memory that anyone would normally be interested in.

Examining Volatile Data

Understanding Memory

| 329

Viewing Memory Dump Data
A Memory Dump file includes all the Processes, DLLs, Sockets, Drivers, Open Handles, Processors, System
Descriptor Tables and Devices in use at the time of the acquisition. The Volatile tab provides a view of all this
data by type.
Right-click on any dump file in the Snapshot view to choose View Memory or Search Memory.

Viewing Hidden Processes
Hidden processes are automatically detected. There is no way to disable or turn off this feature. The detection
compares a list of processes in memory to the operating systems’s processes list to determine whether any
running processes do not belong. These are the processes that are highlighted in yellow.
Hidden processes, when detected in a Memory Dump file, and found only in the Process List. Click on a dump
file in the Process List, then scroll down the Detail List to locate any lines highlighted in yellow.
Click on a yellow-highlighted line in the Detail List to display related information in the Detailed Information list.
Scroll across the columns list to see all the data.

Viewing Input/Output Request Packet Data
Input/Output Request Packet (IRP) data, also known as memory hooks, when detected in a memory dump file,
are indicated in the Snapshot view by a yellow warning indicator. Memory hooks can be used for both legitimate
and non-legitimate purposes.
In the Detail list, the items that contain memory hooks are highlighted in pink. Click on a pink-highlighted item to
open that item in the Detailed Information view. The IRP tab shows the items and properties that are related to
the IRP data that was detected. This data does not identify whether the IRP was bad or good, only that it was
there, so you can determine its nature.
Tabs in the Detailed Information list provide additional related data for the selected data type. Some data types
have several tabbed pages, and some have only a few. Each tabbed page contains different information related
to the selected item, and each displays properties specific to the tabbed page for that information type. The
property column headings are sortable to make it easier to locate critical information.
In addition to the IRP data view, access is provided to Service Descriptor Tables (SDT), and System Service
Descriptor Tables (SSDT).
Up to four SSDT tables are available. The four tabs are placeholders only; their existence does not indicate nor
guarantee they will be populated. Notice that the names of the populated tables’ tabs are longer than those that
are not populated. Only the data that is found in the evidence can be displayed.

Viewing Virtual Address Descriptor (VAD) Data
In the Windows operating system, every object opened by a program (example files, screens, sections of
memory, etc.) is assigned a handle that the process in which the program is running can use. These handles are
stored in a table that is managed by the process. This table is called the virtual address descriptor table (VAD).

Examining Volatile Data

Viewing Memory Dump Data

| 330

A single process normally contains many VADs. Each VAD describes a range of virtual pages and tells the
Memory Manager what those virtual pages represent. For example, a typical process will consist of an
executable image (the program) and a set of dynamic link libraries (DLLs) that are used within that process, as
well as data that is unique to the program. Each of these separate items exists somewhere within the address
space of the program.
When each component is first loaded into the address space, the Memory Manager creates a new VAD entry for
each such range of addresses. These VAD entries are in turn linked together in a binary tree that optimizes
access to the most recently accessed VAD. This representation makes it is easy to describe a sparse address
space using a tree of VADs, it is fast to find entries within the VAD tree, and it is easy to reorganize VAD entries
as necessary.
Investigating the VAD tree lets you view resources allocated by a program. The VAD tree constantly changes
during execution of a program. Each time the VAD tree is read, the results are different.

To view Virtual Address Descriptor (VAD) Data
1.

In the Examiner, select the Volatile tab.

In the Snapshot tab, expand Process List.

Expand the date of the snapshot.

Select the computer name.

In the upper-right pane, under Detail List, select a process.

In the lower-right pane, under Detailed Information, click the VAD tab.

The Virtual Address Descriptor (VAD) information is displayed in the Detailed Information pane.

Examining Volatile Data

Viewing Memory Dump Data

| 331

Performing File Remediation from the Volatile Tab
Certain file remediation tasks are available for specific data types in the Volatile tab. After a remote volatile data
acquisition is completed, click to expand the data type in the Snapshot tabbed view, then right-click on the item in
the Detail List to choose from the available file remediation options.

Volatile Tab File Remediation Options

Volatile Data Type

Kill Process

Wipe File

Add
Hashes to
KFF Lib

Add
Hashes to
Fuzzy Lib

Dump

Process List

DLL List

Sockets

Driver List

Open Handles

Processors

System Descriptor Table

Devices

Killing a Process
Kill Process ends a process running on the remote computer the data was acquired from.

To kill a process
1.

In the Snapshot view, click and expand the Process List.

In the Detail List, highlight or mark the check boxes of the processes to be killed.

Right-click in the Detail List and select Kill Process.

In the Select Source dialog box, select either Highlighted Detail List items, or Checked items.

Click OK.

Examining Volatile Data

Performing File Remediation from the Volatile Tab

| 332

Wiping a File
Wipe File completely removes a file from the remote computer the file was acquired from.

To wipe a file
1.

In the Snapshot view, click and expand the Process List.

In the Detail List, highlight or mark the check boxes of the file to be wiped.

Right-click in the Detail List and select Wipe File.

In the Select Source dialog box, select either Highlighted Detail List items, or Checked items.

Click OK.

Adding Hashes to KFF Library from the Volatile Tab
Hashes can be added directly to the KFF Library directly from the Volatile tab.

To add hashes to the KFF Library
1.

In the Detail List, highlight or mark the check boxes of the hashes to add to the KFF Library.

Right-click in the Detail List, and click Add Hashes to KFF.

Provide a name for the set.

Click Add all hashes to add the hashes of all displayed items, or Add only checked hashes in the
current Detail List.

Select either Alert or Ignore.

Choose whether or not to Activate in [the current] case.

Click OK.

Examining Volatile Data

Wiping a File

| 333

Adding Hashes to Fuzzy Hash Library from the Volatile Tab
Hashes can be added directly to the Fuzzy Hash Library directly from the Volatile tab.

To add hashes to the Fuzzy Hash Library
1.

In the Detail List, highlight or mark the check boxes of the file(s) hashes to add to the Fuzzy Hash
Library.

Right-click in the Detail List, and click Add Hashes to Fuzzy.

Provide a name for the set.

Click Add all hashes to add the hashes of all displayed items, or Add only checked hashes in the
current Detail List.

Select either Alert or Ignore.

Assign a Threshold Value.

Choose whether or not to Activate in [the current] case.

Click OK.

Creating a Memory Dump File
A dump file can be created and added to the case directly from the Volatile tab.

To create a Dump file
1.

In the Snapshot view, click and expand the Process List or the DLL List.

In the Detail List, highlight or mark the check boxes of the files to be dumped.

Right-click in the Detail List and select Dump to file.

In the Dump a file dialog box, mark Include DLLs with processes, and/or Include parent process
with DLLs.

Browse to and select a destination path for the dump file.

Click OK.

Examining Volatile Data

Adding Hashes to Fuzzy Hash Library from the Volatile Tab

| 334

Chapter 27

Using Visualization

About Visualization
Visualization is a component that provides a graphical interface to enhance understanding and analysis of files
and emails in a case. You view data based on file and email dates. Visualization provides dashboards with chats
and lists that quickly show information about the data in the specified date range. Visualization helps you identify
files and emails that you label and bookmark as part of your investigation.
Note: The Visualization feature is available as an add-on license. Please contact your AccessData sales
representative for more information.
Visualization can only display data that has an associated date. If a file or an email does not contain a valid
Created, Modified, Last Accessed, Sent or Received date, it is not displayed. For example, carved files do not
have an associated date so they are not displayed in Visualization.
You can also take screen captures of the Visualization pages to have a record of the data.
Visualization supports the following data types:
File

Data: You can view file data from either the Explore tab or the Overview tab in the Examiner
interface.
For more information see Visualizing File Data (page 342).

Email

Data: You can view email data from the Email tab in the Examiner interface.
For more information see Visualizing Email Data (page 349).



Browser History: You can view internet browser history data.
For more information see Visualizing Browser History Data (page 361).

Visualization also has the following components:
Using

Visualization Heatmap (page 362)

Using

Visualization Social Analyzer (page 364)

Using

Visualization Geolocation (page 369)

Using Visualization

About Visualization

| 335

Launching Visualization
To launch visualization
1.

Use the Explore, Overview, or Email tabs to specify a set of data.
For example, in the Overview tab, you can view everything under File Extension or drill down to just
DOC files.

When you have specified the data that you want to view in the Visualization pane, click the following pie
chart icon:

The data that you have displayed in the File List pane is the data that you can send to the visualization
module.
The visualization module opens in a separate window from the Examiner that you can minimize,
maximize, and select in the Windows task bar.
3.

On the time line, specify the date range for the base time line that you want to view data for.
See Setting the Base Time Line on page 340.

Important: The dashboard and data list displays information only for the data that exists in the base time
line. If specified dates have no files, the dashboard displays the text “No Data Series.” To properly
use Visualization, you must specify the base time line that you want to view data for.

Using Visualization

Launching Visualization

| 336

About the Visualization page
The Visualization page includes three main components:
Time

line pane - Provides a time line pane with graphics representing the available data. This is the top
part of the page.

Dashboard
Data

- Provides graphical chart panes about the data. This is the middle part of the page.

list pane- Provides a list of the data items. The is the lower part of the page.

You can resize each pane.

Using Visualization

About the Visualization page

| 337

About Visualization Time Line Views
You can use one of the following two time line views:
Basic

- The basic view lets you specify a base time line that you want to view data for. For example, you
can select a specific year or month, or you can specify a custom date range. Any data that falls in that
date range will be represented in the charts and data list.
See About the Base Time Line on page 338.

Detailed

- The detailed time line view shows a graphical representation of each file or email message. If
you have a lot of data in a given date range, you can narrow your view to days, hours, minutes, and
milliseconds.
See About the Detailed Visualization Time Line on page 355.

About the Base Time Line
The top portion of the visualization page is the time line. The time line displays a graph with a representation of
that data that is visualized. The data is displayed from the oldest date on the left to the most current date on the
right.
The span of the time line is automatically configured based on the dates of the data that you specified for
visualization. For example, if the data that you specified has creation dates that range from 8/15/2003 to 9/11/
2003, it will build a time line with those dates as the start and end.

The vertical gray bars represent where the data files are on the time line. The gold text in the lower left corner of
the time line details the full timespan.
In the Basic time line view, you configure the base time line. The base time line is the specific range of dates that
you want to work with. This may be a smaller date range than the full timespan (dates in yellow).
The base time line is represented by the blue selection box with sliding vertical bars. You can modify the base
time line to be any range within the full timespan.
Important: The dashboard and data list displays information only for the data that exists in the base time line. If
specified dates have no files, the dashboard displays the text “No Data Series.” To properly use
visualization, you must specify the base time line that you want to view data for.

Using Visualization

About Visualization Time Line Views

| 338

When you first launch visualization, a limited default base time line is specified, starting with the oldest data that
is in the data set. For example, if you are viewing files, the default base time line is the first month starting with
the creation date of the oldest file.

In the example in the graphic shown above, there are four files in the default base time line of one month and
those four files are shown in the list and represented in the dashboard.
In the email visualization, the time line is displayed in weeks, with vertical gray bars representing the emails.

Time Line Selection Tools

Using Visualization

About the Base Time Line

| 339

Setting the Base Time Line
You adjust the range and the location of the base time line by adjusting the blue selection box. The information in
the visualization dashboard and data list change when you adjust the selection box.
See About the Base Time Line on page 338.

To adjust the full timespan
1.

Below the time line, you can zoom in on the view of the total timespan (yellow full timespan bar) by
clicking and dragging the end of the bar.

You can also slide the yellow bar left or right to adjust the range.

To adjust the base time line
1.

You change the base time line of the data set by adjusting the blue selection box.

You can do one of the following options:
Select

a period that is on the top of the time line, for example, a specific month like June.

Drag

the sliders of the blue selection box to make it bigger or smaller.

Drag

the selection box to a different position.

Use

the mouse scroll wheel to move the selection box left or right.

Using Visualization

About the Base Time Line

| 340

Changing the View of Visualization
You can change the way that visualization looks. You can modify the way that bar charts in visualization appear.
You can also change the color scheme of the visualization windows.

Modifying the Bar Chart Displays
You can use the radio buttons below the time line to change the appearance of bar charts in visualization.

Option

Description

Log (default)

The Log (logarithmic) view makes visualization adjust the bars or lines to raise the low
points and lower the highs so that both are easier to view on a chart. This view smooths
the peaks and valleys in the chart.

Linear

The Linear view returns the view from Log to an unadjusted representation of the data.
Changing from the Log view to the Linear view shows more of the variance and spikes in
the data.

Bars (default)

The Bars option makes Visualization show evenly-spaced bars to represent the data.

Line

The Line view makes Visualization show the data as an unbroken line with peaks and
valleys, representing increases and decreases in the amount of data over time.

Changing the Theme of Visualization
You can modify the appearance of the Visualization windows. You can choose from nine different color schemes.

To change the theme of Visualization
1.

In the Case Manager, click Tools > Preferences.

In the Preferences dialog, under Theme to use for Visualization, choose from the following:
Office

Blue (default)

Metro
Office

Black

Office

Silver

Vista
Windows

Summer
Expression

Dark

Transparent

Using Visualization

Changing the View of Visualization

| 341

Visualizing File Data
The file data dashboard lets you view bar graphs, pie charts, and details about the files in the data set.

When visualizing files data, you can do the following:
Configuring

Visualization File Dates (page 342)

Visualizing

File Extension Distribution (page 343)

Visualizing

File Category Distribution (page 345)

Using

the File Data List (page 346)

Configuring Visualization File Dates
When you view file data in the Visualization page, you can view data based on the following file data:
Created

date

Modified
Last

date

accessed date

If a file contains a Created date but not a Modified date, and you change the pane to display the file by Modified
date, the file is no longer displayed in the visualization pane.
If a file’s Created date, Modified date, or Last Accessed date is prior to the year 1985, visualization displays a
dialog box. The dialog box asks you if you want to include the files with these dates in the visualization display. If
you select the option to Do not ask me again, Visualization will remember your preference the next time the
dates precede 1985.

Using Visualization

Visualizing File Data

| 342

Configuring the file date type
1.

On the Visualization page, click the file date type drop-down menu.

By default, it displays the Created setting.

Select Created, Modified, or Last Accessed.

Visualizing File Extension Distribution
The extension distribution chart lets you view the data for the selected date range.
You can view selected data by the following ways:
File

extension counts

File

sizes

File counts and sizes are rounded to two decimal places. You can select a bar in the extension distribution chart
to further refine the data that is displayed in the file data list.
You can select an extension in the legend to select or un-select extensions.

Using Visualization

Visualizing File Data

| 343

File Extension Distribution Pane

Using Visualization

Visualizing File Data

| 344

Visualizing File Category Distribution
The category distribution chart displays a pie chart of the data set. It is organized according to the categories of
the Overview tab and displays the percentages of each category in the data set. The percentages are displayed
as the nearest whole number. For example: 10%. However, if a section in a category represents less than 1
whole percent, then the percentage is displayed to the hundredth percent. For example,56%.

Visualization Category Distribution Chart

If several categories are displayed very closely together, they may overlap and it can be difficult to read the
percentages. You can click the Show Connectors option to expand the percentages further from the pie chart
and include a connecting line to the pie section that correlates to the percentage.
You can select a category in the pie chart to further refine that data that is displayed in the file data list.

Using Visualization

Visualizing File Data

| 345

Using the File Data List
The file data list displays detail about the files in the data set. The pane is similar to the File List pane in the
Examiner interface. The information that is displayed in the file data list is generated based on the data that you
refine through the use of the time line pane, the file extension distribution chart, and the categories distribution
chart.

Visualization File Data List

Within the file data list you can sort, group, and sub-group, items according to columns including; ID, Name,
Category, Date, and Size. To sort, drag and drop the desired column heading onto the blue bar. Any column
heading that includes a filter icon can be used to sort the file list data set.

Using Visualization

Visualizing File Data

| 346

Important: If you want to filter for a specific date, include the day of and the day after. The filter uses midnight as
the time frame. So if you only want files with a date of January 27, 2013, include January 27 and Jan
28. That will include files from midnight on the 27th to midnight on the 28th.
You can perform several actions on selecting the files and then clicking the Mark Selected Items button.
You can do the following:
Label

the item

Create
Clear

a bookmark from the item

a check mark if you have checked it.

Check

the item.

You can use the Filter icon on any of the column headings to create custom filters in the file details list.

When you select the filter icon, a filter dialog is displayed that lets you select items that apply to the column
where you add filtering expressions. There are many various was in which you can filter to refine the data that is
displayed.
Note: You can filter and sort by file sizes such as bytes, KB, and MB. However, note that when you enter an
operator to filter by size, you must enter the size according to its byte value. You cannot enter the value in
KB or MB. For example, instead of entering 100 KB, you must enter 102400 for the filter to work properly.

Using Visualization

Visualizing File Data

| 347

File Data List Filtering Tool

Using Visualization

Visualizing File Data

| 348

Visualizing Email Data

The email visualization dashboard consists of the following items:
Email

Time Line
See Narrowing the Scope with the Email Time Line on page 349.

Mail

Statistics Graph
See Viewing Mail Statistics on page 351.

Email

Details List
See Using the Email Details List on page 351.

Social

Analyzer Chart
See Using Visualization Social Analyzer on page 364.

Narrowing the Scope with the Email Time Line
The time line provides an aggregate view of email items sent and received in the data set. You can scale and
refocus the scope of the time line to a specific data range. You can change the scope and scale of the data set
by adjusting the gray slider tool. You can change the focus of the data set by adjusting the blue slider tool.

Visualization Email Date Pane

Using Visualization

Visualizing Email Data

| 349

See also Setting the Base Time Line (page 340).

Using History Items in the Email Time Line
In the Email Visualization pane, when you alter the selection in the time line, a history item, also called a “bread
crumb,” is added to the top of the time line. Each history item is labeled according to the date range that you
have selected in the time line. You can use these history items to move forward or backward through different
views that you have created.

Visualization History Items

Using Visualization

Visualizing Email Data

| 350

Viewing Mail Statistics
The mail statistics graph displays the sent and received mail statistics in a bar chart. The data contained within
the date range, in the email time line, determines the data that is displayed in the mail statistics graph.
You can select a bar in the statistics graph to further refine the data that is displayed below in the Email details
list.

Visualization Mail Statistics Chart

Using the Email Details List
The email details list displays custodian-level sent and received statistics for email items. The list contains a
column for the custodian's name, a column for the custodian’s sent mail, and a column for the custodian’s
received mail.
You can sort group and subgroup the emails according to the columns including: Sender, Address, Traffic Count,
Sent Mail, and Received Mail. To group the list of emails, you can drag and drop the column headers onto the
table heading of the details list. The list sorts first by the first columns that you drop, and then in the order of any
preceding columns that you drop into the table heading.

Visualization Email Details List

Using Visualization

Visualizing Email Data

| 351

You can use the Filter icon on any of the column headings to create filters in the Email Details List.

When you select the Filter icon, a filter dialog is displayed that lets you select items that apply to the column and
add filtering expressions.

Email Details List Filtering Tool

In visualization, Email addresses that are similar but not exactly the same are displayed as two different
addresses, even though they may be the same address. For example, the quotation marks for 'John Doe' and
“John Doe” are not the same. These slight changes in text can happen from different email servers/software
during email transit, and the program cannot discern duplicate email addresses.

Using Visualization

Visualizing Email Data

| 352

If an email item is sent to multiple recipients, it is counted as a single item in the email details pane. In the Traffic
Details chart, you can see when the same email was sent to multiple recipients. To view specific information
about the recipients of that email item, you can click the Traffic Details button.
You can check specific emails in the examiner from the email details list by selecting the emails and then
choosing one of the Check Selected Items options, Sent, Received, or Both.

When you expand a specific email item, you can run additional functionality. This functionality includes the Social
Analyzer chart. The buttons to open the Social Analyzer chart are located on the right side of a custodian’s email
item in the list.
For more information see the following:
Using Visualization Social Analyzer (page 364)

Analyzing Email Domains in Visualization
Once you have you opened the Social Analyzer pane, you can isolate and examine individual email domains.
Note: Social Analyzer is very graphics-intensive. In order to avoid server issues, you should cull the data with
facets and other filters to isolate the information that you want to examine before viewing it in Social
Analyzer.

To analyze email domains in Visualization mode
1.

Open Social Analyzer.

Click the domain bubbles to select the domain(s) that you want to view.

(optional) If you want to view the top ten domains in terms of received emails. click

. Each time you

click this icon, the next top ten bubbles will be selected, and so forth.
4.

(optional) You can zoom in and zoom out of the Social Analyzer panel. If you hover over a domain
bubble, the full display name and address, as well as the count, is displayed in the tool tip.

You can expand selected email domains and examine individual emails in a domain. See Analyzing
Individual Emails in Visualization on page 353.

Analyzing Individual Emails in Visualization
You can expand email domains to display individual emails and the traffic between those emails.

To analyze individual emails within selected email domains
1.

Open Social Analyzer.

Click the domain bubbles to select the domain(s) that you want to view.

(optional) If you want to view the top ten domains in terms of received emails. click

. Each time you

click this icon, the next top ten bubbles will be selected, and so forth.

Using Visualization

Visualizing Email Data

| 353

(optional) You can zoom in and zoom out of the Social Analyzer panel. If you hover over a domain
bubble, the full DisplayName and address, as well as the count, will be displayed in the tool tip.

Click

to expand the domain names to display the individual emails.

Posting Email Results Back to the Examiner
After you have identified emails that are relevant to your investigation, you can post them back to the Examiner
for further review. For example, you may drill down to an certain individual that had sent 25 emails to various
domains. You can do the following:
Add

the 25 emails to a Label

Add

the 25 emails to a Bookmark

Check
Clear

the 25 emails in the File List

all other checked emails in the File List and check only these 25 emails.

To post email results
1.

In the Social Analyzer, identify emails that you want to post.

Click Post Results Back.

Select the desired option.

Using Visualization

Visualizing Email Data

| 354

About the Detailed Visualization Time Line
You can use the Detailed view of the visualization time line to get a more granular view of the files and emails in
your data set. This helps you use the time line to identify the files and emails that are important in your
investigation. The detailed view provides the following time bands that you can turn on or off to get a more or
less granular view of the files:
Years
Months
Days
Hours
Minutes
Seconds
Milliseconds

Different file types are represented by different colors to assist in identifying relevant files.

Using Visualization

About the Detailed Visualization Time Line

| 355

Using the Detailed Visualization Time Line
You can use the Detailed view of the time line to get a more granular view of the files and emails in your specified
time line. You can change the Time Line View option to switch between the Basic view and the Detailed view.
Important: Before you launch the Detailed time line view, you must specify a base time line in the basic view that
includes the data that you want to look at. Otherwise, you will only be able to see the files that are in
the default base time line.
See About the Base Time Line on page 338.

To use the detailed visualization time line
1.

Select a data set that you want to view.

Launch the visualization panel.
See Launching Visualization on page 336.

Specify the base time line for the data that you want to view.
See Setting the Base Time Line on page 340.

For the Time Line View, click Detailed.

Understanding How Data is Represented in the Detailed Time Line
In the detailed view, each file, or group of files, is represented with a flag with a circle. Each flag displays the file’s
name, item number, category, size, and date. If you click a flag, the item it represents is selected in the file list
pane at the bottom of the visualization interface.
The color of each flag and circle represents the type of data. For example, the color blue represents Graphics
files. To the right of the time line, there is a Legend that displays what each color represents.
The span of the files depends on the base time line that you selected previously in the basic view.
See Setting the Base Time Line on page 340.

Using Visualization

Using the Detailed Visualization Time Line

| 356

About Time Bands
If several items fall within a particular time frame, it can be difficult to see all of them. This is because their flags
can overlap in the limited amount of interface space that is available.
You can manipulate the time line by giving the time line a greater or less granular view by using different time
bands. You can use one or more of the following time bands to change your view:
Years
Months
Days
Hours
Minutes
Seconds
Milliseconds

When you first open visualization, it will determine which time bands to enable based on the date range of the
base time line.
You can choose to display or hide a time band. The bands are displayed at the bottom of the time line. The more
time bands that you turn on, the more granular the data becomes.

Using Visualization

Using the Detailed Visualization Time Line

| 357

For example, suppose you turn on the Year, Month, and Day time bands.

The Year time band is on the bottom, with the Month time band above that, and the Days time band (1-31) is
above that. There are green dots in the bands. The green dots represent files or groups of files. Also in the
example, there is a box in the center of the bands. That box is the view window. The view window is always in
the center of the time line. You will only see the files that are in the view window. You can slide the time line to the
left and right to place files into the view window.
If there are large clusters of files, you can turn on more time bands to get a more granular view of the files.

Using Visualization

Using the Detailed Visualization Time Line

| 358

Modifying the Time Line Using Time Bands and Zoom
You can select different time bands to get a greater or less granular view of your data.

To change the time bands of the detailed time line
1.

To display or hide a time band, in the top left corner, click a band to toggle it on or off.
When a band is on, it is shadowed with a dark box.
Be aware that when you change time bands, the focus box of that time band will be centered in the time
line, and there may not be any files in the focus area. You will need to slide the time line to put the green
dots back into the focus area.

Slide the time line to place the data in the view window.
You can do one of the following options:
Click

the right or left arrows in the upper-right corner.

Click

the time line and drag it left or right.

Use

the mouse scroll wheel to move it left or right.

You can also use the Zoom In and Zoom Out buttons (top-right corner) to modify the view.
The zoom feature does not change the time bands or the selected date range. It simply displays more
or less of the data.

Understanding How Grouping Works in the Detailed Visualization Time
Line
If there are more than 500 items that all within a particular time period, the items are grouped together under a
single grouped flag that represents all of the items. Grouping helps you to still use the detailed time line without
having to view an overwhelming amount of data flags in a small amount of space.
You can have the data grouped by the following two methods:
Selected

Time - (Default) Items are grouped by a specific time period, for example Days. For example,
you could have 25 items on the 5th, 200 items on the 6th, and 1100 items on the 7th. There would be a
single group for each day.

Fixed

Number - Items are grouped into by a maximum group size of 500. Using the previous example, if
there were 1325 total items, they would displayed in three groups of 441 files.

The group flag includes a Details button. Click the Details button to display a list of all of the items that are
grouped under that flag.
You can also click a group to get a more granular view of the files in the group. When you click a group additional
time bands are enabled to give you a more detailed view.
Be aware that multiple flags may be staked vertically. You may need to make the time line pane taller by
dragging the bottom border of the pane down.

Using Visualization

Using the Detailed Visualization Time Line

| 359

Example of grouping

Using Visualization

Using the Detailed Visualization Time Line

| 360

Visualizing Browser History Data
You can view internet browser history files in the detailed visualization timeline. You can view browser history
from the following browsers:


Explorer

Firefox
Chrome
Safari
Opera

In order to view internet browsing history files in the detailed visualization timeline, you must first process the
browser history files. By default, the option to process browser history files is disabled. You must enable the
Process Browser History for Visualization option in either the processing options or additional analysis options.
See Evidence Processing Options on page 76.
See Using Additional Analysis on page 124.

To view internet browser history files in the detailed visualization timeline
1.

If you have browser history files, in the File List Overview tab, browse to File Category > Chat Files >
browser name > History.

Right-click one or more browser history files and select Visualize Browser History...
View browser history files from only one manufacturer at a time.
If the Visualize Browser History... option is grayed-out, then either the file has not been processed
with the Process Browser History for Visualization option enabled, or the file type is not supported.
If it is a supported file, the detailed visualization timeline is opened.
You may need to adjust the blue selection box to include the data that you want to see.
For information on viewing the visualization timeline, see About the Visualization page (page 337).

Visualizing Other Data
You can process specific file types so that they can be viewed in the visualization timeline.
EVTX
IIS

files - See Viewing Data in Windows XML Event Log (EVTX) Files (page 269)

Log files - See Viewing IIS Log File Data (page 271)

Registry
CSV

data files - See Viewing Registry Timeline Data (page 273)

files that are in the Log2Timeline format - See Viewing Log2Timeline CSV File Data (page 275)

Using Visualization

Visualizing Browser History Data

| 361

Chapter 28
Using Visualization Heatmap

Heatmap allows you to view a visual representation of file categories and file volume within a project. Information
displays in a grid comprised of squares of different colors and sizes. Each color represents a different file
category, and the relative size of the square represents the file volume within the category. You can view each
file category for more details about the files within that category (similar to a file tree) and navigate between file
categories.
You can also switch between viewing the file volume by the physical size of each file and the file count. This
allows you to see any discrepancies in the size of the files. For example, if someone were trying to hide a file by
renaming the file extension, you could easily see the size discrepancy in the heatmap, and then investigate that
particular file further.

To access Heatmap
1.

In FTK, do the following:
1a.

Open the Examiner.

1b.

In the File List panel, click

(Heatmap).

In Summation, eDiscovery, CIRT, or ResolutionOne, do the following:
2a.

Click Project Review.

2b.

In the Item List panel, click Options > Visualization >

Heatmap.

Heatmap Panel

Using Visualization Heatmap

| 362

Heatmap Options Panel
The following table defines the tasks from the Heatmap panel.

Heatmap Panel Options
Element

Description
Cancels the heatmap filters and exits out of Visualization.
Apply the visualization graph filters to the Item List grid. Once applied, only those
items filtered with visualization appear in the Item List grid.

Options
Category



Metric




Using Visualization Heatmap

Files - Allows you to view files by the file category. You can view the files in
each category:
By double-clicking that particular file category’s square, or
By clicking the menu from the upper left side and choosing the file category that you want to view in the heatmap.
Folders - Allows you to view files by the folders contained within the project.
You can view the files in each folder:
By double-clicking that particular folder’s square.
By clicking the menu from the upper left side and choosing the folder that
you want to view in the heatmap.
Extensions - Allows you to view files by the file extension.
By Size - Allows you to view file types by size of the files. The larger the files,
the larger the represented square in the heatmap.
By Count - Allows you to view file types by quantity. The more files of a particular type that are in the project, the larger the represented square in the heat
map.

| 363

Chapter 29

Using Visualization Social Analyzer

About Social Analyzer
The Social Analyzer shows a visual representation of email volume contained in the data set. Social Analyzer
will display all of the email domains in a project, as well as individual email addresses within the email domains.
Social Analyzer Map

The Social Analyzer map displays emails in the data set group by domain name. These domain names appear
on the map in circles called “bubbles.” The larger the bubble, the more emails are contained within that domain.
The bubbles in the map are arranged in a larger sphere according to how many emails were sent to that domain.
The center bubble in the sphere will have the most emails sent from this domain, while domains radiating
clockwise from the center will have fewer and fewer emails in their domain bubble. If you want to examine email
domains with the most sent emails, concentrate on examining the bubbles in the center of the map.
Email data in the Social Analyzer map can be examined on two different levels. On the first level, you can get an
overall view of communications between domains. You can then select domains that you want to examine in a

Using Visualization Social Analyzer

About Social Analyzer

| 364

more detailed view and expand those domains to view communications between specific email addresses from
the domain. For example, if you search for high email traffic between two domains, you can see which two
domains have the highest amount of traffic between them. Select the two domains, and expand them to view the
email traffic between individual users from those two selected domains.
See Analyzing Email Domains in Visualization on page 368.
See Analyzing Individual Emails in Visualization on page 368.

Elements of the Social Analyzer Map
Element

Description
This map presents the overall view of the social analyzer data. The orange
rectangle indicates the area displayed in the main social analyzer map. Black
dots in the overall view show domains that are either selected or communicating.
You can either expand or collapse the overall view by clicking on the triangle in
the upper right corner.

When you select a domain bubble, it is surrounded by a colored double ring. The
ring may be colored blue, black, purple, or red. The different colors allow you to
distinguish between different selected domains, but they do not have any
significant meaning.
Domain bubbles that are not selected, but have sent emails to the selected
domain bubble, are surrounded by a single colored ring that is the same color as
the selected domain bubble. This allows you to easily tell which domains have
been communicating with the selected domain bubble. Domain bubbles that do
not connect to any selected domains are greyed out.
Lines connect other domain bubbles to the selected domain bubble. These lines
represent emails sent to the selected domain from other domains. The more
emails that have been sent to the domain, the thicker the line between domain
bubbles are. You can also see emails sent from the selected domain. Select
Show Reversed Connections in the Social Analyzer panel to show visual
representations of emails sent from the selected domain.
A domain bubble with an orange ring indicates that a domain has been
connected to from another domain multiple times. This allows you to pinpoint
domains that have heavy communication between them.

Using Visualization Social Analyzer

About Social Analyzer

| 365

Accessing Social Analyzer
To navigate throughout the Social Analyzer pane, click and drag inside the pane. Hover over an email domain
bubble to view the total number of emails that were sent from the domain.
Note: Expansion of large datasets may result in slow server speeds and slow rendering the Social Analyzer
visualization data.

To access Social Analyzer
1.

Click Project Review.

In the Item List panel, click Options > Visualization > Social Analyzer.

Social Analyzer Options Panel

Using Visualization Social Analyzer

About Social Analyzer

| 366

Social Analyzer Options
The following table identifies the tasks that you can perform from the Social Analyzer panel.

Social Analyzer Options
Element

Description

Apply Visualization

Applies the visualization graph filters to the Item List grid. Once
applied, only those items filtered with visualization will appear in
the Item List grid.

Cancel Visualization

Cancels the visualization graph filters and exits out of
Visualization.
Refreshes the Social Analyzer pane.

Refresh
Clear Selections

Clears the selected bubbles in the Social Analyzer pane.

Select Most Connected Items

Selects the ten bubbles that have been most connected to in the
Social Analyzer pane. Each time you click this icon, the next top
ten bubbles will be selected, and so forth.

Expand Selected Domains

Expands selected domains in the Social Analyzer pane. You can
drill down to a second level to examine the email data. See
Analyzing Individual Emails in Visualization on page 368.

Zoom In

Zoom Out

Zooms into the Social Analyzer pane. If you are unable to view
the social analyzer data, click Zoom In to locate the data. You can
also zoom in by expanding the slider bar located at the bottom of
the Social Analyzer pane, by using the + key on the keyboard, or
by scrolling the mouse wheel up.
Zooms out of the Social Analyzer pane. You can also zoom out
by expanding the slider bar located at the bottom of the Social
Analyzer pane, by using the - key on the keyboard, or by scrolling
the mouse wheel down.
Expands and collapses the overall map of the data set. Dots that
appear in black in the overall map are domains/emails that are
connected to the selected domain/email. The orange rectangle on
the map shows where the expanded location is on the map.

View






Using Visualization Social Analyzer

Show Reversed Connections - Select to show all reversed
connections in the pane. Reversed connections are emails
sent from a particular email or email domain.
Show Connections - Select to show the connections between
domains in the pane. Connections are emails sent to a particular email or email domain.
Preview Connections on Hover - Select to view connections
between domains when you hover over them. This option is
not selected by default to speed rendering of the map.
Email Display - Display email domains either by the display
name or address.
Bubble Limit - You can choose a display limit of either 2,500,
5,000, or 10,000 domains. Server issues may occur with larger
display limits.

About Social Analyzer

| 367

Social Analyzer Options
Element

Description

Stats

Displays the statistics of either the first or second level of the
email domain data. You can view:
 The total number of domains, emails, and bubbles in the pane.
 The total number of selected domains, emails, and bubbles in
the pane.
 The total number of domains, emails, and bubbles that have
been expanded.
You can access the second level of data by clicking Expand
Selected Data.

To analyze email domains in Visualization mode
1.

Click Project Review.

In the Item List panel, click Options > Visualization > Social Analyzer.

Click the domain bubbles to select the domain(s) that you want to view.

(optional) If you want to view the top ten domains in terms of received emails. click

. Each time you

click this icon, the next top ten bubbles will be selected, and so forth.
5.

(optional) You can zoom in and zoom out of the Social Analyzer panel. If you hover over a domain
bubble, the full display name and address, as well as the count, is displayed in the tool tip.

You can expand selected email domains and examine individual emails in a domain. See Analyzing
Individual Emails in Visualization on page 368.

Analyzing Individual Emails in Visualization
You can expand email domains to display individual emails and the traffic between those emails.

To analyze individual emails within selected email domains
1.

Click Project Review.

In the Item List panel, select Options > Visualization > Social Analyzer.

Click the domain bubbles to select the domain(s) that you want to view.

(optional) If you want to view the top ten domains in terms of received emails. click

. Each time you

click this icon, the next top ten bubbles will be selected, and so forth.
5.

(optional) You can zoom in and zoom out of the Social Analyzer panel. If you hover over a domain
bubble, the full DisplayName and address, as well as the count, will be displayed in the tool tip.

Click

to expand the domain names to display the individual emails.

Using Visualization Social Analyzer

About Social Analyzer

| 368

Chapter 30

Using Visualization Geolocation

About Geolocation Visualization
Geolocation allows you to view a map with real-world geographic location of evidence items that have
geolocation information associated with them. This lets you understand where certain activities/actions took
place .
See Using Visualization on page 183.
For example, if you have photos in the evidence that have GPS data in the EXIF data, you can see where those
photos were taken. For volatile/RAM data, you can see the lines of communication (both sent and received)
between addresses, showing the location of all parties involved.
Geolocation supports the following data types:
Photos
Live

with GPS information in the EXIF data.

email sender and receiver IP data gathered using a Volatile Job in AD CIRT and AD ResolutionOne.

Email

sender and receiver IP data gathered using a Network Acquisition Job in AD CIRT and AD
ResolutionOne. Because the data is gathered from Sentinel, the data displayed shows a snapshot of the
traffic at the time that Sentinel captured the data.

When viewing geolocation data, you can use any of the three following maps:
MapQuest

Streets

MapQuest

Satellite

OpenStreetMaps

You have the option to switch between the three map views while in the Geolocation filter.

Geolocation Workflow
When you launch Geolocation, it will display all relevant files currently in the item list. You can cull the data using
filters and other tools in the item list to limit the data that is displayed in geolocation.

Geolocation Requirements
As a prerequisite, you must have the following:
Access

to a KFF Service Server.

The

KFF Server can be installed on the same computer as the AccessData software or on a separate
computer.

Using Visualization Geolocation

About Geolocation Visualization

| 369

KFF Geolocation Data. This must be installed on the KFF Server.
See Installing KFF on page 424.
Internet

access to view Web-based maps.

You

can download the offline maps for Geolocation. Use the link Geolocation Map for Offline Use and
Geolocation Map for Offline ReadMe on the FTK Product download page:
http://www.accessdata.com/support/product-downloads/ftk-download-page

For

AD ResolutionOne and AD CIRT:

The

Geolocation option selected when processing the evidence. This option allows the data to display
properly in the Geolocation filter. Geolocation is selected by default when evidence is processed.
Default Evidence Processing Options (page 88)

For

examining network acquisition and volatile data, enable the Geolocation option in the Web Config
file. To enable this option, contact AccessData’s support.

Also

for examining network acquisition and volatile data, you need to generate a text file of your IP
locations and place the text file in the GeoData directory. Creating a Location Configuration File
(page 370)

For

FTK, FTK Pro, Lab, and Enterprise:

The

File Signature Analysis option selected when processing the evidence.

Creating a Location Configuration File
When using AD CIRT and AD ResolutionOne, in order to have Geolocation Visualization populate the network
acquisition and volatile data in the map and Item List, you need to create a text file for the KFF server. This file
must contain a block of IPs in your local network and written with the following requirements:
The

text file needs to be saved with the filename iplocations.txt.

The

IP addresses must be written in CIDR format and need to be IPv4 addresses.

Each

comment line in the file must start with the character #. List only one address/network per line.

The

network line must contain the following information in the following order: address (in CIDR format),
Id, CountryCode, CountryCode3, CountryName, Region, City, PostalCode, Latitude, Longitude,
MetroCode, AreaCode, ContinentCode, Source.

The

iplocations.txt file must be placed in the Geodata folder of the kffdata folder on the server.

The following is an example of an iplocations.txt file:

#this file goes in the \GeoData directory
#address (in cidr
form),Id,CountryCode,CountryCode3,CountryName,Region,City,PostalCode,Latitude,Longitud
e,MetroCode,AreaCode,ContinentCode,Source
#192.168.0.0/24,1,,USA,United States,Utah,Taylorsville,84129,40.6677,-111.9388,,801,,
#10.10.200.252/30,1,,USA,United States,Utah,Orem,84042,40.2969,-111.6946,,801,NA,
#10.10.200.48/32,1,,USA,United States,Utah,Orem,84042,40.2969,-111.6946,,801,NA,
10.10.200.0/24,1,,USA,United States,Utah,Orem,84042,40.2969,-111.6946,,801,NA,

Using Visualization Geolocation

About Geolocation Visualization

| 370

Viewing Geolocation EXIF Data
When your evidence has photos with GPS information in the EXIF data, you can view photo locations.

To view EXIF data in the Geolocation viewer
1.

In FTK, do the following:
1a.

Open the Examiner.

1b.

In the File List panel, click

(Geolocation).

In Summation, eDiscovery, CIRT, or ResolutionOne, do the following:
2a.

Click Project Review.

2b.

In the Item List panel, click Options > Visualization >

Geolocation.

Geolocation Panel - EXIF data

Using Visualization Geolocation

Viewing Geolocation EXIF Data

| 371

Viewing Geolocation IP Locations Data
You can use geolocation to view IP location data to discover where in the world a computer is communicating.
You can view IP locations data when using one of the following products:
AD

CIRT and AD ResolutionOne, after running either a Volatile Job or a Network Acquisition Job

AD

Forensics products, after gathering Volatile data

The Geolocation view will display lines that trace internet traffic sent and received between IP addresses,
indicating the physical location of all parties involved. You can drill into geographic regions to see multiple
evidence items. You can then select specific data to post back to the case, where they can view information in
the examiner or include it in reports.

Geolocation Panel - IP Locations To view IP data in Geolocation viewer

To view IP location data in the Geolocation viewer
1.

In FTK, do the following:
1a.

Open the Examiner.

1b.

In the Volatile tab, click

(Geolocation).

In CIRT or ResolutionOne, do the following:
2a.

Click Project Review.

2b.

In the Item List panel, click Options > Visualization >

Using Visualization Geolocation

Geolocation.

Viewing Geolocation IP Locations Data

| 372

Geolocation Panel
Points of data in a particular area on the map are represented by large dots called clusters. The number on each
cluster show how many points of data (known as pins) are represented by the cluster. Clicking a particular
cluster on the map zooms in on a group of pins.
The general location of the clusters are determined by a central point on the map. The clusters radiate from this
central point. When you zoom in and out of the map, your central point on the map moves as well, and clusters
will shift position on the map. However, as you zoom into a cluster, the cluster rendered will more closely align
itself with the location of the individual pins.
When viewing IP data, the connections between two pins display on the map as lines between clusters/pins. The
width of the lines represent the amount of traffic between two IP address. The thicker the lines, the more traffic
has occurred. Green lines represent traffic originating from the pin and red lines represent traffic entering the pin.
When you select a cluster and zoom in on a particular pin, you can select one or more pins. When a pin is
selected, the outline and shadow of the selected pin turns orange. If you zoom out of the map, the cluster with
one or more selected pins has an orange ring.
Hovering over the cluster displays the following icons:


Selects all of the pins in a cluster.



Clears all of the selected pins in a cluster.
Displays only the connections going in and out of the particular cluster. This option is not available



for EXIF data.


Selects connections in a cluster. This option is not available for EXIF data.

The following table describes the Geolocation panel options.

Geolocation Panel
Element

Description
Applies the visualization graph filters to the Item List grid. Once applied, only
those items filtered with visualization appear in the Item List grid.
Cancels the geolocation filters and exits out of Visualization.

Options
Displays the number of pins selected in the map versus the number of pins
available in the data.
Map Tab

Choose which map to display in the Geolocation filter.
Expands or collapses the overall view map.

Using Visualization Geolocation

Geolocation Panel

| 373

Geolocation Panel
Element

Description
Displays the latitude and longitude where the mouse pointer resides. To view the
position of a particular pin, hover the mouse over the pin. To view the exact
coordinates of the pin, select the pin and right-click.
Turns the connections between the pins/clusters either on or off.
Displays all of the pins on the map.
Zooms in or out on the map. A slide bar displays, allowing you to control the
zoom feature.

View All/View Selected
Displays either EXIF data or network connection data. You can also view both
types of data at the same time.

Filter

Right-clicking a pin displays more information about the pin.

Detail of Pin

In the pin dialog, you can:
Add

any notes

View

the exact coordinates and status of the pin

View

the IP Address of the pin

Using Visualization Geolocation

Geolocation Panel

| 374

Note: To save processing time and to ensure data accuracy, the host name does not populate in the

Geolocation pin. However, the host name does populate in the Item List.
Change

the color and shape of the pin

If you make any changes to the pin, a warning icon

displays that notifies you that changes were made to

the pin and need to be saved. You can do the following in the pin dialog:
Click

to save the changes that you have made to the pin

Click

to reset the pin. If changes have been saved previously to the pin, this action resets the pin to
the saved version

Click

to close the dialog

Using Visualization Geolocation

Geolocation Panel

| 375

Geolocation Columns
The data that the Geolocation filter uses to render the information is also available in columns in the Item List.
You can find the following columns in the Item List, depending upon the data that has been collected. These
columns can be sorted and filtered.
Data for geolocation columns require that the KFF Geolocation Data be installed.
See Geolocation Requirements on page 369.

Geolocation EXIF Data Columns
When your evidence has photos with GPS information in the EXIF data, you can view data using the following
columns.

Geolocation Columns: EXIF data
Column

Display name

Description

Geotagged Area Code:

Area Code

Area code location of geotagged photo or object.

Geotagged City:

City

City location of geotagged photo or object.

Geotagged Country Code:

Country Code:

ISO country code location of geotagged photo or object,
such as USA, FRA, MEX, HKG, and EST.

Geotagged Direction:

Direction

Direction geotagged photo or object.

Geotagged Latitude:

Latitude

Latitude of geotagged photo or object.

Geotagged Longitude:

Longitude

Longitude of geotagged photo or object.

Geotagged Postal Code:

Postal Code

Postal code of geotagged photo or object.

Geotagged Region:

Region

Regional or State location of geotagged photo or object,
such as NY, DC, IL, FL, and UT.

Geotagged Source:

Source

Source used to resolve geotagged GPS location to locality
information.

Using Visualization Geolocation

Geolocation Columns

| 376

Geolocation IP Locations Columns
When using AD CIRT and AD ResolutionOne, after running either a Volatile Job or a Network Acquisition Job,
you can view IP location data using the following columns.

Geolocation Columns: IP Data
Column

Description

GeolocationFromAreaCode

The area code that the communication originated from. This is usually
related to phone communication. Example: 415 is the area code for San
Francisco.

GeolocationFromCity

The city that the communication originated from. Example: San Francisco,
San Jose, Los Angeles.

GeolocationFromCountryCode

The numerical code of the country that the communication originated from.
This is usually related to phone communication. Example: The United
States’s country code is 1, China’s code is 86, and Australia's code is 61.

GeolocationFromDomainName

The identification string of a origin point of communication on the Internet.
This can be to a website or the domain of a company. Example:
Accessdata.com.

GeolocationFromISP

The Internet Service Provider that the communication originated from.
Example: Comcast, AT&T, Time Warner Cable.

GeolocationFromLatitude

The exact numerical value of the North-South location on the globe that
the communication originated from. Example: 37.783333 is the latitudinal
value for San Francisco.

GeolocationFromLongitude

The exact numerical value of the East-West location on the globe that the
communication originated from. Example: -122.416667 is the longitudinal
value for San Francisco.

GeolocationFromMetroCode

The code assigned to a particular region. This code indicated the location
in or near a large city where the communication originated from.

GeolocationFromNetspeed

The size of the connection, in bytes, that the communication originated
from. Example: 5000 is 5000 bytes of data a second.

GeolocationFromOrganization

The place or group that the communication originated from. Example:
AccessData.

GeolocationFromPostalCode

The code used for mailing identification of where the communication
originated from. Example: 94127 is the postal code for San Francisco.

GeolocationFromRegion

The area from which the communication originated from. Example:
Maidenhead’s region is England, Tokyo’s region is Tokyo.

GeolocationFromSource

The feed, or source from where the software obtained the information
about the communication and the origin. Example: Sentinel or from a thirdparty source.

GeolocationToAreaCode

The area code that the communication is being sent to. This is usually
related to phone communication. Example: 617 is the area code for
Boston.

GeolocationToCity

The city that the communication was sent to. Example: Boston,
Philadelphia, New York City.

Using Visualization Geolocation

Geolocation Columns

| 377

Geolocation Columns: IP Data (Continued)
Column

Description

GeolocationToCountryCode

The numerical code of the country the communication is being sent to,
usually related to phone communication. Example: The United States’s
country code is 1, China’s code is 86, and Australia's code is 61.

GeolocationToLatitude

The exact numerical value of the North-South location on the globe of the
communication’s destination. Example: 42.358056 is the latitudinal value
for Boston.

GeolocationToLongitude

The exact numerical value of the East-West location on the globe of the
communication’s destination. Example: -71.063611 is the longitudinal
value for Boston.

GeolocationToMetroCode

The code assigned to a particular region. This code indicated the location
in or near a large city where the communication was destined for.

GeolocationToPostalCode

The code used for mailing identification of where the communication was
destined for. Example: 94127 is the postal code for San Francisco.

GeolocationToRegion

The area from which the communication was destined for. Example:
Maidenhead’s region is England, Tokyo’s region is Tokyo.

GeolocationToSource

The feed, or source from where the software obtained the information
about the communication and the destination. Example: Sentinel or from a
third-party source.

Using Geolocation Column Templates
When using AD Forensics products, you can use the following Column Templates to help you quickly display
Geolocation-based columns in the File List:
Geolocation
GeoEXIF
GeoIP

- Displays all available Geolocation columns.

- Displays all columns that contain EXIF-related Geolocation data.

- Displays all columns that contain IP-related Geolocation data.

In the Forensics product User Guide, see Icons of the File List Tool Bar (page 229).

Geolocation Facets
You can also use facets to cull data based on Geolocation data.
See Geolocation Filters in the Facets Panel on page 557.

Using Visualization Geolocation

Geolocation Facets

| 378

Chapter 31

Customizing the Examiner Interface

This chapter includes the following topics
About
The

Customizing the Examiner User Interface (page 379)

Tab Layout Menu (page 380)

Moving

View Panels (page 381)

Creating

Custom Tabs (page 383)

Managing

Columns (page 384)

Customizing

File List Columns (page 384)

Creating

User-Defined Custom Columns for the File List view (page 385)

Deleting

Custom Columns (page 387)

Navigating

the Available Column Groups (page 387)

About Customizing the Examiner User Interface
You can use the View menu to control the pane views displayed in each tab. There are several tabs by default,
but you can create an interface view that best suits your needs.
Add or remove panes from the current tab using the View menu. Click View and click the unchecked pane to add
it to the current view, or click a checked item on the list to remove that pane from the current view.

To save the new arrangement
Click View > Tab Layout > Save.

The View menu lets you do the following:
Refresh
View

the current view’s data.

the Filter Bar

Display

the Time Zone for the evidence.

Choose

the display size for graphic thumbnails.

Manage

Tabs.

Select
Open

Trees and viewing panes to include in various tabs.

the Progress Window.

Customizing the Examiner Interface

About Customizing the Examiner User Interface

| 379

The Tab Layout Menu
Use the options in the Tab Layout menu to save changes to tabs, restore original settings, and lock settings to
prevent changes.
The following table describes the options in the Tab Layout menu.

Tab Layout Menu Options
Option

Description

Save

Saves the changes made to the current tab.

Restore

Restores the Examiner window to the settings from the last saved layout. Custom
settings can be restored.

Reset to Default

Sets the window to the setting that came with the program. Custom settings will be lost.

Remove

Removes the selected tab from the window.

Save All Layouts

Saves the changes made to all tabs.

Lock Panes

Locks the panes in place so that they cannot be moved until they are unlocked.

Add New Tab
Layout

Adds a new tab to the window. The new tab will be like the one selected when this
option is used. Customize the tab as needed and save it for future use.

Customizing the Examiner Interface

The Tab Layout Menu

| 380

Moving View Panels
Move view panes on the interface by placing the cursor on the title of the pane, clicking, dragging, and dropping
the pane on the location desired. Holding down the mouse button undocks the pane. Use the guide icons to dock
the pane in a pre-set location. The pane can be moved outside of the interface frame.

Moving View Panels

To place the view panel at a specific location on the application
1.

Place the mouse (while dragging a view pane) onto a docking icon. The icon changes color.

Release the mouse button and the panel seats in its new position.
The following table indicates the docking options available:

Docking Icons
Docking
Icon

Description
Docks the view panel to the top half of the tab.

Docks the view panel to the right half of the tab.

Docks the view panel to the left half of the tab.

Customizing the Examiner Interface

Moving View Panels

| 381

Docking Icons (Continued)
Docking
Icon

Description
Docks the view panel to the bottom half of the tab.

Docks the view panel to the top, right, left, bottom, or center of the pane. When docked to
the center, the new pane overlaps the original pane, and both are indicated by tabs on the
perimeter of the pane.

Docks the view panel to the top, right, left, or bottom of the tree pane. The tree panes cannot
be overlapped.

Locks the panels in place, making them immovable. When the lock is applied, the blue box
turns grey. This button is found on the toolbar.

Customizing the Examiner Interface

Moving View Panels

| 382

Creating Custom Tabs
Create a custom tab to specialize an aspect of an investigation, add desired features, and apply filters as
needed to accommodate conditions specific to a case.

To create a custom tab
1.

Click on the tab that is most like the tab you want to create.

Click View > Tab Layout > Add New Tab Layout.

Enter a name for the new tab and click OK. The resulting tab is a copy of the tab you were on when you
created the new one.

From the View menu, select the features you need in your new tab.
Note: Features marked with diamonds are mutually exclusive; only one can exist on a tab at a time.
Features with check marks can coexist in more than one instance on a tab.

Choose from the following:
Click

Save to save this new tab’s settings

Click

View > Tab Layout > Save.

Click

View > Tab Layout > Save All to save all changes and added features on all tabs.

To remove tabs
1.

Highlight the tab to be removed

Click View > Tab Layout > Remove.

Customizing the Examiner Interface

Creating Custom Tabs

| 383

Managing Columns
Shared Columns use the same familiar windows and dialogs that Local Columns use.

To create a Shared Column Template
1.

In Case Manager, click Manage > Columns.
The Manage Shared Column Settings dialog opens.

Highlight a default Column Template to use as a basis for a Custom Column Template.

Click New.

Enter a new name in the Column Template Name field.

Select the Columns to add from the Available Columns pane, and click Add >> to move them to the
Selected Columns pane.

Select from the Selected Columns pane and click Remove to clear an unwanted column from the
Selected Columns.

When you have the new column template defined, click OK.

Customizing File List Columns
The Column Settings dialog box allows the modification or creation of new definitions for the file properties and
related information that display in the File List, and in what order. Columns display specific information about, or
properties of, the displayed files.
Column settings are also used to define which file information appears in case reports. Use custom column
settings in defining reports to narrow the File List Properties information provided in the Bookmark and File List
sections.
Additional states have been added to keep track of users’ Label selections. For example, if the user has already
checked a Label name, that filename and path will turn red, and it remains red as long as it remains different
from the original status. Clicking it again will cycle it back to its original status and its color will return to black.
Note: Checking the Label name before choosing Apply Labels To, unchecks the Label name. Choose Apply
Labels To first, then check or select the files to apply the Label to.
Column Settings can be customized and shared.

To define or customize Column Settings
1.

From the File List, click Column Settings to open the Manage Column Settings dialog.
From the Manage Column Settings dialog you can do any of the following tasks:

TABLE 31-1
Button

Action

New

Create a new column template. This option opens a blank template you can use to
create a new template from scratch.

Edit

Edit existing custom column templates. Use this option to make changes to an
existing custom column template. You cannot edit default templates.

Customizing the Examiner Interface

Managing Columns

| 384

TABLE 31-1
Button

Action

Copy
Selected

Copy existing default or custom column templates. Start with the settings in an
existing template to customize it to your exact needs without starting from scratch.

Delete

Delete existing custom column templates. You cannot delete default templates

Import

Import custom column templates XML files from other cases. Use Import to utilize
a template from another source or that was created after you created your case.

Export

Export custom column templates to XML files for others to use. Export a custom
column to use in another system.

Make Shared

Case Administrators can Share custom column templates to the database so they
are available to all new cases. Once custom columns are Shared, the Application
Administrator manages them. However, the original remains in the case so the
Case Administrator has full control of it. Case Reviewers do not have sufficient
permissions to create custom column templates.

Apply

Apply the selected column template

To define column settings using a new or copied template, click New, Edit, or Copy Selected to open
the familiar Column Settings dialog.

In the Column Template Name field, type a name for the template.

In the Available Columns list, select a category from which you want to utilize a column heading.
You

can add the entire contents of a category or expand the category to select individual headings.

You

can move any item in the list up or down to position that column in the File List view. The top
position is the first column from left to right.

When you are finished defining the column setting template, click OK to save the template and return to
the Manage Column Settings dialog.

Highlight the template you just defined, and click Apply to apply those settings to the current File List
view.

Creating User-Defined Custom Columns for the File List view
You can define your own custom columns for use in the File List view. You must first export a file list to a TSV or
a CSV file from a case, then populate the spreadsheet with custom column names and your own data as it
relates to items that are listed by the ObjectID. To add the resulting custom columns to the File List view, you
simply import the TSV or CSV file that you created, add the custom columns to the template, and apply the
template.
If you import a custom column sheet that contains a column that you do not want to import, but you do not want
to delete the column, you can type IGNORE in the first row of the column.
Files saved as TSV or CSV are encoded UTF-8.

To define custom columns for the File List view
1.

Open CCExample.CSV in a spreadsheet program. The default path to the file is

C:\Program Files\AccessData\Forensic Toolkit\[version_number]
Use this example file to help you create your own custom columns.
2.

In the File List, select the files that you want to add to your custom columns settings template.

Customizing the Examiner Interface

Managing Columns

| 385

From the File List, click Export File List

In the Save in text box, browse to and select the destination folder for the exported file.

In the File name text box, type the first name of the file, but do not specify the extension.
Note: You can overwrite user created column setting files by giving the column template the same
name as an existing user created template. Be sure you provide a file name that is unique if you
don’t want to overwrite the original or existing column template file.

In the Save As type text box, click the drop-down and choose CSV (Comma delimited) (*.CSV)

In the File List items to export group box, click All Highlighted.

Click Column Settings.

In the Column Settings dialog box, ensure that Item Number is in the Selected Columns list. If
desired, you can move it to the top of the list, or remove all other columns headings that are listed in the
Selected Columns list.

10. Click OK.
11. In the Choose Columns drop-down, select the Column Setting you just created or modified.
12. Click Save.
13. Open the CSV file that you just created with the Export File List.
14. Copy the item numbers in the Item Number column.
15. In the opened CCexample.CSV file, paste the item numbers in the OBJECTID column.
16. Edit the column headings the way you want them.

For example, the spreadsheet column, “MyCustomInt:INT” displays as the column heading
“MyCustomInt” in the File List view.
Edit

“MyCustomInt” to be whatever you want:

The

INT portion allows integer values in the column

MyCustomBool:BOOL
CustomStr:STRING

column allows true or false values

heading allows text values.

17. Save the CCExample.CSV file with a new name, and in a place where you have rights to save and

access the file as needed.
18. Close the FileList.CSV (or whatever name you gave the Export File List file.
19. On the Evidence menu, click Import Custom Column File.
20. Navigate to the CSV file that you just saved, then click Open.
21. In the “Custom column data imported” dialog box, click OK.
22. On the Manage menu, click Column > Manage Columns, or click Column Settings on the File List

toolbar.
23. Choose a column template to copy, or create a new one.
24. Add the custom column headings to a new or existing template.
25. In the Column Settings dialog box, click OK.
26. In the Manage Column Settings dialog box, select the template that contains the custom headings, and

then click Apply.

Customizing the Examiner Interface

Managing Columns

| 386

Deleting Custom Columns
You can remove and delete custom columns that you have added to any column templates. You can delete
custom columns even if the File List view is turned off.
Note: The data is not deleted; only the custom columns that allowed you to see that specific data are deleted.

To delete custom column data
1.

On the Evidence menu, click Delete Custom Column Data.

Click Yes to confirm the deletion.

Navigating the Available Column Groups
The Column Settings dialog box groups column settings according to the following:

Available Column Groups


Common Features



Custom Columns (When a custom column template has been created or
imported.)



Disk Image Features



Email Features



File Status Features



Stats



File System Features



Mobile Phone (When an MPE AD1
image has been processed.)



ZIP-specific Features



All Features

Within each grouping, you can choose from a list of various column headings that you want to add. You can also
delete selected columns or arrange them in the order you want them to appear in the File List view.

To view the name, short name, and description of each available column
1.

On the Manage menu, click Columns > Managed Shared Columns.

Do one of the following:
Select
Open

a category.

a category and select an individual column setting name.

Do either of the following:
Click

Add >> to move your selection to the Selected Columns list.

Double-click

your selection to add it to the Selected Columns list.

Do either of the following.
Use

standard Windows column sizing methods to resize the column margins, thereby allowing you to
read each description.



Click anywhere in the Select Columns list box, and then hover over a column description to see the
entire description.

Click OK.

Customizing the Examiner Interface

Managing Columns

| 387

Note: The following information may be useful when navigating or viewing Available Columns and Groups.
When

you view data in the File List view, use the type-down control feature to locate the information you
are looking for. Sort on the Filename column, then select the first item in the list.
Type the first letter of the filename you are searching for. As you continue to type, next filename that
matches the letters you have typed will be highlighted in the list.
If at some point you see the file you are looking for displayed in the list, simply click on it. You may type
the entire file name for the exact name to be fully highlighted in the list.

A

new column has been added, “Included by Filters” within the All Features group. This column tells you
which filter caused a file to display in the File List pane. The Included by Filters column is not sortable.

In

the past, the “Processed” column was able to display only two states, Yes, and No. It has been
changed to display different states, such as the following:
P = Default (may be a null value)
C = Complete
Note: M = User’s manually carved items

Customizing the Examiner Interface

Managing Columns

| 388

Chapter 32

Working with Evidence Reports

You can create a case report about the relevant information of a case any time during or after the investigation
and analysis of a case. Reports can be generated in different formats, including HTML and PDF. The PDF report
is designed specifically for printing hard copies with preserved formatting and correct organization. The HTML
report is better for electronic distribution.
This chapter includes the following topics
Creating

a Case Report (page 390)

Adding

Case Information to a Report (page 391)

Adding

Bookmarks to a Report (page 392)

Adding

Graphics Thumbnails and Files to a Report (page 393)

Adding

a File Path List to a Report (page 395)

Adding

a File Properties List to a Report (page 396)

Adding

Registry Selections to a Report (page 397)

Adding

Screen Captures from Examiner (page 398)

Selecting

the Report Output Options (page 399)

Customizing
Viewing

the Report Graphic (page 400)

and Distributing a Report (page 401)

Modifying

a Report (page 402)

Exporting

and Importing Report Settings (page 402)

Writing

a Report to CD or DVD (page 403)

Working with Evidence Reports

| 389

Creating a Case Report
You can use the Report Wizard to create a report. The the settings that you specify in the Report Wizard are
persistent, and remain until they are changed by the user. You do not need to click OK until all the report creation
information is entered or selected. If you inadvertently close the Report Wizard, you can re-open it by clicking
File > Report.

To Create a Case Report
1.

In the Examiner, click File > Report to run the Report Wizard.

Define your requirements for the following:

TABLE 32-1
Option

Description

Case Information

See Adding Case Information to a Report (page 391)

Bookmarks

See Adding Bookmarks to a Report (page 392)

Graphics

See Adding Graphics Thumbnails and Files to a Report (page 393)

Videos

See Adding a Video to a Report (page 394)

File Path List

See Adding a File Path List to a Report (page 395)

File Properties
ListSee

See Adding a File Properties List to a Report (page 396)

Registry
Selections

See Adding Registry Selections to a Report (page 397)

When you have completed defining the report, click OK to open the Report Output options dialog.
See Selecting the Report Output Options (page 399)

Working with Evidence Reports

Creating a Case Report

| 390

Adding Case Information to a Report
The Case Information dialog lets you add basic case information to a report, such as the investigator and the
organization that analyzed the case.
For information about other items you can define for a report, See Creating a Case Report (page 390).

To Add Case Information to a Report
1.

In the Examiner, click File > Report.

In the left pane, under Report Outline, highlight Case Information to display the Case Information
options in the right pane.
You can select the Case Information check box to include a case information section in the report. You
can deselect the Case Information check box to exclude a case information section from the report.

In the Default Entries pane, deselect any entries that you do not want to include in the report.
If you inadvertently remove a default entry that you require, close and reopen the case to have the
default entries displayed again.

Double-click the Value field to enter information.

Add and remove entries with the Add and Remove buttons under the Default Entries section.

Provide a label (Name) and a value (Information) for the included entries.

(Optional) Select the Include File Extensions option to include a file extensions list and count in the
File Overview portion of the report.
The list of file extensions appears in the report under Case Information, after File Items and File
Category, and before File Status. The File Extensions List can be very long and may span many pages.
If you intend to print the report, this may not be desirable.

Working with Evidence Reports

Adding Case Information to a Report

| 391

Adding Bookmarks to a Report
The Bookmarks dialog lets you create a section in the report that lists the bookmarks that were created during
the case investigation. Each bookmark can have a unique sorting option and a unique column setting.
For information about other items you can define for a report, See Creating a Case Report (page 390).

To add Bookmarks to a Report
1.

In the Examiner, click File > Report.

In the left pane, under Report Outline, highlight Bookmarks to display the Bookmarks options in the
right pane.
You can select the Bookmarks check box to include bookmarks in the report. You can deselect the
Bookmarks check box to exclude bookmarks from the report.

In the right pane, click Filter to open the filters list.

Select one the filters from the list. The empty line at the top of the list lets you apply no filter to the
bookmarks.

Select the options to indicate which bookmarks you want to include. Choose Shared and/or User
bookmarks by group, or individually.

For each bookmark you choose to include, you can choose options from the Bookmark section on the
right. Options include:
Include

Bookmarked Email Attachments in Reports. This setting applies to all email children, not only
common attachments.

Export

files & include links.

Include

thumbnail for each object.

Choose a Thumbnail Arrangement option for each bookmark or bookmark group as follows:
Number
Include
Group

of thumbnails per row

all thumbnails at end of each bookmark section

all file paths at the end of thumbnails

Specify if you want to export the bookmarked files and include links to them in the report when it is
generated.

Specify if you want to include graphic thumbnails that may be part of any bookmarks. If you want to
create links to original files in the report, choose both to export the original files and to include graphic
thumbnails when the report is generated.

10. In the Report Options dialog, click Bookmarks.
11. Click Sort Options and do the following:
Click

the plus (+) to add a criterion, or click minus (-) to delete a criterion.

Click

the down arrow button on the right side of each line to open the drop down of available sort
columns.

Click

OK to save the selected Sort Options and close the dialog.

Note: The sort options you see are determined by the Columns Template you have selected
For more information on customizing columns, see Customizing File List Columns (page 384).
12. Specify if you want to apply all settings for this bookmark to child files.

Working with Evidence Reports

Adding Bookmarks to a Report

| 392

Adding Graphics Thumbnails and Files to a Report
The Graphics section in the Report Options dialog lets you define whether-or-not to create a section in the report
that displays thumbnail images of the case graphics. You can also link the thumbnails to a full sized version of
the original graphics if desired.
For information about other items you can define for a report, See Creating a Case Report (page 390).

To add graphics thumbnails and files to a report
1.

In the Examiner, click File > Report.

In the left pane, under Report Outline, highlight Graphics to display the Graphics options in the right
pane.
You can select the Graphics check box to include graphics in the report. You can deselect the
Graphics check box to exclude graphics from the report.

To apply a filter to any included graphics files in a report, click Filter and select a filter to apply to the
graphics.

To export and link full-sized graphics in the report, click the Export and link full-size graphics to
thumbnails option.

Select one of the following options
Include

checked graphics only

Include

all graphics in the case

To sort the graphics by name or by path, click Sort Options. In the Sort Options dialog, use the Plus (+)
and Minus (-) buttons to add and remove sort options. Click the drop-down arrow on the right side of the
line to select either Name or Path.

Specify the number of graphics thumbnails to display per row and choose whether-or-not to Group all
filenames at end of report.

Working with Evidence Reports

Adding Graphics Thumbnails and Files to a Report

| 393

Adding a Video to a Report
The Video section in the Report Options dialog lets you define lets you define whether-or-not to create a section
in the report that displays the thumbnail images and/or the rendered MP4 files of the case videos. You can also
choose to include a link to the original full sized version of the video. These thumbnails and MP4 videos are
created during evidence processing or during additional analysis.
See Generating Thumbnails for Video Files (page 261).
See Creating Common Video Files (page 263).

To add video thumbnails and files to a report
1.

In the Examiner, click File > Report.

In the left pane, under Report Outline, highlight Videos to display the Video options in the right pane.
You can select the Videos check box to include videos in the report. You can deselect the Videos check
box to exclude videos from the report.

To apply a filter to any included video files in a report, click Filter and select a filter to apply to the
videos.

To export and link the original videos in the report, click the Export and link original videos option.

To include a link to the rendered MP4 videos that were created during evidence processing or during
additional analysis, check Export rendered videos.

To include the thumbnails of the videos in the report that were created during evidence processing or
during additional analysis, check Export rendered thumbnails.

Select one of the following options
Include

checked videos only

Include

all videos in the case

To sort the videos by name or by path, click Sort Options. In the Sort Options dialog, use the Plus (+)
and Minus (-) buttons to add and remove sort options. Click the drop-down arrow on the right side of the
line to select either Name or Path.

Specify the number of video thumbnails to display per row in the Rendered Thumbnail Arrangement
group box.

10. Click Columns. In the Manage Column Settings dialog, select the Settings Template to copy or edit.

For detailed information on creating and modifying Columns Templates, see Customizing File List
Columns (page 384).

Working with Evidence Reports

Adding a Video to a Report

| 394

Adding a File Path List to a Report
The File Paths dialog lets you create a section in the report that lists the file paths of files in selected categories.
The File Paths section displays the files and their file paths; it does not contain any additional information.
For information about other items you can define for a report, See Creating a Case Report (page 390).

To add a File Path List to a Report
1.

In the Examiner, click File > Report.

In the left pane, under Report Outline, highlight File Path to display the File Path options in the right
pane.
You can select the File Path check box to include a file path section in the report. You can deselect the
File Path check box to exclude a file path section from the report.

Select a filter from the Filter drop-down, to apply a filter to the items you want to include a file path list.
You can leave the filter option empty to not apply a filter.

Select from the Available Categories list to include the category or categories in the report by dragging
the category to the Selected Categories list.

To also export and link to the selected files in the File Path list, select the check-boxes box next to the
items in the Selected Categories box.
If you do not select a check-box Selected Categories list, the File Path is included in the report, but the
files themselves are not exported and linked to the File Path in the report.

Working with Evidence Reports

Adding a File Path List to a Report

| 395

Adding a File Properties List to a Report
The File Properties dialog lets you create a section in the report that lists the file properties of files in selected
categories. Several options let you make the File Properties List in the report as specific or as general as you
want it to be.
For information about other items you can define for a report, See Creating a Case Report (page 390).

To Add a File Properties List to a Report
1.

In the Examiner, click File > Report.
In the left pane, under Report Outline, highlight File Properties to display the File Properties options in
the right pane.
You can select the File Properties check box to include a file properties section in the report. You can
deselect the File Properties check box to exclude a file properties section from the report.

Either click the Filter drop-down arrow and selecting the desired filter, or choose no filter by selecting
the blank entry at the top of the filter drop-down list.

Drag and drop the categories that you want to include from the Available Categories window into the
Selected Categories window.

Check a category in the Selected Categories window to export related files and link them to the File
Properties list in the report.
Checking an item automatically selects the files and folders under it. If you do not want to include all
sub-items, expand the list and select and deselect each item individually.

In the Report Options dialog, click File Properties.

In the File Properties options area, click Columns.

In the Manage Column Settings dialog, select the Settings Template to copy or edit.
For detailed information on creating and modifying Columns Templates, see Customizing File List
Columns (page 384).

When you are done defining the columns settings, click OK.
You might want to define how the data is sorted, according to column heading. In the File List view you
are limited to a primary and secondary search. In the Report wizard, you can define many levels of
sorting.

In the Report Options dialog, click File Properties.

10. In the File Properties options area, click Sort Options and do the following:
Click

the plus (+) to add a criterion, or click minus (-) to delete a criterion.

Click

the down arrow button on the right side of each line to open the drop down of available sort
columns.

Click

OK to save the selected Sort Options and close the dialog.

Note: The sort options you see are determined by the Columns Template you have selected
For more information on customizing columns, see Customizing File List Columns (page 384).

Working with Evidence Reports

Adding a File Properties List to a Report

| 396

Adding Registry Selections to a Report
If your drive image contains Registry files, you can include them in your report.
When creating a Report that includes Registry files, a DAT extension is being added to the link. If the link does
not open in the report, it can be exported and opened in Notepad.
For information about other items you can define for a report, See Creating a Case Report (page 390).

To Add Registry Selections to a Report
1.

In the Examiner, click File > Report.
In the left pane, under Report Outline, highlight Registry Selections to display the registry selections
options in the right pane.
You can select the Registry Selections check box to include a Registry Selections section in the
report. You can deselect the Registry Selections check box to exclude a Registry Selections section
from the report.

In the Registry File Types window, check the file types for which you want to include headings for in your
report.

In the right window, check the registry file paths that you want included in your report.

Mark the box Include user generated reports (if any) if you have generated Registry Reports using
Registry Viewer, and you want to include them in this report.
Note: User-generated reports must exist in the case before generating the report, otherwise, this option
is disabled. These reports are generated in Registry Viewer and can be collected from the
Registry data found on the source drive.

Mark the box Select Auto Reports, to view and select which registry reports to include in the report
from those that were generated automatically based on the registry reports selection in Case Manager
> Case > New > Detailed Options > Evidence Refinement.
Note: If you did not select this option during pre-processing, this option is disabled in the Report
Options dialog.

Working with Evidence Reports

Adding Registry Selections to a Report

| 397

Adding Screen Captures from Examiner
You can now capture screenshots within the Examiner interface. You can include the screen captures when
creating reports. You can use screen captures to include information that is not easy to export or include in
reports, such as:
The

contents of the Natural view (File Content pane)

The

contents and information in the File List

The

contents of visualization pages

These UI elements can include information that is useful as evidence, but there is no way to present it outside of
the UI.
When you create a screen capture, the following occurs:
file is saved in the case folder under a Screenshots sub-folder. (Do not manually rename the
captured files, otherwise the Report dialog will not find them.)

The

file is saved in the original size and in a smaller size that may be needed to fit in a report.

The

name and description of the file is saved in the database so that they can be displayed in the Report
Options dialog.

To create a screen capture
1.

In the Examiner, click the screen capture icon.

Click and drag the + cursor to select the area that you want to capture.

In the Screen Capture Info dialog, give the screen capture file a name.

Enter a description.
This is recorded with the filename in the database.

Click Save.

To cancel a screen capture, click Esc.

To include a screen capture in a report
1.

In the Examiner, click File > Report.

In the Report Options, click Screen Capture.

Select the screen captures that you want to include in the report.

(Optional) You can edit the description of the files, but not the filename.

Configure the other options for the report.
When the report is created, the image files are copied to the report folder.

Working with Evidence Reports

Adding Screen Captures from Examiner

| 398

Selecting the Report Output Options
The Report Output dialog lets you select the location, language, report formats, and other details of the report.
You can also recreate the directory structure of exported items.
For information about other items you can define for a report, See Creating a Case Report (page 390).

To select the report output options
1.

When you have completed defining the report, from the Report Options dialog, click OK to open the
Report Output options dialog.

Type the destination folder name for the saved report, or use the Browse button to locate and select a
location.

Use the drop-down arrow to select the language for the written report. Available languages are as
follows:
Arabic (Saudi Arabia)

Chinese (Simplified, PRC)

English (United States)

German (Germany)

Japanese (Japan)

Korean (Korea)

Portuguese (Brazil)

Russian (Russia)

Spanish (Spain, Traditional Sort)

Swedish (Sweden)

Turkish (Turkey)
4.

Indicate the formats for publishing the report. You can choose any or all of the output formats.
To view a report made in any of the supported formats, you must have the appropriate application
installed on your computer. Options are as follows:
PDF (Adobe Reader)

HTML (Windows Web Browser)

XML (Windows Web Browser)

RTF (Rich Text Format: Most Text Editors)

WML (Unix Web Browser)

DOCX (MS Office Word 2007)

ODT (Open Document Interchange: Sun Microsystems OpenOffice Documents)
Note: Some report output formats require J#, either 1.1 or 2.0. If you select RTF format, for example, and J# is
not installed, you will see an error.
5.

Under Export Options do the following:
Check

the Use object identification number for filename to shorten the paths to data in the report.
Links are still created for proper viewing of the files.

The

unique File ID numbers, when used in a report, keep the pathnames shorter. This makes burning
the report to a CD or DVD more reliable.

Check

the Append extension to filename if bad/absent box to add the correct extension where it is
not correct, or is missing.

Under HTML Report Customization, choose from the following:
If

you wish to use your own custom graphic or logo, mark the Use custom logo graphic box, then
browse to the file and select it. Use GIF, JPG, JPEG, PNG, or BMP file types.

If

you wish to use a custom CSS file, mark the Use custom CSS box. Select the folder where the
custom CSS files have been saved. Click OK. The folder you selected displays in the “Use Custom
CSS” text box.

Working with Evidence Reports

Selecting the Report Output Options

| 399

Click OK to run the report.
If the report folder you selected is not empty, you will see the following error message:
Choose to Delete or Archive the contents of the folder, or to Cancel the report. Delete the contents of
the current destination folder, or change to a different destination folder, then recreate the report or
import it if you saved it during creation.

Customizing the Report Graphic
When you select HTML as an output format, you can add your own graphic or logo to the report.

To add your own graphic or logo
1.

In the Examiner, click File > Report to open the Report wizard.

From the Report Options dialog, after you are done making selections for the Report Outline, click OK.

In the Report Output dialog, under Formats, mark HTML. This activates the HTML Report
Customization options.

Under HTML Report Customization, mark Use custom logo graphic.

Click the Browse button to open the Windows Explorer view and browse to the graphic file to use for
the report. The file format can be JIF, JPG, JPEG, PNG, or BMP.

Click Open.

When all Report options have been selected, click OK.
The progress bar dialog indicates the progress of the report.
Note: When selected, the finished HTML and/or PDF reports open automatically.
You can process only one set of reports at a time. If you select the options to create several different
report formats before clicking OK to generate the report, all will process concurrently. However, if you
start that process and then decide to create a new report, you will not be able to until the current report
is finished generating.
If you start another report too soon, you will be prompted to wait, if you chose to create either HTML or
PDF format for the report, it will automatically open when creation is complete. Otherwise, to view the
report, click Yes when prompted.

Using Cascading Style Sheets
The formatting of reports can be customized with Cascading Style Sheets (CSS). Reports stores a file path you
select (default or custom) to the folder containing the custom CSS files. When CSS is not selected, Reports use
the default settings.
For reports to utilize the cascading style sheets, three CSS files are necessary, and must all be located in the
specified CSS folder:
Common.CSS
Bookmarks.CSS
Navigation.CSS

The original CSS files are found in the following path if no changes were made to the default:

C:\Program Files\AccessData\Forensic Toolkit\\bin\ReportResources

Working with Evidence Reports

Customizing the Report Graphic

| 400

Copy the *CSS files to a different directory before making changes to any of these files. Do not make changes to
the original files.
To utilize the customized CSS files, click Use custom CSS, and select the path to the folder where the
customized CSS files are stored.
When CSS is selected, Reports checks for those files in the specified directory. If any of the three files is missing
you are notified and the report does not proceed.
Note: The UI option consists of a check box and a text path string. The path string points to the path directory
that contains the three needed CSS files.

Note: The UI options settings are persistent per Windows login user. Thus, your selections will be persistent
across the Case List for the currently authenticated user.
Important: In versions, the cascading style sheets have been updated for a better user experience. Updates
include persistent highlighting on the navigation tree (so examiners know which item they are
viewing) and better organization of data within the report.
However, if you have created personalized templates in previous versions, you will need to re-create
them for 5.1.

Viewing and Distributing a Report
The report contains the information that you selected in the Report Wizard. When included in the report, files
appear in both raw data and in the report format.

To view the report outside of Examiner
1.

Browse to the report file

Click on the report file:
Click

on index.htm to open an HTML document in your Web browser.

Click

on the file [report].PDF to open the report in a PDF viewer.

Working with Evidence Reports

Viewing and Distributing a Report

| 401

Modifying a Report
Modify the report by changing the report settings, and recreating it. Add the new evidence or change report
settings to modify the report to meet your needs.
Change the report settings for each report as needed.
All previously distributed reports should be retracted to keep all recipients current.
Note: If you want to keep a previous report, save the new report to a different folder that is empty.

Exporting and Importing Report Settings
Report settings are automatically saved whenever you generate a report. You can export the settings that you
used as an XML file. You can then later import and reapply those same settings to use with new reports that you
generate.

To export report settings
1.

In the Examiner, click File > Report.

In the Report Options dialog box, click Export.

In the Export Sections dialog, select the sections that you want to export.

Click OK.

Click Browse to select a folder to save the settings.

You can accept the default name for the report settings file, or you can type a name for the settings file.
An XML extension is automatically added when the report is created.

Click Save for each item you have selected in the Report Outline list.

Click OK.

To import saved settings for a new report
1.

In the Examiner, click File > Report.

In the Report Options dialog, click Import.

Browse to a settings XML file that you want to apply, and select it.

Click Open to import and apply the settings file to your current report.

Working with Evidence Reports

Modifying a Report

| 402

Writing a Report to CD or DVD
You can write a report to a CD or DVD, depending on the report’s size. It is recommended that you select Use
object identification number for filename, in the Report Output options dialog. This option keeps paths
shorter, so they do not exceed the limits of the media format.
After you create the report, write only the contents from the root of the report folder, and not the report folder
itself. The autorun automatically launches the report’s main page (index.htm) using the default browser when the
CD is read on a Windows computer.
Note: The following information pertains to burning reports to a CD or DVD.
When

burning some reports to a CD, some Registry Viewer Auto Reports links may be broken, where
they work when viewing on the computer. To avoid this issue, make sure that longer Joliet filenames are
enabled when burning report to a CD.

To

launch the report, the computer must be configured to automatically execute autorun files.

If

you burn the folder that contains the report to the CD or DVD, the autorun will not be at the root of the
disk, and will not work properly.

To

prevent broken links to report files, use File Item numbers instead of names to keep paths short, and /
or use the Joliet file naming to allow longer file paths.

Working with Evidence Reports

Writing a Report to CD or DVD

| 403

Part 5

Reference

This part contains additional reference information and contains the following appendices
Using

the Known File Filter (KFF) (page 405)

Installing
Working

KFF (page 424)

with Windows Registry Evidence (page 446)

Supported

File Systems and Drive Image Formats (page 454)

Recovering
Managing

Deleted Material (page 457)

Security Devices and Licenses (page 459)

Configuring

for Backup and Restore (page 480)

AccessData

Distributed Processing (page 484)



AccessData Oradjuster (page 491)

Reference

| 404

Chapter 33

Using the Known File Filter (KFF)

About KFF
The Known File Filter (KFF) is a utility that compares the file hash values of known files against the files in your
project. The known files that you compare against may be the following:
Files

that you want to ignore, such as operating system files

Files

that you want to be alerted about, such as malware or other contraband files

The hash values of files, such as MD5, SHA-1, etc., are based on the file’s content, not on the file name or
extension. This helps you identify files even if they are renamed.
Using KFF during your analysis can provide the following benefits:
Immediately

identify and ignore 40-70% of files irrelevant to the project.

Immediately

identify known contraband files.

About KFF Components
KFF is comprised of the following components:
The

KFF Server

The

KFF Data

Each component is managed separately and can be shared across multiple AccessData installations.
See Introduction to the KFF Architecture on page 424.
See How KFF Works on page 427.

Using the Known File Filter (KFF)

About KFF

| 405

Process for Using KFF
To use the KFF feature, you perform the following steps:

Process for using KFF
Step 1.

Install and configure the KFF Server.
See Installing KFF on page 424.

Step 2.

Configure the KFF Data (groups and hash sets) that you want to use.
See Configuring KFF Data on page 407.

Step 3.

Configure a KFF template to use for a case.
See Configuring KFF Templates for Use in Cases on page 416.

Step 4.

Enable KFF for a case.
See Enabling KFF for a Case on page 418.

Step 5.

Review KFF results in the Examiner.
See Reviewing KFF Results in a Case on page 419.

Using the Known File Filter (KFF)

Process for Using KFF

| 406

Configuring KFF Data
When configuring KFF Data, you configure the following KFF Data components:
Hashes
Hash

sets

Groups
Libraries
Templates

See Components of KFF Data on page 425.
When configuring KFF Data, you can do the following:
Install pre-defined KFF libraries

As part of the KFF installation, you can install pre-configured hash
libraries:
NIST

NSRL

NDIC

HashKeeper

DHS

See Installing Pre-defined KFF Data Libraries on page 437.
These are installed as KFF Groups.
Import KFF Groups and Hash
Sets

See Importing KFF Data on page 409.

Manually create and configure
KFF Libraries, Groups, and
Hash Sets

You can create a custom KFF Library.
See Manually Creating a KFF Library on page 410.
After you have created the library, you can add hashes to the library.
See Adding and Managing KFF Hashes in a Library on page 411.
See Manually Managing Hash Sets in a Library on page 413.

Organize hash sets for a case
by creating a KFF template

See Configuring KFF Templates for Use in Cases on page 416.

About the KFF Admin page
To configure KFF Data, you use the KFF Admin page.

To open the KFF Admin page
From the Case Manager or the Examiner, click Manage > KFF...

The KFF Admin page opens.
If the Configure KFF dialog appears instead, check the following:
The

KFF Server is installed.
See Installing KFF on page 424.

The

application has been configured for the KFF Server.
See Configuring the Location of the KFF Server on page 435.

The

KFF Service is running.
See Configuring KFF Server Settings on page 433.

Using the Known File Filter (KFF)

Configuring KFF Data

| 407

Elements of the KFF Admin page
Tab

Element

Description

Templates tab

Lets you create and manage templates, groups,
and pre-configured sets.

Templates

Lets you create, rename, and edit KFF templates.
Configuring KFF Templates for Use in Cases
(page 416)

Groups

Lets you create and manage KFF groups.
Using KFF Groups (page 414)
Save as Default

You can specify a group to be the default if a
template is not selected when enabling KFF.
See Enabling and Configuring KFF on page 418.

You can close a group so that it cannot be edited or
deleted while in a closed state.

Export

You can share KFF hashes by exporting KFF
groups. Exports are saved in XML format.
See Exporting KFF Groups on page 415.

Sets

Displays sets that you have installed or imported.
For example, if you install NSRL KFF data, those
sets are displayed here.
If you import sets from a pre-existing group, those
sets appear here.
This does not list the sets that are part of a custom
library.
These sets are not editable You can add and edit
custom sets on the Libraries tab.

Import

Lets you import KFF hashes from a pre-existing
group.
Importing KFF Data (page 409)

Libraries tab

Lets you create and manage libraries for custom
hash sets.
See Manually Configuring KFF Libraries and Hash
Sets on page 410.
KFF Library List

Displays the existing libraries along with their owner
and status.
The owner is the application that creates the library,
such as FORENSIC TOOLKIT, INSIGHT, or
SUMMATION.

Lock

Lets you lock a library so that it cannot be edited or
deleted through a different application.
For example, if you create a library using
FORENSIC TOOLKIT, and lock it, it cannot be
modified by a someone using INSIGHT, or
SUMMATION.

Create Group

Lets you create a KFF Group.
See Using KFF Groups on page 414.

Using the Known File Filter (KFF)

Configuring KFF Data

| 408

Importing KFF Data
You can import KFF data in one of the following ways:
Import

KFF hashes and groups. For example, you can import hashes that you have previously saved as
a KFF Group.
See About Importing KFF Groups on page 409.

Import

custom KFF hashes into a custom library.
See Importing Custom KFF Hashes into a Library on page 411.

When you perform an import, a KFF log file records any errors or hash updates.
See Viewing KFF Import Data Logs on page 420.

About Importing KFF Groups
Using KFF Admin, on the Templates tab, you can import hashes from other databases or files. You can also
import groups that you exported from a previous version.
You can import hashes from one of the following file types:
Delimited

files (CSV or TSV)

Hashkeeper

Hash Set (HKE)

AccessData

Hash Database (HDB)

FTK

Exported KFF files (KFF)

FTK

Supported XML files (XML)

When you import hashes, you can specify the following default values:
Status
Name

- The hash status: Alert or Ignore
- The hash set name

Source

Vendor

Version
Package

When you perform an import, a KFF log file records any errors or hash updates.
See Viewing KFF Import Data Logs on page 420.

About Duplicate Hashes
If multiple Hash Set files containing the same Hash identifier are imported into a single KFF Library, the library
keeps the last Hash Set’s metadata information, overwriting the previous Hash Sets’ metadata. This only
happens within an individual library and not across multiple libraries.

About CSV Files
Hash values can be saved into CSV files that can be imported into KFF libraries. Normally, you can only import
hashes into a single hash set at a time.
However, you can use custom libraries and an expanded CSV format to import hashes into multiple sets using a
single CSV file.

Using the Known File Filter (KFF)

Configuring KFF Data

| 409

See Using Expanded CSV Files to Import Hashes into Multiple Sets on page 411.

Importing KFF Sets
To import a KFF set
1.

Open the Case Manager or the Examiner.

Click Manage > KFF.

On the Templates tab, click Import.

Click Add File.

To browse to a file, do the following:
5a.

For the Path, click ...

5b.

Browse to the path of the file.

5c.

Use the file type selector to view the types of files that you are looking for.

5d.

Click Open.

Enter information for the hash set:
About Importing KFF Groups (page 409)

After you have selected a file and added the information, click OK.

Add or remove additional files.

Click Import.
The data is added to the Sets list.

10. Configure groups to add to a KFF template.

See Managing KFF Groups on page 415.
See Configuring KFF Templates for Use in Cases on page 416.

Manually Configuring KFF Libraries and Hash Sets
KFF Libraries are custom collections of hashes and hash sets. Within a library, you can do the following:
Import

custom hash sets into a custom library.

Manually

create hash sets

Manually

edit hash sets

Note: You cannot edit hash sets from pre-configured libraries such as NIST NSRL, NDIC HashKeeper,

and DHS.

Manually Creating a KFF Library
Before you can manually configure custom KFF hash sets, you need to create a library to hold those sets. You
can create and manage KFF libraries on the Libraries tab of the KFF Admin page.
You can also edit, delete, or lock a library.
See Managing KFF Libraries on page 411.

Using the Known File Filter (KFF)

Configuring KFF Data

| 410

To create a KFF Library
1.

Open the Case Manager or the Examiner.

Click Manage > KFF.

Click the Libraries tab.

Click New.

Enter a name for the KFF Library and click OK.

Managing KFF Libraries
You can edit the names of and delete KFF libraries.
You can also lock a KFF library. You may have multiple applications that share the KFF Server and libraries.
When you lock a library, another application cannot delete it, edit it, or modify the sets or hashes that are part of
it. This is useful when using a product like Summation or InSight along with FTK. If you create a library in FTK
and lock it, a user in InSight who has access the same KFF server and data cannot delete or edit it.

To manage a KFF library
1.

Open the Case Manager or the Examiner.

Click Manage > KFF.

Click the Libraries tab.

Select a Library.

(Optional) Click Edit or Delete.

(Optional) To lock or unlock a library, click Lock.

Adding and Managing KFF Hashes in a Library
You can add hashes and hash sets to a library by doing the following:
Importing

a file with custom hashes
See Importing KFF Data on page 409.

Manually

creating hashes and hash sets
See Manually Managing Hash Sets in a Library on page 413.

After adding hashes, you can view the hashes that are contained in a hash set and library.
See Viewing and Searching for Hashes in a Hash Set on page 413.

Importing Custom KFF Hashes into a Library
Using Expanded CSV Files to Import Hashes into Multiple Sets
You can use an expanded CSV format to import hashes into more than one set at a time using a single CSV file.
The expanded CSV format has the following five new columns at the beginning:
SetName
SetStatus

Using the Known File Filter (KFF)

Configuring KFF Data

| 411

SetVendor
SetVersion
SetPackage

The following is the sample CSV file enlarged to show the first columns.

You can use these values to add hashes into multiple sets with multiple statuses into a library. For example, you
can have some hashes be added to one hash set with an Alert status, and other hashes added to another set
with an Ignore status.
You do not have to use or populate these five values in the CSV. When you import the file, you can set default
values for the import. If any of the values are not included in the CSV file, the defaults that you specify when
performing the import will be used. If a value is included in the CSV file, the value in the file takes precedence
and is used.

Importing Custom KFF Hashes
To import KFF Hashes
1.

Open the Case Manager or the Examiner.

Click Manage > KFF.

Click the Library tab.

Select a KFF library from the KFF library list.

Click Edit.

Click Import.

Click Add File.

Browse to the file and click OK.

Enter information for the hash set in the columns and set the Status as either Alert or Ignore.

10. Add or remove files.

Using the Known File Filter (KFF)

Configuring KFF Data

| 412

11. Click Import.

The hash sets in the file you imported display in the bottom pane.

Manually Managing Hash Sets in a Library
Using the Hash Sets list, you can manually add sets to or delete sets from the library.

To manually create hash sets in a library
1.

On the KFF Admin page, click the Library page.

Select a KFF library to which you want to add a set.

In the Edit KFF Library pane, click New.

Enter a name for the set.

Select the status for the set: Alert or Ignore.

Enter a package, vendor, or version.

Click OK.

To manually manage sets in a library
1.

On the KFF Library page, select a KFF library that you want to edit.

To edit a set, select a set a set, and click Edit.

To delete a set from the library, select a set a set, and click Delete.

Manually Managing Hashes in a Hash Set
You can manually add, edit, and delete hash values within a hash set.

To manage hashes in a hash set
1.

Click Manage > KFF.

Click the Libraries tab.

Select a Library.

Click Edit.

Click Hashes.

To add hashes to a hash set
1.

In the KFF Hashes page, click Add

Enter the KFF hash info, such as category, description, and hash value.

Click Save.
The new hash is displayed.

Viewing and Searching for Hashes in a Hash Set
Due to the large number of hashes that may be in a set, a list of hashes is not displayed. You can use the KFF
Hash Finder to search for hash values within a hash set. You can search by entering a complete hash value. You
can only search within one hash set at a time.

Using the Known File Filter (KFF)

Configuring KFF Data

| 413

To view hashes in a hash set
1.

Click Manage > KFF.

Click the Libraries tab.

Select a Library.

Click Edit.

Click Hashes.

In the Hash field, enter the complete hash value that you want to search for.

Click Search.

To edit hashes in a hash set
1.

Search for and select a hash.

Click Edit

Enter the KFF hash info.

Click Save.
The edited hash is displayed.

To delete hashes from a hash set
1.

Search for and select a hash.

Click Delete

Using KFF Groups
About KFF Groups
A KFF template is simply a container for one or more KFF groups. KFF groups are the containers for one or
more hash sets that you want to use from one or more libraries.
When you create a template, you add groups to the template. You then add hash sets to the groups.

Creating KFF Groups
You create KFF templates and groups to organize your hash sets for projects.
When you add sets to a group, you can choose to override the status of the individual sets or use them as they
are defined in the hash sets.
You can also add, edit, and delete KFF templates and groups.
See Managing KFF Templates on page 417.

To create a KFF group
1.

Open the Case Manager or the Examiner.

Click Manage > KFF.

Using the Known File Filter (KFF)

Configuring KFF Data

| 414

Do one of the following:
In

the Templates tab, under Groups, click New.

In

the Libraries tab, select a library and click Create Group.

Enter a Name.

Select the sets to include in the group.

Click OK.

Managing KFF Groups
You can edit the name of and delete KFF groups.

To manage a KFF Group
1.

Open the Case Manager or the Examiner.

Click Manage > KFF.

Select a template or group.

Click Edit.

Exporting KFF Groups
You can share KFF hashes by exporting KFF groups. Exports are saved in XML format.

To export a KFF group
1.

Open the Case Manager or the Examiner.

Click Manage > KFF.

Select a group.

Click Export.

Select the location to which you want to save the exported file.

Enter a name for the exported file.

Click Save.

Using the Known File Filter (KFF)

Configuring KFF Data

| 415

Configuring KFF Templates for Use in Cases
About KFF Templates
After you have KFF sets and groups with the hashes that you want to use, you must specify which hashes from
all your libraries you want to use for a given case. To specify the hashes that you want to use in cases, you
create KFF Templates. KFF templates are containers of groups of hash sets.
When you enable the KFF Processing Option for a case, you select one KFF template to use. A KFF template is
simply a container for one or more KFF groups. KFF groups are the containers for one or more hash sets that
you want to use from one or more libraries.
When you create a template, you add groups to the template.
See Using KFF Groups on page 414.

Creating KFF Templates
You create KFF templates and groups to organize your hash sets for projects.
When you add sets to a group, you can choose to override the status of the individual sets or use them as they
are defined in the hash sets.
You can also add, edit, and delete KFF templates and groups.
See Managing KFF Templates on page 417.

To create a KFF template
1.

Open the Case Manager or the Examiner.

Click Manage > KFF.

In the Templates tab, under Templates, click New.

Enter a Name.

Click OK.

To add a group to a KFF Template
1.

Create the KFF groups that you want to add to a template.
See Using KFF Groups on page 414.

In the Templates tab, select a template that you want to add a group to.

In the Groups section, check the groups that you want to include in the template.

Click Save.

Using the Known File Filter (KFF)

Configuring KFF Templates for Use in Cases

| 416

Managing KFF Templates
You can edit the name of and delete KFF templates.
Important: Use caution when deleting a KFF template. If an existing project is using a template and you delete
that template, you will no longer be able to use that data to search against.
When you are in a project that used a deleted template, opening the KFF tab displays the following
message:
“The template assigned to this project can not be found. It may have been removed. Please select
another template.”

To manage a KFF template
1.

In the Templates tab, select a template that you want to add a group to.

Select a template or group.

Click Rename or Delete.

Using the Known File Filter (KFF)

Configuring KFF Templates for Use in Cases

| 417

Enabling KFF for a Case
When you create a case or run Additional Analysis, you can enable KFF and configure the KFF settings for the
project.

About Enabling and Configuring KFF
To use KFF in a project, do the following:

Process for enabling and configuring KFF
1. Enable KFF

If you want to use KFF, you must enable it when you create a case or run
Additional Analysis.

2. Select a KFF Template

When enabling KFF for a case, select the one KFF Template that you want to
use. You can only select an existing template or create a new template.
See About KFF Templates on page 416.

Enabling and Configuring KFF
To enable and configure KFF for a case
1.

Do one of the following:
Create

a new case and open the Evidence Processing options.
See Configuring Evidence Processing Options on page 70.

In

an existing case, open the Additional Analysis page.
See Using Additional Analysis on page 124.

In the options, select KFF.

In the KFF drop-down menu, select the template that you want to use.
See About KFF Templates on page 416.
Note: If you selected a KFF group to be a default, you can select ***Case Specific*** to use that group.

Using the Known File Filter (KFF)

Enabling KFF for a Case

| 418

Reviewing KFF Results in a Case
KFF results display in the Examiner.
You can use the following tools to view KFF results:
KFF

Filters

KFF

Information in Columns

KFF

Details

About KFF Data Shown in the Item List
You can identify and view files that are either Known or Unknown based on KFF results.
Depending on the KFF configuration options, there are three possible KFF statuses in Project Review:
Alert

(2) - Files that matched hashes in the template with an Alert status

Ignore

(1) - Files that matched hashes in the template with an Ignore status (not shown in the Item List by
default)

Unknown

(0) - Files that did not match hashes in the template

About KFF Filters
You can use filters to view KFF data.
There are two filters for KFF:
KFF

Alert Files

KFF

Ignore Files

Using the KFF Information Quick Columns
KFF Columns
Column

Description

KFF Status

Displays the status of the file as it pertains to KFF. The three options are
Unknown (0), Ignore (1), and Alert (2).

KFF Group

Displays the name created for the KFF Group in the project.

Using the Known File Filter (KFF)

Reviewing KFF Results in a Case

| 419

Viewing KFF Import Data Logs
When you perform an import of hashes, a log file is created and records the following:
If

a hash was imported into a library that already contained the same hash, the log reports that the
previous hash was updated to the latest hash.

If

any errors occurred during the import, they are recorded here. An example of an error is a hash value
that was not valid.

The log files are located in a logs sub-folder on the KFF server. It is under the KFF Data folder that was
specified when the KFF Server was installed.

Using the Known File Filter (KFF)

Viewing KFF Import Data Logs

| 420

Using the Known File Filter (KFF)

Viewing KFF Import Data Logs

| 421

Using the Known File Filter (KFF)

Viewing KFF Import Data Logs

| 422

Using the Known File Filter (KFF)

Viewing KFF Import Data Logs

| 423

Chapter 34

Installing KFF

This document contains the following information about installing the Known File Filter (KFF).
About

KFF (page 424)

Introduction

to the KFF Architecture (page 424)

About

the KFF Server and Geolocation (page 429)

About

Installing the KFF Server (page 430)

Installing

the KFF Server (page 430)

Configuring

KFF Settings (page 433)

Installing

Pre-defined KFF Data Libraries (page 437)

Installing

KFF Updates (page 440)

that you want to ignore, such as operating system files

Files

that you want to be alerted about, such as malware or other contraband files

The hash values of files, such as MD5, SHA-1, etc., are based on the file’s content, not on the file name or
extension. The helps you identify files even if they are renamed.
Using KFF during your analysis can provide the following benefits:
Immediately

identify and ignore 40-70% of files irrelevant to the project.

Immediately

identify known contraband files.

Introduction to the KFF Architecture
There are two distinct components of KFF:
KFF

Server - The KFF Server is an application that is used to process the KFF data against the evidence.

KFF

Data - The KFF data are the hashes of the known files that are compared against the files in your
project. The KFF data can be comprised of hashes obtained from pre-configured libraries or custom
hashes that you configure your self.

Installing KFF

About KFF

| 424

Each component is installed separately. The KFF database is no longer stored in the shared evidence database
or on the file system in EDB format.

Components of KFF Data
Item

Description

Hash

The unique MD5 or SHA-1 hash value of a file. This is the value that is compared
between known files and the files in your project.

Hash Set

A collection of hashes that are related somehow. The hash set has an id, status,
name, vendor, package, and version. In most projects, a set corresponds to a
collection of hashes from a single source

Status

The specified status of a hash set of the known files which can be either Ignore
or Alert. When a file is a project matches a known file, this is the reported status
of the file in the project.

Library

A collection of hashes and hash sets
You can use pre-defined libraries or configure your own libraries and ass hashes
to them.
See About Pre-defined KFF Hash Libraries on page 426.

Group and Template

Groups and Templates are containers that are used for managing the hash sets
that are used in a project.
A group is a collection that you define of hash sets from one or more libraries.
Templates are containers for one or more groups. When you configure a project
or case to use KFF, you select template to use. This is how you select which
hashes are used in a project. Each project can only use one template at a time.

About Hashes
Hashes, such as MD5, SHA-1, etc., are based on the file’s content, not on the file name or extension.
The KFF Library includes hash values in .TSV, .CSV, .HKE, .HKE.TXT, .HDI, .HDB, .hash, .NSRL, or .KFF file
formats.
Hash sets must be added to a group before it can be utilized in a project. Groups are used to categorize the
hashes according to the types of files the hashes came from and what you intend to identify by using them in the
project.

Installing KFF

Introduction to the KFF Architecture

| 425

About Pre-defined KFF Hash Libraries
All of the pre-configured hash sets currently available for KFF come from three federal government agencies
and are available in KFF libraries.
See KFF Pre-Defined Hash Sources on page 441.
You can download the following KFF libraries from the AccessData Downloads page:
NIST

NSRL
See About Installing the NIST NSRL Data on page 437.

NDIC

HashKeeper (Sept 2008)
See Installing the NDIC Hashkeeper Library on page 438.

DHS

(Jan 2008)
See Installing the DHS Library on page 438.

It is not required to use a pre-configured KFF library in order to use KFF. You can configure or import custom
hash sets.
For more information on KFF libraries and customizing or importing hash sets, see the Using KFF chapter in
your product User Guide.

About KFF Organization
The KFF data is organized into libraries. Groups and other constructs exist outside the libraries. Applications
interface with the KFF using a network protocol that allows them to manipulate the sets, hashes, groups,
libraries, and active groups and to perform lookup functions. Libraries contain hashes and sets, and can exist in
a global space. Predefined groups may exist in the global space, but may only reference libraries in the global
space.
Note: If two hash sets in the same library have the same MD5 hash value, they must have the same metadata.
If you change the metadata of one hash set, all hash sets in the library with the same MD5 hash file will
be updated to the same metadata.
The KFF data is owned by the KFF service, which responds to network requests. The KFF user interface
interacts with the KFF library API and the KFF service's management port API. You will be able to build libraries,
add sets and hashes to them, and submit them to the KFF Server.
If you are using a product with a Site Server license, Site Server will manage KFF lookups for collections from
the agent. Since Site Server cannot guarantee that it will be able to contact the KFF server, the libraries are
copied to the Site Server and a list of active sets is downloaded with each job.
The KFF Library data is contained in an ESE database, usually with an extension of .edb. The data is stored in a
manner that optimizes the lookup of hashes. The ESE (Extensible Storage Engine) technology is used for MS
Exchange and allows for efficient storage of the sets and hashes.

Installing KFF

Introduction to the KFF Architecture

| 426

How KFF Works
The Known File Filter (KFF) is a body of MD5 and SHA1 hash values computed from electronic files. Some predefined data is gathered and cataloged by several US federal government agencies. KFF is used to locate files
residing within project evidence that have been previously encountered by other investigators or archivists.
Identifying previously cataloged (known) files within a project can expedite its investigation.
When evidence is processed with the MD5 Hash (and/or SHA-1 Hash) and KFF options, a hash value for each
file item within the evidence is computed, and that newly computed hash value is searched for within the KFF
data. Every file item whose hash value is found in the KFF is considered to be a known file.

Status Values
In order to accelerate an investigation, each known file is labeled as either Alert or Ignore, meaning that the file
is likely to be forensically interesting (Alert) or uninteresting (Ignore). This Alert/Ignore designation can assist the
investigator to hone in on files that are relevant, and avoid spending inordinate time on files that are not relevant.
Known files are presented in the Overview Tab’s File Status Container, under “KFF Alert files” and “KFF
Ignorable.”

Hash Sets
The hash values comprising the KFF are organized into hash sets. Each hash set has a name, a status, and a
listing of hash values. Consider two examples. The hash set “ZZ00001 Suspected child porn” has a status of
Alert and contains 12 hash values. The hash set “BitDefender Total Security 2008 9843” has a status of Ignore
and contains 69 hash values. If, during the course of evidence processing, a file item’s hash value were found to
belong to the “ZZ00001 Suspected child porn” set, then that file item would be presented in the KFF Alert files
list. Likewise, if another file item’s hash value were found to belong to the “BitDefender Total Security 2008 9843”
set, then that file would be presented in the KFF Ignorable list.
In order to determine whether any Alert file is truly relevant to a given project, and whether any Ignore file is truly
irrelevant to a project, the investigator must understand the origins of the KFF’s hash sets, and the methods
used to determine their Alert and Ignore status assignments.
You can install libraries of pre-defined hash sets or you can import custom hash sets. The pre-defined hash sets
contain a body of MD5 and SHA1 hash values computed from electronic files that are gathered and cataloged by
several US federal government agencies.
See KFF Pre-Defined Hash Sources on page 441.

Groups
Above hash sets, the KFF is partitioned into two hash set groups. The AD_Alert group contains all default sets
with Alert status, and AD_Ignore contains all default sets with Ignore status. When the MD5/SHA-1 and KFF
options are chosen for processing, the AD_Alert and AD_Ignore groups are selected by default. This causes
hash set “look-ups” to be executed against the entire KFF. If the investigator selected only one of these two
groups, say AD_Ignore, then the hash value queries conducted during processing would be applied only to the
sets with Ignore status.

Installing KFF

How KFF Works

| 427

Important: If no group is selected, then KFF processing is voided.
In addition, hash set groups are assigned a status value, and each group’s status supersedes that of any of its
individual sets.

Higher Level Structure and Usage
Because hash set groups have the properties just described, and because custom hash sets and groups can be
defined by the investigator, the KFF mechanism can be leveraged in creative ways. For example, the
investigator may define a group of hash sets created from encryption software and another group of hash sets
created from child pornography files and then apply only those groups while processing.

Installing KFF

How KFF Works

| 428

About the KFF Server and Geolocation
In order to use the Geolocation Visualization feature in various AccessData products, you must do the following:
Install

the KFF Server 1.2.2 or later.
You install the KFF server in the normal way.
See Installing the KFF Server on page 430.

Install

the KFF Geolocation (GeoIP) Data (this data provide location data for evidence)
On the KFF installation disc, there is also an option to install KFF Geolocation data.
See Installing the Geolocation (GeoIP) Data on page 438.
From time to time, there will be updates available for the GeoIP data.
See Installing KFF Updates on page 440.

Installing KFF

About the KFF Server and Geolocation

| 429

Installing the KFF Server
About Installing the KFF Server
In order to use KFF, you must first install the KFF Server application.
Where you install the KFF Server depends on the product you are using with KFF:
For

FTK and FTK Pro, the KFF Server must installed on the same computer that runs the Examiner.

For

all other AD products, the KFF Server can be installed on either the same computer or on a remote
computer.

If you install the KFF Server on a deferent computer, you must configure the application with the location of the
KFF Server.
After installing the KFF Server, before installing data or using KFF, you must configure KFF Server settings.
See Configuring KFF Settings on page 433.
If you are installing KFF in a distributed processing environment, when you configure the KFF Server location,
you must specify the KFF server by its IP address and not use ‘localhost’. Otherwise you may get incorrect KFF
counts.
To install the KFF server, Microsoft .NET Framework 4 is required. If you do not have .NET installed, you will be
prompted to install it.
You can also check for and install KFF updates.

About the KFF Server Application versions
The KFF Server application is updated from time to time. It is best to use the latest version of the KFF Server.
KFF Server

Released

Installation Instructions

Version 1.2.4

February 2014 with FTK 5.2

See Installing the KFF Server on page 431.

Version 1.2.3

January 2014 with
ResolutionOne 5.2

version 1.2.2

November 2013 with FTK 5.1

version 1.2.1.3

July 2013 with FTK 5.0.1

version 1.2.0.115 May 2013 with FTK 5.0
version 1.1.0.55

April 2013

version 1.1.0.41

March 2013 with FTK 4.2.1

See the FTK 4.2.x User Guide.

About upgrading from FTK, FTK Pro, Lab, or Enterprise 4.1
If you are upgrading from 4.1, you can use 4.1 to export your existing KFF groups and then import them into
4.2.x or 5.x.
If you continue to use 4.1, you will use the 4.1 version of KFF, not the new KFF version for 4.2.x or 5.x.

Installing KFF

Installing the KFF Server

| 430

You do the following to install and add hash sets to KFF:
Install

the KFF Server

Configure

KFF Server settings

(Optional)

Install KFF libraries

KFF Server Prerequisites
Microsoft

.NET Framework
Microsoft .NET Framework 4 is required. If the computer does not have it installed, you will be prompted
to install it. If you install it at this time, the computer must be restarted before installing KFF.

Microsoft

Visual C++
Microsoft Visual C++ 2010. If the computer does not have it installed, you will be prompted to install it.

Recommended
Operation

environment:

System: 64-bit system

RAM:

For computers doing heavy processing, 24 GB is recommended, but less can be used
successfully.

CPU:

Core i7

Installing the KFF Server
Use these instructions to install the KFF server for the following:
FTK,
AD

FTK Pro, LAB, or Enterprise versions 4.2, 5.x, and later

ResolutionOne, Summation, CIRT, eDiscovery 5.0 and later

See About Installing the KFF Server on page 430.

To install the KFF Server
1.

Access the KFF Server installation files by doing one of the following:

Access

the setup file from the KFF Installation disc.

Download

the setup file from the web by doing the following:

1a.

Go to the AccessData Product Download website at: http://www.accessdata.com/support/productdownloads

1b.

On the Product Downloads page, expand Known File Filter (KFF).

1c.

Click Download to download one of the following ISO files:
KFF Server 1.2.2 (32-bit)
KFF Server 1.2.2 (64-bit
(AccessData recommends using a download manager program such as Filezilla.)

1d.

Mount the ISO.

Launch the Autorun.

Install the KFF Server.
3a.

Click Install KFF Server.

3b.

Install pre-requisite software if needed.

3c.

Specify the location that you want to install KFF to.

3d.

Complete the installation wizard.

Installing KFF

Installing the KFF Server

| 431

Configure the KFF settings.
See Configuring KFF Settings on page 433.

(Optional) Install KFF data.
See Installing Pre-defined KFF Data Libraries on page 437.

Installing the KFF Server for CIRT2.x
Before you install or configure KFF hash data for use with CIRT, you must install the KFF Server.
To install the KFF server for CIRT, follow the instructions in the CIRT documentation.
You can also check for and install KFF updates.
See Installing KFF Updates on page 440.

Installing KFF

Installing the KFF Server

| 432

Configuring KFF Settings
After installing the KFF Server, before using KFF you must configure KFF settings.
There are two places that you configure KFF settings:

Where to configure KFF Server Settings
Item

Description

The computer running
the KFF Server

You mus configure settings for the KFF Server.
See Configuring KFF Server Settings on page 433.

The computer running
the application

On the computer running the application, such as FTK, Lab, Summation, or
ResolutionOne , you configure the location of the KFF server.
See Configuring the Location of the KFF Server on page 435.

Configuring KFF Server Settings
The KFF Server Configuration dialog opens after the KFF Server installation is completed. You can also open
this dialog manually.

Important: To configure KFF, you must be logged in with Admin privileges.

KFF Server Settings
Item

Description

Interface port settings

Use the default interface port settings unless you want to use different ports for
your environment:
 KFF Management Interface is used to view KFF groups and sets. (Default
port is 3799)
 The KFF Lookup Interface is the port used to lookup KFF hashes. (Default
port is 3798)

Installing KFF

Configuring KFF Settings

| 433

KFF Server Settings
Item

Description

Interface thread settings

Specify the number of threads.
 KFF Management Interface is used to view KFF groups and sets. (Default
threads is 10)
 In most cases you will not need to modify the number of Management Interface threads.
 The KFF Lookup Interface is the port used to lookup KFF hashes. (Default
threads is 300)
Important: If you have too few Lookup Interface threads configured, it can result
in KFF not working and generating the following error in the error log:
“[Date] Failure on item ... Could not connect to KFF Server ..., token ...”
If you get the error, increase the thread count.

Storage Directory

Specify the location where you want to store KFF data. If you install KFF data,
this is the location it is stored to. The location must be configured before using
KFF.

Management
Communications
Certificate

(Optional) If you want to encrypt the KFF data, specify a Management
Communication Certificate

Start/Stop

You can manually start or stop the KFF Service.

To view or edit KFF Server configuration settings
1.

On the computer where the KFF Server is installed, click Start > All Programs > AccessData KFF
Server > KFF Server Configuration.

Configure the KFF settings.

Click Apply.

Installing KFF

Configuring KFF Settings

| 434

Configuring the Location of the KFF Server
On the computer running the application, after installing the KFF Server, you must specify the location of the KFF
Server.

Configuring KFF Settings on FTK computers.
Before using KFF with FTK, FTK Pro, Lab, or Enterprise, with KFF, you must configure the KFF settings.

Important: To configure KFF, you must be logged in with Admin privileges.

To view or edit KFF configuration settings
1.

In the Case Manager, click Tools > Preferences > Configure KFF.

Configure the KFF settings.
2a.

You can set or view the address of the KFF Server.
 If you installed the KFF Server on the same computer, this value will be localhost.
 If you installed the KFF Server on a different computer, identify your KFF server.

2b.

Use the default interface port settings unless you want to use different ports for your environment:
 KFF Management Interface is used to view KFF groups and sets. (Default port is 3799)
 The KFF Lookup Interface is the port used to lookup KFF hashes. (Default port is 3798)

2c.

(Optional) If you want to encrypt the KFF data, specify a Management Communication Certificate.

2d.

Click Test to validate communication with the KFF Server.

2e.

Click Close.

Configuring the KFF Server Location on Web-based Products
If you are using Summation, CIRT, eDiscovery, or ResolutionOne, so the following to specify the location of the
KFF Server.
1.

On the computer running the application (for example, the server running Summation), go to
C:\Program Files\AccessData\Common\FTK Business Services.

Open AdgWindowsServiceHost.exe.config.

Modify .

Change localhost to be the location of your KFF server (you can use hostname or IP).

Save and close file.

Installing KFF

Configuring KFF Settings

| 435

Restart the business services common service.

Installing KFF

Configuring KFF Settings

| 436

Installing Pre-defined KFF Data Libraries
You can install pre-defined KFF data libraries.
See About Pre-defined KFF Hash Libraries on page 426.
Note: If you install either DHS data or NDIC data after previously installing KFF Geolocation (GeoIP) data, you
will get an error that a newer version is already installed and will need to be uninstalled first.
Workaround: Uninstall the GeoIP data, install the DHS and/or NDIC data, then re-install the GeoIP data.

About Installing the NIST NSRL Data
If you want to use the NSRL library, you do the following:
Install
If

the complete library.

updates are made available, install the updates to bring the data up-to date.

Important: In order to use the NSRL updates, you must first install the complete library.
When you install an NSRL update, you must keep the previous NSRL versions installed in order to
maintain the complete set of NSRL data.
NSRL data release Released

Information

version 2.40

May 2013

Contains the full NSRL library up through update 2.40.
Install this library first.
See Installing the NSRL Data Library on page 437.

version 2.39

April 2013

Contains NSRL updates 2.36 through 2.39.

version 2.35

Feb 2012

Contains the full NSRL library up through update 2.35.

Installing the NSRL Data Library
After you install the KFF Server, you can install NSRL data. After you install NSRL data, you can view the
installed hash sets and groups.
You start by installing the full NSRL library up to version 2.40. You can then install any updates.
See About Installing the NIST NSRL Data on page 437.
You can also check for and install KFF updates.
See Installing KFF Updates on page 440.

To install the NSRL 2.40 library and updates
1.

Access the NSRL 2.40 installation files by doing one of the following:

Access

the setup file from the KFF Installation disc.

Download

the setup file from the web by doing the following:

1a.

Go to the AccessData Product Download website at: http://www.accessdata.com/support/productdownloads

1b.

On the Product Downloads page, expand Known File Filter (KFF).

1c.

Click Download to download one of the following ISO files:

Installing KFF

Installing Pre-defined KFF Data Libraries

| 437

KFF Server 1.2.2 & Cum. NRSL 240 Data (32-bit)
KFF Server 1.2.2 & Cum. NRSL 240 Data (64-bit
(AccessData recommends using a download manager program such as Filezilla.)
1d.

Mount the ISO.

Launch the Autorun.

Click Install NSRL Full Data 2.40 and complete the installation wizard.

Close the installation window.

Installing the NDIC Hashkeeper Library
You can install the Hashkeeper 9.08 library to work with versions 4.2.x of FTK, FTK Pro, Lab, and Enterprise as
well as version 2.2.3 and newer of CIRT.

To install the Hashkeeper library
1.

Go to the AccessData Product Download website at: http://www.accessdata.com/support/productdownloads

On the Product Downloads page, expand Known File Filter (KFF).

Download and run the NDIC Hashkeeper 9.08 installation file.

Installing the DHS Library
You can install the DHS 1.08 library to work with versions 4.2.x of FTK, FTK Pro, Lab, and Enterprise as well as
version 2.2.3 and newer of CIRT.

To install the DHS library
1.

Go to the AccessData Product Download website at: http://www.accessdata.com/support/productdownloads

On the Product Downloads page, expand Known File Filter (KFF).

Download and run the DHS 1.08 installation file.

Installing the Geolocation (GeoIP) Data
Geolocation (GeoIP) data is used for the Geolocation Visualization feature of several AccessData products.
See About the KFF Server and Geolocation on page 429.
You can also check for and install KFF updates.
See Installing KFF Updates on page 440.

To install the Geolocation Data
1.

Access the KFF installation files by doing one of the following:

Access

the setup file from the KFF Installation disc.

Download

Installing KFF

the setup file from the web by doing the following:

Installing Pre-defined KFF Data Libraries

| 438

1a.

Go to the AccessData Product Download website at: http://www.accessdata.com/support/productdownloads

1b.

On the Product Downloads page, expand Known File Filter (KFF).

1c.

Click Download to download one of the following ISO files:
KFF Server 1.2.2 & Cum. NRSL 240 Data (32-bit)
KFF Server 1.2.2 & Cum. NRSL 240 Data (64-bit
(AccessData recommends using a download manager program such as Filezilla.)

1d.

Mount the ISO.

Launch the Autorun.

Click Install Geolocation and complete the installation wizard.

Close the installation window.

Installing KFF

Installing Pre-defined KFF Data Libraries

| 439

Installing KFF Updates
From time to time, AccessData will release updates to the KFF Server and the KFF data libraries.
Some of the KFF data updates may require you to update the version of the KFF Server.
To check for updates, do the following:
1.

Go to the AccessData Product Download website at: http://www.accessdata.com/support/productdownloads

On the Product Downloads page, expand Known File Filter (KFF).

Check for updates.
See

About the KFF Server Application versions on page 430.

See

About Installing the NIST NSRL Data on page 437.

Installing KFF

Installing KFF Updates

| 440

KFF Reference
KFF Pre-Defined Hash Sources
This section includes a description of pre-defined hash collections that can be added to AccessData KFF Library.
The following pre-defined hash sets are currently available for KFF and come from one of three federal
government agencies:
NIST

NSRL (The default library installed with KFF)

NDIC

HashKeeper (An optional library that can be downloaded from the AccessData Downloads page)

DHS

(An optional library that can be downloaded from the AccessData Downloads page)

Note: Because the KFF Library is now multi-sourced, it is no longer maintained in HashKeeper format.
Therefore, you cannot modify the KFF in the HashKeeper program. However, the HashKeeper format
continues to be compatible with the AccessData KFF Library.

Use the following information to help identify the origin of any hash set within the KFF
The

NSRL hash sets do not begin with “ZZN” or “ZN”. In addition, in the AD Lab KFF, all the NSRL hash
set names are appended (post-fixed) with multi-digit numeric identifier. For example: “Password Manager
& Form Filler 9722.”

All

HashKeeper Alert sets begin with “ZZ”, and all HashKeeper Ignore sets begin with “Z”. (There are a
few exceptions. See below.) These prefixes are often followed by numeric characters (“ZZN” or “ZN”
where N is any single digit, or group of digits, 0-9), and then the rest of the hash set name. Here are two
examples of HashKeeper Alert sets:

Suspected child porn” and “ZZ14W”.
Here’s a HashKeeper Ignore set:

“ZZ00001

“Z00048
The


Corel Draw 6”.

DHS collection is broken down as follows:

In 1.81.4 and later there are two sets named “DHS-ICE Child Exploitation JAN-1-08 CSV” and
“DHS-ICE Child Exploitation JAN-1-08 HASH”.

In

AD Lab there is just one such set, and it is named “DHS-ICE Child Exploitation JAN-1-08”.

Once an investigator has identified the vendor from which a hash set has come, he/she may need to consider
the vendor’s philosophy on collecting and categorizing hash sets, and the methods used by the vendor to gather
hash values into sets, in order to determine the relevance of Alert (and Ignore) hits to his/her project. The
following descriptions may be useful in assessing hits.

Installing KFF

KFF Reference

| 441

NIST NSRL
The NIST NSRL collection is described here: http://www.nsrl.nist.gov/index.html. This collection is much larger
than HashKeeper in terms of the number of sets and the total number of hashes. It is composed entirely of hash
sets being generated from application software. So, all of its hash sets are given Ignore status by AccessData
staff except for those whose names make them sound as though they could be used for illicit purposes.
The NSRL collection divides itself into many sub-collections of hash sets with similar names. In addition, many of
these hash sets are “empty”, that is, they are not accompanied by any hash values. The size of the NSRL
collection, combined with the similarity in set naming and the problem of empty sets, allows AccessData to
modify (or selectively alter) NSRL’s own set names to remove ambiguity and redundancy.
Find contact info at http://www.nsrl.nist.gov/Contacts.htm.

NDIC/HashKeeper
NDIC’s HashKeeper collection uses the Alert/Ignore designation. The Alert sets are hash values contributed by
law enforcement agents working in various jurisdictions within the US - and a few that apparently come from
Luxemburg. All of the Alert sets were contributed because they were believed by the contributor to be connected
to child pornography. The Ignore sets within HashKeeper are computed from files belonging to application
software.
During the creation of KFF, AccessData staff retains the Alert and Ignore designations given by the NDIC, with
the following exceptions. AccessData labels the following sets Alert even though HashKeeper had assigned
them as Ignore: “Z00045 PGP files”, “Z00046 Steganos”, “Z00065 Cyber Lock”, “Z00136 PGP Shareware”,
“Z00186 Misc Steganography Programs”, “Z00188 Wiping Programs”. The names of these sets may
suggest the intent to conceal data on the part of the suspect, and AccessData marks them Alert with the
assumption that investigators would want to be “alerted” to the presence of data obfuscation or elimination
software that had been installed by the suspect.
The following table lists actual HashKeeper Alert Set origins:

A Sample of HashKeeper KFF Contributions
Hash

Contributor

Location

ZZ00001
Suspected child
porn

Det. Mike McNown
& Randy Stone

Wichita PD

ZZ00002
Identified Child
Porn

Det. Banks

Union County
(NJ) Prosecutor's
Office

ZZ00003
Suspected child
porn

Illinois State Police

ZZ00004
Identified Child
Porn

SA Brad Kropp,
AFOSI, Det 307

ZZ00000,
suspected child
porn

NDIC

Installing KFF

Contact Information

Case/Source

(908) 527-4508

case 2000S-0102

(609) 754-3354

Case # 00307D7S934831

KFF Reference

| 442

A Sample of HashKeeper KFF Contributions (Continued)
Hash

Contributor

ZZ00005
Suspected Child
Porn

Rene Moes,
Luxembourg Police

ZZ00006
Suspected Child
Porn

Illinois State Police

Location

Contact Information

Case/Source

rene.moes@police.eta
t.lu

ZZ00007b
Suspected KP
(US Federal)
ZZ00007a
Suspected KP
Movies
ZZ00007c
Suspected KP
(Alabama 13A-12192)
ZZ00008
Suspected Child
Pornography or
Erotica

Sergeant Purcell

Seminole County
Sheriff's Office
(Orlando, FL,
USA)

(407) 665-6948,
dpurcell@seminoleshe
riff.org

suspected child
pornogrpahy from
20010000850

ZZ00009 Known
Child
Pornography

Sergeant Purcell

Seminole County
Sheriff's Office
(Orlando, FL,
USA)

(407) 665-6948,
dpurcell@seminoleshe
riff.org

200100004750

ZZ10 Known Child
Porn

Detective Richard
Voce CFCE

Tacoma Police
Department

(253)594-7906,
rvoce@ci.tacoma.wa.u
s

ZZ00011
Identified CP
images

Detective Michael
Forsyth

Baltimore County
Police
Department

(410)887-1866,
mick410@hotmail.com

ZZ00012
Suspected CP
images

Sergeant Purcell

Seminole County
Sheriff's Office
(Orlando, FL,
USA)

(407) 665-6948,
dpurcell@seminoleshe
riff.org

ZZ0013 Identified
CP images

Det. J. Hohl

Yuma Police
Department

928-373-4694

ZZ14W

Sgt Stephen May
Tamara.Chandler@oa
g.state.tx.us,
(512)936-2898

ZZ14U

Sgt Chris Walling
Tamara.Chandler@oa
g.state.tx.us,
(512)936-2898

ZZ14X

Sgt Jeff Eckert

YPD02-70707
TXOAG
41929134

TXOAG
41919887

TXOAG Internal
Tamara.Chandler@oa
g.state.tx.us,
(512)936-2898

Installing KFF

KFF Reference

| 443

A Sample of HashKeeper KFF Contributions (Continued)
Hash

Contributor

ZZ14I

Sgt Stephen May

Location

Contact Information

Tamara.Chandler@oa
g.state.tx.us,
(512)936-2898
ZZ14B

Robert Britt, SA,
FBI

ZZ14S

Tamara.Chandler@oa
g.state.tx.us,
(512)936-2898

Sgt Stephen May
Tamara.Chandler@oa
g.state.tx.us,
(512)936-2898

ZZ14Q

Sgt Cody Smirl
Tamara.Chandler@oa
g.state.tx.us,
(512)936-2898

ZZ14V

Sgt Karen McKay
Tamara.Chandler@oa
g.state.tx.us,
(512)936-2898

ZZ00015 Known
CP Images

Det. J. Hohl

ZZ00016

Marion County
Sheriff's
Department

Yuma Police
Department

Case/Source
TXOAG
041908476

TXOAG
031870678

TXOAG
041962689

TXOAG
041952839

TXOAG
41924143

928-373-4694

YPD04-38144

(317) 231-8506

MP04-0216808

The basic rule is to always consider the source when using KFF in your investigations. You should consider the
origin of the hash set to which the hit belongs. In addition, you should consider the underlying nature of hash
values in order to evaluate a hit’s authenticity.

Higher Level KFF Structure and Usage
Since hash set groups have the properties just described (and because custom hash sets and groups can be
defined by the investigator) the KFF mechanism can be leveraged in creative ways. For example:
You

could define a group of hash sets created from encryption software and another group of hash sets
created from child pornography files. Then, you would apply only those groups while processing.

You

could also use the Ignore status. You are about to process a hard drive image, but your search
warrant does not allow inspection of certain files within the image that have been previously identified.
You could do the following and still observe the warrant:
3a.

Open the image in Imager, navigate to each of the prohibited files, and cause an MD5 hash value
to be computed for each.

3b.

Import these hash values into custom hash sets (one or more), add those sets to a custom group,
and give the group Ignore status.

3c.

Process the image with the MD5 and KFF options, and with AD_Alert, AD_Ignore, and the new,
custom group selected.

Installing KFF

KFF Reference

| 444

3d.

During post-processing analysis, filter file lists to eliminate rows representing files with Ignore
status.

Hash Set Categories
The highest level of the KFF’s logical structure is the categorizing of hash sets by owner and scope. The
categories are AccessData, Project Specific, and Shared.

Hash Set Categories
Category

Description

AccessData

The sets shipped with as the Library. Custom groups can be created from these sets, but
the sets and their status values are read only.

Project
Specific

Sets and groups created by the investigator to be applied only within an individual project.

Shared

Sets and groups created by the investigator for use within multiple projects all stored in the
same database, and within the same application schema.

Important: Coordination among other investigators is essential when altering Shared groups in a lab
deployment. Each investigator must consider how other investigators will be affected when Shared
groups are modified.

Installing KFF

KFF Reference

| 445

Chapter 35

Working with Windows Registry Evidence

This appendix contains information about the Windows Registry and what information can be gathered from it for
evidence. It includes the following topics:
Understanding
Windows

the Windows Registry (page 446)

XP Registry Quick Find Chart (page 451)

Understanding the Windows Registry
For forensic work, registry files are particularly useful because they can contain important information such as
the following:
Usernames

and passwords for programs, email, and sites

A

history of sites accessed, including dates and times

A

record of queries (i.e., searches performed on search engines like Google, Yahoo, etc.)

Lists
A

of recently accessed files (e.g., documents, images, etc.)

list of all programs installed on the system

AccessData Registry Viewer allows you to view the contents of Windows operating system registries. Unlike the
standard Windows Registry Editor, which only displays the current system’s registry, Registry Viewer lets you
examine registry files from any Windows system or user. Registry Viewer also provides access to a registry’s
protected storage, which contains passwords, usernames, and other information not accessible from within
Windows Registry Editor.
The files that make up the registry differ depending on the version of Windows. The tables below list the registry
files for each version of Windows, along with their locations and the information they contain.

Working with Windows Registry Evidence

Understanding the Windows Registry

| 446

Windows 9x Registry Files
The following table describes each item on the Windows 9x registry files.

Windows 9x Registry Files
Filename

Location

system.dat

\Windows

Contents





user.dat

\Windows



If there are multiple user
accounts on the system,
each user has a user.dat file
located in
\Windows\profiles\user
account



Protected storage for all users on the system. Protected Storage is an
access-restricted area of the registry that stores confidential user information including usernames and passwords for web sites, email passwords for Microsoft Outlook or Outlook Express, and a record of
queries (i.e., searches performed on search engines like Google, Yahoo,
etc.), including the time and date when they were performed.
Lists installed programs, their settings, and any usernames and passwords associated with them.
Contains the System settings.

MRU (Most Recently Used) list of files. MRU Lists maintain
a list of files so users can quickly re-access files. Registry
Viewer allows you to examine these lists to see what files
have been recently used and where they are located. Registry Viewer lists each program’s MRU files in order from most
recently accessed to least recently accessed.
User preference settings (desktop configuration, etc.).

Windows NT and Windows 2000 Registry Files
The following table describes each item in the Windows NT and Windows 2000 registry files.

Windows NT and Windows 2000 Registry Files
Filename

Location

NTUSER.DAT

\Documents and
Settings\[user account]

Contents


If there are multiple user
accounts on the system,
each user has an ntuser.dat
file.



Protected storage for all users on the system. Protected Storage is an
access-restricted area of the registry that stores confidential user information including usernames and passwords for web sites, email passwords for Microsoft Outlook or Outlook Express, and a record of
queries (i.e., searches performed on search engines like Google, Yahoo,
etc.), including the time and date when they were performed.
All installed programs, their settings, and any usernames and passwords
associated with them.
User preference settings (desktop configuration, etc.).

default

\Winnt\system32\config

System settings.

SAM

\Winnt\system32\config

User account management and security settings.

SECURITY

\Winnt\system32\config

Security settings.

software

\Winnt\system32\config

All installed programs, their settings, and any usernames and
passwords associated with them.

system

\Winnt\system32\config

System settings.

Working with Windows Registry Evidence

Understanding the Windows Registry

| 447

Windows XP Registry Files
The following table describes each item in the Windows XP registry files.

Windows XP Registry Files
Filename

Location

Contents

NTUSER.DAT

\Documents and
Settings\[user account]



If there are multiple user
accounts on the system,
each user has an ntuser.dat
file.



Protected storage for all users on the system. Protected Storage is an
access-restricted area of the registry that stores confidential user information including usernames and passwords for web sites, email passwords for Microsoft Outlook or Outlook Express, and a record of
queries (i.e., searches performed on search engines like Google, Yahoo,
etc.), including the time and date when they were performed.
All installed programs, their settings, and any usernames and passwords
associated with them.
User preference settings (desktop configuration, etc.)

default

\Winnt\system32\config

System settings.

SAM

\Winnt\system32\config

User account management and security settings.

SECURITY

\Winnt\system32\config

Security settings.

software

\Winnt\system32\config

All installed programs, their settings, and any usernames and
passwords associated with them.

system

\Winnt\system32\config

System settings.

The logical registry is organized into the following tree structure:
The top level of the tree is divided into hives. A hive is a discrete body of keys, subkeys, and values that is rooted
at the top of the registry hierarchy. On Windows XP systems, the registry hives are as follows:
HKEY_CLASSES_ROOT

(HKCR)

HKEY_CURRENT_USER

(HKCU)

HKEY_LOCAL_MACHINE
HKEY_USERS

(HKLM)

(HKU)

HKEY_CURRENT_CONFIG
HKEY_DYN_DATA

(HKCC)

(HKDD)

HKEY_LOCAL_MACHINE and HKEY_USERS are the root hives. They contain information that is used to
create the HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, and HKEY_CURRENT_CONFIG hives.

HKEY_LOCAL_MACHINE is generated at startup from the system.dat file and contains all the configuration
information for the local machine. For example, it might have one configuration if the computer is docked, and
another if the computer is not docked. Based on the computer state at startup, the information in
HKEY_LOCAL_MACHINE is used to generate HKEY_CURRENT_CONFIG and HKEY_CLASSES_ROOT.
HKEY_USERS is generated at startup from the system User.dat files and contains information for every user on
the system.
Based on who logs in to the system, the information in HKEY_USERS is used to generate

HKEY_CURRENT_USER, HKEY_CURRENT_CONFIG, and HKEY_CLASSES_ROOT.
Keys and sub-keys are used to divide the registry tree into logical units off the root.

Working with Windows Registry Evidence

Understanding the Windows Registry

| 448

When you select a key, Registry Editor displays the key’s values; that is, the information associated with that
key. Each value has a name and a data type, followed by a representation of the value’s data. The data type tells
you what kind of data the value contains as well as how it is represented. For example, values of the

REG_BINARY type contain raw binary data and are displayed in hexadecimal format.

Possible Data Types
The following table lists the Registry’s possible data types.

Registry Data Types
Data Type

Name

Description

REG_BINARY

Binary Value

Raw binary data. Most hardware component information is stored as
binary data and is displayed in hexadecimal format.

REG_DWORD

DWORD Value

Data represented by a number that is 4 bytes long (a 32-bit integer).
Many parameters for device drivers and services are this type and are
displayed in binary, hexadecimal, or decimal format. Related values are
REG_DWORD_LITTLE_ENDIAN (least significant byte is at the lowest
address) and REG_DWORD_BIG_ENDIAN (least significant byte is at the
highest address).

REG_EXPAND_SZ

Expandable
String Value

A variable-length data string. This data type includes variables that are
resolved when a program or service uses the data.

REG_MULTI_SZ

Multi-String
Value

A multiple string. Values that contain lists or multiple values in a format
that people can read are usually this type. Entries are separated by
spaces, commas, or other marks.

REG_SZ

String Value

A text string of any length.

REG_RESOURCE_LI Binary Value
ST

A series of nested arrays designed to store a resource list used by a
hardware device driver or one of the physical devices it controls. This
data is detected by the system and is displayed in hexadecimal format
as a Binary Value.

REG_RESOURCE_
Binary Value
REQUIREMENTS_LIS
T

A series of nested arrays designed to store a device driver’s list of
possible hardware resources that it, or one of the physical devices it
controls, can use. This data is detected by the system and is displayed
in hexadecimal format as a Binary Value.

REG_FULL_RESOUR Binary Value
CE_
DESCRIPTOR

A series of nested arrays deigned to store a resource list used by a
physical hardware device. This data is displayed in hexadecimal format
as a Binary Value.

REG_NONE

None

Data with no particular type. This data is written to the registry by the
system or applications and is displayed in hexadecimal format as a
Binary Value.

REG_LINK

Link

A Unicode string naming a symbolic link.

REG_QWORD

QWORD Value

Data represented by a number that is a 64-bit integer.

Additional Considerations
If there are multiple users on a single machine, you must be aware of the following issues when conducting a
forensic investigation:
there are individual profiles for each user on the system, you need to locate the USER.DAT file for the
suspects.

If

Working with Windows Registry Evidence

Understanding the Windows Registry

| 449

If

all the users on the system are using the same profile, everyone’s information is stored in the same
USER.DAT file. Therefore, you will have to find other corroborating evidence because you cannot
associate evidence in the USER.DAT file with a specific user profile.
Windows 9x systems, the USER.DAT file for the default user is used to create the USER.DAT files for
new user profiles. Consequently, the USER.DAT files for new profiles can inherit a lot of junk.

On

To access the Windows registry from an image of the suspect’s drive, you can do any of the following:
Load

the suspect’s drive image and export his or her registry files to view them in Registry Editor.

Mount

a restored image as a drive, launch Registry Editor at the command line from your processing
machine, export the registry files from the restored image, then view them in a third-party tool.
Note: The problem with this method is that you can only view the registry as text. Registry Editor

displays everything in ASCII so you can’t see hex or binary values in the registry.
Use

Registry Viewer. Registry Viewer integrates seamlessly with the Examiner to display registry files
within the image and create reports.

Important: Registry Viewer shows everything you normally see in live systems using the Windows Registry
Editor. However, unlike Registry Editor and other tools that use the Windows API, Registry Viewer
decrypts protected storage information so it displays values in the Protected Storage System Provider
key (PSSP). Registry Viewer also shows information that is normally hidden in null-terminated keys.

Seizing Windows Systems
Information stored in the registry— Messenger sessions, Microsoft Office MRU lists, usernames and passwords
for internet Web sites accessed through Internet Explorer, and so forth—are temporarily stored in

HKEY_CURRENT_USER. When the user closes an application or logs out, the hive’s cached information is
pulled out of memory and written to the user’s corresponding USER.DAT.
Note: Passwords and MRU lists are not saved unless these options are enabled.
Important: Because normal seizure procedures require that there be no alteration of the suspect’s computer in
any way, you must be able to articulate why you closed any active applications before pulling the plug
on the suspect’s computer. Sometimes it is better to simply pull the plug on the computer; other times,
it makes more sense to image the computer in place while it is on. It may depend on what is the most
important type of data expected to be found on the computer.
For example, Windows updates some program information in the registry when the changes are
made. Other information is not updated until a program is closed. Also, if the computer’s drive is
encrypted and you cannot decrypt it or don’t have the Key or password, you may have no choice
except to image the live drive.
The Registry Quick Find Chart shown below gives more information.

Working with Windows Registry Evidence

Understanding the Windows Registry

| 450

Windows XP Registry Quick Find Chart
The following charts describe common locations where you can find data of forensic interest in the Windows
Registry.

System Information
Windows XP Registry System Information
Information

File or Key

Location

Description

Registered Owner

Software

Microsoft\Windows NT\
CurrentVersion

This information is entered during
installation, but can be modified later.

Registered
Organization

Software

Microsoft\Windows NT\
CurrentVersion

This information is entered during
installation, but can be modified later.

Run

Software

Microsoft\Windows\Current
Version\Run

Programs that appear in this key run
automatically when the system boots.

Logon Banner
Message

Software

Microsoft\Windows\Current
Version\Policies\System\Legal
NoticeText

This is a banner that users must click
through to log on to a system.

Mounted Devices

System

MountedDevices

Database of current and prior mounted
devices that received a drive letter.

Current Control Set System

Select

Identifies which control set is current.

Shutdown Time

System

ControlSetXXX\Control\Windows System shutdown time.

Event Logs

System

ControlSetXXX\Services\Eventlo Location of Event logs.
g

Dynamic Disk

System

ControlSetXXX\Services\DMIO\
Boot Info\Primary Disk Group

Identifies the most recent dynamic disk
mounted in the system.

Pagefile

System

ControlSetXXX\Control\
Session Manager\Memory
Management

Location, size, set to wipe, etc.

Last User Logged In Software

Microsoft\Windows NT\
CurrentVersion\Winlogon

Last user logged in - can be a local or
domain account.

Product ID

Software

Microsoft\Windows NT\
CurrentVersion

O\S Version

Software

Microsoft\Windows NT\
CurrentVersion

Logon Banner Title

Software

Microsoft\Windows\Current
Version\Policies\System\Legal
NoticeCaption

User-defined data.

Logon Banner
Message

Software

Microsoft\Windows\Current
Version\Policies\System\Legal
NoticeCaption

User-defined data.

Time Zone

System

ControlSet001(or002)\Control\
TimeZoneInformation\Standard
Name

This information is entered during
installation, but can be modified later.

Working with Windows Registry Evidence

Windows XP Registry Quick Find Chart

| 451

Networking
Windows XP Registry Networking Information
Information

File or Key

Location

Description

Map Network Drive
MRU

NTUSER.DA
T

Software\Microsoft\Windows\
CurrentVersion\Explorer\Map
Network Drive MRU

Most recently used list of mapped
network drives.

TCP\IP data

System

ControlSetXXX\Services\
TCPIP\Parameters

Domain, hostname data.

TCP\IP Settings of a
Network Adapter

System

ControlSetXXX\Services\
adapter\Parameters\TCPIP

IP address, gateway information.

Default
Printer

NTUSER.DA
T

Software\Microsoft\Windows
NT\CurrentVersion\Windows

Current default printer.

Default
Printer

NTUSER.DA
T

\printers

Current default printer.

Local Users

SAM

Domains\Account\Users\
Names

Local account security identifiers.

Local Groups

SAM

Domains\Builtin\Aliases\
Names

Local account security identifiers.

Profile list

Software

Microsoft\Windows NT\
CurrentVersion\ProfileList

Contains user security identifiers (only
users with profile on the system).

Network Map

NTUSER.DA
T

Documents and
Settings\username

Browser history and last-viewed lists
attributed to the user.

User Data
Windows XP Registry User Data
Information

File or Key

Location

Description

Run

NTUSER.DAT

Software\Microsoft\Windows\
CurrentVersion\Run

Programs that appear in this key run
automatically when the user logs on.

Media Player
Recent List

NTUSER.DAT

Software\Microsoft\Media
Player\Player\ RecentFileList

This key contains the user's most
recently used list for Windows Media
Player.

O\S Recent
Docs

NTUSER.DAT

Software\Microsoft\Windows\
CurrentVersion\Explorer\
RecentDocs

MRU list pointing to shortcuts located in
the recent directory.

Run MRU

NTUSER.DAT

\Software\Microsoft\Windows\
MRU list of commands entered in the
CurrentVersion\Explorer\RunMR “run” box.
U

Open And Save As NTUSER.DAT
Dialog
Boxes MRU

\Software\Microsoft\Windows\
CurrentVersion\Explorer\
ComDlg32

MRU lists of programs\files opened with
or saved with the “open” or “save as”
dialog boxes.

Current Theme

NTUSER.DAT

Software\Microsoft\Windows\
CurrentVersion\Themes

Desktop theme\wallpaper.

Last Theme

NTUSER.DAT

Software\Microsoft\Windows\
CurrentVersion\Themes\Last
Theme

Desktop theme\wallpaper.

Working with Windows Registry Evidence

Windows XP Registry Quick Find Chart

| 452

Windows XP Registry User Data (Continued)
Information

File or Key

Location

Description

File Extensions\
Program
Association

NTUSER.DAT

Software\Microsoft\Windows\
CurrentVersion\Explorer\
FileExts

Identifies associated programs with file
extensions.

User Application Data
Windows XP Registry User Application Data
Information

File or Key

Location

Description

NTUSER.DAT

Software\Microsoft\office\
version\Common\UserInfo

This information is entered during
installation, but can be modified later.
Microsoft word recent documents.

NTUSER.DAT

Software\Microsoft\office\
version\Common\Data

Data entered into the URL address bar.

NTUSER.DAT

Software\Microsoft\
Explorer\TypedURLs

NTUSER.DAT

\Software\Microsoft\
Explorer\IntelliForms

Web page auto complete passwordencrypted values.

NTUSER.DAT

\Software\Microsoft\Protected
Storage System Provider

Lists Web pages where auto complete
was used.

Word User Info
Word Recent Docs
IE Typed URLs
IE Auto- Complete
Passwords
IE Auto-Complete
Web Addresses

Default download directory when
utilizing Internet Explorer.

IE Default
Download Directory NTUSER.DAT

Software\Microsoft\ Explorer

Outlook Temporary
Attachment
Directory

NTUSER.DAT

Software\Microsoft\office\
version\Outlook\Security

NTUSER.DAT

Software\America Online\AOL
etc.
Instant Messenger\
CurrentVersion\Users\username

NTUSER.DAT

Software\Microsoft\office\
version\Common\UserInfo

NTUSER.DAT

\Software\Mirabilis\ICQ\*

NTUSER.DAT

Software\Microsoft\MSN
Messenger\ListCache\.NET
MessngerService\*

NTUSER.DAT

Software\Kazaa\*

NTUSER.DAT

Software\Yahoo\Pager\ Profiles\* etc.

NTUSER.DAT

Software\Google\NavClient\
1.1\History

NTUSER.DAT

Software\Adobe\*

AIM

IM contacts, file transfer information,

Word User Info
ICQ
MSN Messenger

Kazaa
Yahoo
Google Client
History
Adobe

Location where attachments are stored
when opened from Outlook.

Working with Windows Registry Evidence

This information is entered during
installation, but can be modified later.
IM contacts, file transfer information,
etc.
IM contacts, file transfer information,
etc.
Configuration, search, download, IM
data, etc.
IM contacts, file transfer information,

Acrobat, Photo deluxe, etc.

Windows XP Registry Quick Find Chart

| 453

Chapter 36

Supported File Systems and Drive Image
Formats

This appendix lists the file systems and image formats that are analyzed. It includes the following topics:
File

Systems (page 454)

Whole
Hard
CD

Disk Encrypted Products (page 455)

Disk Image Formats (page 455)

and DVD Image Formats (page 456)

File Systems
The following table lists AccessData identified and analyzed file systems.

Identified and Analyzed File Systems


FAT 12, FAT 16, FAT 32



NTFS



Ext2FS



HFS, HFS+



Ext3FS



CDFS



Ext4FS



exFAT



ReiserFS 3



Windows 8 and Server 2012 ReFS



VxFS (Veritas File System)



Supported File Systems and Drive Image Formats

File Systems

| 454

Whole Disk Encrypted Products
The following table lists identified and analyzed Whole Disk Encryption (WDE) decryption products (these all
require the investigator to enter the password, AccessData forensic products don’t “crack” these).

Recognized and Analyzed Whole Disk Encryption Formats


AFF (Advanced Forensic Format)



Utimaco Safeguard Easy



PGP®



Utimaco SafeGuard Enterprise



Credant



Guardian Edge



SafeBoot



EFS



JFS



LVM



VMWare



LVM2



UFS1



UFS2

Hard Disk Image Formats
The following table lists identified and analyzed hard disk image formats.

Supported Hard Disk Image Formats


Encase, including ‘incomplete’ Tableaucreated files



SnapBack



Safeback 2.0 and under



Expert Witness



Linux DD



ICS



Ghost (forensic images only)



SMART



AccessData Logical Image (AD1)



MSVHD (MS Virtual Hard Disk)



DMG (Mac)



Lx0, Lx01

Supported File Systems and Drive Image Formats

Whole Disk Encrypted Products

| 455

CD and DVD Image Formats
The following table lists identified and analyzed CD and DVD image formats.

Identified and Analyzed CD and DVD File Systems and Formats


Alcohol (*.mds)



IsoBuster CUE



PlexTools (*.pxi)



CloneCD (*.ccd)



Nero (*.nrg)



Roxio (*.cif)



ISO



Pinnacle (*.pdi)



Virtual CD (*.vc4)



CD-RW,



VCD



CD-ROM



DVD+MRW



DVCD



DVD-RW



DVD-VFR



DVD+RW Dual Layer



DVD-VR



BD-R SRM-POW



BD-R



BD-R SRM



BD-R DL



HD DVD-R



HD DVD-RW DL



SVCD



HD DVD



HD DVD-RW



DVD-RAM,



CD-ROM XA



CD-MRW,



DVD+VR



DVD+R



DVD+R Dual Layer



BD-RE



DVD-VRW



BD-ROM



HD DVD-R DL



BD-R RRM



BDAV



Virtual CD (*.vc4)



HD DVD-RAM



DVD+RW



CD-R



VD-R



SACD



DVD-R Dual Layer



DVD-ROM



BD-R SRM+POW



DVD-VM



BD-RE DL



DVD+VRW



Supported File Systems and Drive Image Formats

CD and DVD Image Formats

| 456

Chapter 37

Recovering Deleted Material

You can find deleted files on supported file systems by their file header.
This appendix includes the following topics:
FAT

12, 16, and 32 (page 457)

NTFS

(page 458)

Ext2

(page 458)

Ext3

(page 458)

HFS

(page 458)

FAT 12, 16, and 32
When parsing FAT directories, deleted files are identified by their names. In a deleted file, the first character of
the 8.3 filename is replaced by the hex character 0xE5.
The file’s directory entry provides the file’s starting cluster (C) and size. From the size of the file and the starting
cluster, the total number of clusters (N) occupied by the file are computed.
The File Allocation Table (FAT) is examined and the number of unallocated clusters are counted, starting at C
(U). The recovered file [min (N, U)] clusters starting at C are then assigned.
If the deleted file was fragmented, the recovered file is likely to be incorrect and incomplete because the
information that is needed to find subsequent fragments was wiped from the FAT system when the file was
deleted.
If present, the long filename (LFN) entries are used to recover the first letter of the deleted file’s short filename. If
the LFN entries are incomplete or absent, it uses an exclamation mark (“!”) as the first letter of the filename.
The volume free space for deleted directories that have been orphaned are searched with a meta-carve process.
An orphaned directory is a directory whose parent directory or whose entry in its parent directory has been
overwritten.

Recovering Deleted Material

FAT 12, 16, and 32

| 457

NTFS
The Master File Table (MFT) is examined to find files that are marked deleted because the allocation byte in a
record header indicates a deleted file or folder. It then recovers the file’s data using the MFT record’s data
attribute extent list if the data is non-resident.
If the deleted file’s parent directory exists, the recovered file is shown in the directory where it originally existed.
Deleted files whose parent directories were deleted are shown in their proper place as long as their parent
directory’s MFT entry has not been recycled.

Ext2
Nodes that are marked deleted are searched for. The link count is zero and the deletion timestamp is nonzero.
For each deleted inode, the block pointers are processed and blocks are added to the deleted file. However, if an
indirect block is marked allocated or references an invalid block number, the recovered file is truncated at that
point because the block no longer contains a list of blocks for the file that the application is attempting to recover.
The filenames for files deleted on ext2 systems are not recovered. Instead, deleted files are identified by inode
number because ext2 uses variable-length directory entries organized in a linked list structure. When a file is
deleted, its directory entry is unlinked from the list, and the space it occupied becomes free to be partially or
completely overwritten by new directory entries. There is no reliable way to identify and extract completely
deleted directory entries.

Ext3
Deleted files from ext3 volumes are not recovered because ext3 zeroes out a file’s indirect block pointers when it
is deleted.

HFS
Deleted files from HFS are not recovered.

Recovering Deleted Material

NTFS

| 458

Chapter 38

Managing Security Devices and Licenses

This appendix includes infrormation about AccessData product licenses, Virtual CodeMeter activation, and
Network License Server configurations.

Installing and Managing Security Devices
You must install the security device software and drivers before you can manage licenses with LicenseManager.
This section explains installing and using the Wibu CodeMeter Runtime software and USB CmStick, as well as
the Keylok USB dongle drivers and dongle device.

Installing the Security Device
AccessData products require a licensing security device that communicates with the program to verify the
existence of a current license. The device can be a Keylok dongle, or a WIBU-SYSTEMS (Wibu) CodeMeter
(CmStick). Both are USB devices, and both require specific software to be installed prior to connecting the
devices and running your AccessData products. You will need:
The

WIBU-SYSTEMS CodeMeter Runtime software with a WIBU-SYSTEMS CodeMeter (CmStick),
either the physical USB device, or the Virtual device.

The

WIBU-SYSTEMS CodeMeter Runtime software, and the AccessData Dongle Drivers with a Keylok
dongle

Note: Without a license security device and its related software, you can run PRTK or DNA in Demo mode only.
Store the CmStick or dongle in a secure location when it is not in use.
You can install your AccessData product and the CodeMeter software from the shipping CD or from
downloadable files available on the AccessData website at www.accessdata.com.
Click Support > Downloads, and browse to the product to download. Click the download link and save the file
locally before you run the installation files.

Installing the CodeMeter Runtime Software
When you purchase a product, AccessData provides a USB CmStick with the product package. The green
Keylok dongles are no longer provided, but can be purchased separately through your AccessData Sales
Representative.

Managing Security Devices and Licenses

Installing and Managing Security Devices

| 459

To use the CmStick, you must first install the CodeMeter Runtime software, either from the shipping CD, or from
the setup file downloaded from the AccessData Web site.

Locating the Setup File
To install the CodeMeter Runtime software from the CD, you can browse to the setup file, or select it from the
Autorun menu.
If you product includes an installation ISO or disc, the setup file is on the setup disk.

To download the CodeMeter Runtime software
1.

Go to www.accessdata.com and do the following:

Click Support > Downloads.

Find one of the following, according to your system:
CodeMeter

Runtime 4.20b (32 bit)
MD5: 2e658fd67dff9da589430920624099b3
(MD5 hash applies only to this version)

CodeMeter

Runtime 4.20b (64 bit)
MD5: b54031002a1ac18ada3cb91de7c2ee84
(MD5 hash applies only to this version)

Click the Download link.

Save the file to your PC and run after the download is complete.

When the download is complete, double-click on the downloaded file.

To run the CodeMeter Runtime Setup
1.

Double-click the CodeMeterRuntime[32 or 64]_4.20bEXE.

In the Welcome dialog, click Next.

Read and accept the License Agreement

Enter User Information.

uses this computer.

Click Next.

Select the features you want to install.

Click Disk Cost to see how much space the installation of CodeMeter software takes, and drive space
available. This helps you determine the destination drive.

Click OK.

10. Click Next.
11. When you are satisfied with the options you have selected, click Next.
12. Installation will run its course. When complete, you will see the “CodeMeter Runtime Kit v4.20b has

been successfully installed” screen. Click Finish to exit the installation.
Install the WIBU-SYSTEMS CodeMeter Runtime software for the USB CodeMeter (CmStick). The WIBUSYSTEMS CodeMeter Runtime 4.20a is required if you are running with a Virtual CmStick. Click Install
CodeMeter Software to launch the CodeMeter installation wizard. Follow the directions for installation,
accepting all defaults, and click Finish to complete the installation.
If the user attempts to run FTK before installing the correct CodeMeter Runtime software and the WIBUSYSTEMS CmStick, a message similar to the following will appear.

Managing Security Devices and Licenses

Installing and Managing Security Devices

| 460

CodeMeter Error
If you are not using NLS for your security device configuration, after clicking No, you will see the following
additional message.
Security Device Not Found
To remedy, click OK, then install the correct CodeMeter Runtime software, and connect the CmStick or run
License Manager to generate your Virtual CmStick. Then, restart FTK.

The CodeMeter Control Center
When the CodeMeter Runtime installation is complete, the CodeMeter Control Center pops up. This is a great
time to connect the CmStick and verify that the device is recognized and is Enabled. Once verified, you can
close the control center and run your AccessData products.
For the most part there is nothing you need to do with this control center, and you need make no changes using
this tool with very few exceptions. If you have problems with your CmStick, contact AccessData Support and an
agent will walk you through any troubleshooting steps that may need to be performed.

Installing Keylok Dongle Drivers
To install the Keylok USB dongle drivers
1.

Choose one of the following methods:
If

installing from CD, insert the CD into the CD-ROM drive and click Install the Dongle Drivers.
If auto-run is not enabled, select Start > Run. Browse to the CD-ROM drive and select
Autorun.EXE.

If

installing from a file downloaded from the AccessData Web site, locate the
Dongle_driver_1.6.EXE setup file, and double-click it.

Click Next.

Select the type of dongle to install the drivers for.

Click Next.

If you have a USB dongle, verify that it is not connected.

Click OK.
A message box appears telling you that the installation is progressing.

When you see the Dongle Driver Setup window that says, “Finished Dongle Installation,” click Finish.

Connect the USB dongle. Wait for the Windows Found New Hardware wizard, and follow the prompts.

Important: If the Windows Found New Hardware wizard appears, complete the wizard. Do not close without
completing, or the dongle driver will not be installed.

Windows Found New Hardware Wizard
When you connect the dongle after installing the dongle drivers, you should wait for the Windows Found New
Hardware Wizard to open. It is not uncommon for users to disregard this wizard, and then find that the dongle is
not recognized and their AccessData software will not run.

Managing Security Devices and Licenses

Installing and Managing Security Devices

| 461

To configure the dongle using the Found New Hardware Wizard
1.

When prompted whether to connect to Windows Update to search for software, choose, “No, not this
time.”

Click Next.

When prompted whether to install the software automatically or to install from a list of specific locations,
choose, “Install the software automatically (Recommended).”

Click Next.

Click Finish to close the wizard.

Once you have installed the dongle drivers and connected the dongle and verified that Windows recognizes it,
you can use LicenseManager to manage product licenses.

Managing Security Devices and Licenses

Installing and Managing Security Devices

| 462

Installing LicenseManager
LicenseManager lets you manage product and license subscriptions using a security device or device packet
file.

To download the LicenseManager installer from the AccessData web site
1.

Go to the AccessData download page at:
http://www.accessdata.com/downloads.htm.

On the download page, click the LicenseManager Download link.

Save the installation file to your download directory or other temporary directory on your drive.

To install LicenseManager
1.

Navigate to, and double-click the installation file.

Wait for the Preparing to Install processes to complete.

Click Next on the Welcome screen

Read and accept the License Agreement.

Click Next.

Accept the default destination folder, or select a different one.

Click Next.

In the Ready to Install the Program dialog, click Back to review or change any of the installation
settings. When you are ready to continue, click Install.

Wait while the installation completes.

10. If you want to launch LicenseManager after completing the installation, mark the

Launch AccessData LicenseManager check box.
11. Select the Launch AccessData LicenseManager check box to run the program upon finishing the

setup. The next section describes how to run LicenseManager later.
12. Click Finish to finalize the installation and close the wizard.

Starting LicenseManager
To launch LicenseManager
1.

Launch LicenseManager in any of the following ways:

LicenseManager.EXE from C:\Program Files\AccessData\Common
Files\AccessData LicenseManager\.

Execute

Click

Start > All Programs > AccessData > LicenseManager > LicenseManager.

Click

or double-click (depending on your Windows settings) the LicenseManager icon on your
desktop.

From

some AccessData programs, you can run LicenseManager from the Tools > Other
Applications menu. This option is not available in PRTK or DNA.

When starting, LicenseManager reads licensing and subscription information from the installed and connected
WIBU-SYSTEMS CodeMeter Stick, or Keylok dongle.

If using a Keylok dongle, and LicenseManager either does not open or displays the
message, “Device Not Found”
1.

Make sure the correct dongle driver is installed on your computer.

Managing Security Devices and Licenses

Installing LicenseManager

| 463

With the dongle connected, check in Windows Device Manager to make sure the device is recognized.
If it has an error indicator, right click on the device and choose Uninstall.

Remove the dongle after the device has been uninstalled.

Reboot your computer.

After the reboot is complete, and all startup processes have finished running, connect the dongle.

Wait for Windows to run the Add New Hardware wizard. If you already have the right dongle drivers
installed, do not browse the internet, choose, “No, not this time.”

Click Next to continue.

On the next options screen, choose, “Install the software automatically (Recommended)

Click Next to continue.

10. When the installation of the dongle device is complete, click Finish to close the wizard.
11. You still need the CodeMeter software installed, but will not need a CodeMeter Stick to run

LicenseManager.

If using a CodeMeter Stick, and LicenseManager either does not open or displays the
message, “Device Not Found”
1.

Make sure the CodeMeter Runtime 4.20b software is installed. It is available at www.accessdata.com/
support. Click Downloads and browse to the product. Click on the download link. You can Run the
product from the Website, or Save the file locally and run it from your PC. Once the CodeMeter Runtime
software is installed and running, you will see a gray icon in your system tray.

Make sure the CodeMeter Stick is connected to the USB port.

If the CodeMeter Stick is not connected, LicenseManager still lets you to manage licenses using a security
device packet file if you have exported and saved the file previously.

To open LicenseManager without a CodeMeter Stick installed
1.

Click Tools > LicenseManager.
LicenseManager displays the message, “Device not Found”.

Click OK, then browse for a security device packet file to open.

Note: Although you can run LicenseManager using a packet file, AccessData products will not run with a packet
file alone. You must have the CmStick or dongle connected to the computer to run AccessData products
that require a license.

Using LicenseManager
LicenseManager provides the tools necessary for managing AccessData product licenses on a WIBUSYSTEMS CodeMeter Stick security device, a Keylok dongle, a Virtual Dongle, or in a security device packet
file.
LicenseManager displays license information, allows you to add licenses to or remove existing licenses from a
dongle or CmStick. LicenseManager, and can also be used to export a security device packet file. Packet files
can be saved and reloaded into LicenseManager, or sent via email to AccessData support.
In addition, you can use LicenseManager to check for product updates and in some cases download the latest
product versions.
LicenseManager displays CodeMeter Stick information (including packet version and serial number) and
licensing information for all AccessData products. The Purchase Licenses button connects directly to the

Managing Security Devices and Licenses

Installing LicenseManager

| 464

AccessData website and allows you to browse the site for information about products you may wish to purchase.
Contact AccessData by phone to speak with a Sales Representative for answers to product questions, and to
purchase products and renew licenses and subscriptions.

The LicenseManager Interface
The LicenseManager interface consists of two tabs that organize the options in the LicenseManager window: the
Installed Components tab and the Licenses tab.

The Installed Components Tab
The Installed Components tab lists the AccessData programs installed on the machine. The Installed
Components tab is displayed in the following figure.
The following information is displayed on the Installed Components tab:

LicenseManager Installed Components Tab Features
Item

Description

Program

Lists all AccessData products installed on the host.

Installed Version

Displays the version of each AccessData product installed on the host.

Newest Version

Displays the latest version available of each AccessData product installed on the host.
Click Newest to refresh this list.

Product Notes

Displays notes and information about the product selected in the program list.

AccessData Link

Links to the AccessData product page where you can learn more about AccessData
products.

The following buttons provide additional functionality from the Installed Components tab:

LicenseManager Installed Components Buttons
Button

Function

Help

Opens the LicenseManager Help web page.

Install Newest

Installs the newest version of the programs checked in the product window, if that
program is available for download. You can also get the latest versions from our website
using your browser.

Newest

Updates the latest version information for your installed products.

About

Displays the About LicenseManager screen. Provides version, copyright, and trademark
information for LicenseManager.

Done

Closes LicenseManager.

Use the Installed Components tab to manage your AccessData products and stay up to date on new releases.

The Licenses Tab
The Licenses tab displays CodeMeter Stick information for the current security device packet file and licensing
information for AccessData products available to the owner of the CodeMeter Stick, as displayed in the following
figure.

Managing Security Devices and Licenses

Installing LicenseManager

| 465

The Licenses tab provides the following information:

LicenseManager Licenses Tab Features
Column

Description

Program

Shows the owned licenses for AccessData products.

Expiration Date

Shows the date on which your current license expires.

Status

Shows these status of that product’s license:
 None: the product license is not currently owned
 Days Left: displays when less than 31 days remain on the license.
 Never: the license is permanently owned. This generally applies to Hash Tables and
Portable Office Rainbow Tables.

Name

Shows the name of additional parameters or information a product requires for its license.

Value

Shows the values of additional parameters or information a product contained in or
required for its license.

Show Unlicensed

When checked, the License window displays all products, whether licensed or not.

The following license management actions can be performed using buttons found on the License tab:

License Management Options
Button

Function

Remove License

Removes a selected license from the Licenses window and from the CodeMeter Stick or
dongle. Opens the AccessData License Server web page to confirm success.

Refresh Device

Connects to the AccessData License Server. Downloads and overwrites the info on the
CodeMeter Stick or dongle with the latest information on the server.

Reload from Device Begins or restarts the service to read the licenses stored on the CodeMeter Stick or
dongle.
Release Device

Click to stop the program reading the dongle attached to your machine, much like
Windows’ Safely Remove Hardware feature. Click this button before removing a dongle.
This option is disabled for the CodeMeter Stick.

Open Packet File

Opens Windows Explorer, allowing you to navigate to a .PKT file containing your license
information.

Save to File

Opens Windows Explorer, allowing you to save a .PKT file containing your license
information. The default location is My Documents.

Finalize Removal

Finishes the removal of licenses in the unbound state. Licenses must be unbound from the
CmStick or dongle before this button takes effect.

View Registration
Info

Displays an HTML page with your CodeMeter Stick number and other license information.

Add Existing License Allows you to bind an existing unbound license to your CodeMeter Stick, through an
internet connection to the AccessData License Server.
Purchase License

Brings up the AccessData product page from which you can learn more about AccessData
products.

About

Displays the About LicenseManager screen. Provides version, copyright, and trademark
information for LicenseManager.

Done

Closes LicenseManager.

Managing Security Devices and Licenses

Installing LicenseManager

| 466

Opening and Saving Dongle Packet Files
You can open or save dongle packet files using LicenseManager. When started, LicenseManager attempts to
read licensing and subscription information from the dongle. If you do not have a dongle installed,
LicenseManager lets you browse to open a dongle packet file. You must have already created and saved a
dongle packet file to be able to browse to and open it.

To save a security device packet file
1.

Click the Licenses tab, then under License Packets, click Save to File.

Browse to the desired folder and accept the default name of the .PKT file; then click Save.
Note: In general, the best place to save the .PKT files is in the AccessData LicenseManager folder. The
default path is C:\Program Files\AccessData\Common Files\AccessData LicenseManager\.

To open a security device packet file
1.

Select the Licenses tab.

Under License Packets, click Open Packet File.

Browse for a dongle packet file to open. Select the file and click Open.

Adding and Removing Product Licenses
On a computer with an connection, LicenseManager lets you add available product licenses to, or remove them
from, a dongle.
To move a product license from one dongle to another dongle, first remove the product license from the first
dongle. You must release that dongle, and connect the second dongle before continuing. When the second
dongle is connected and recognized by Windows and LicenseManager, click on the Licenses tab to add the
product license to the second dongle.

Removing a License
To remove (unassociate, or unbind) a product license
1.

From the Licenses tab, mark the program license to remove.
This action activates the Remove License button below the Program list box.

Click Remove License to connect your machine to the AccessData License Server through the
internet.

When you are prompted to confirm the removal of the selected licenses from the device, click Yes to
continue, or No to cancel.

Several screens appear indicating the connection and activity on the License Server, and when the
license removal is complete, the following screen appears.

Click OK to close the message box.
Another internet browser screen appears from LicenseManager with a message that says, “The
removal of your licenses from Security Device was successful!” You may close this box at any time.

Managing Security Devices and Licenses

Installing LicenseManager

| 467

Adding a License
To add a new or released license
1.

From the Licenses tab, under Browser Options, click Add Existing License.
The AccessData LicenseManager Web page opens, listing the licenses currently bound to the
connected security device, and below that list, you will see the licenses that currently are not bound to
any security device. Mark the box in the Bind column for the product you wish to add to the connected
device, then click Submit.

An AccessData LicenseManager Web page will open, displaying the following message, “The
AccessData products that you selected has been bound to the record for Security Device nnnnnnn
within the Security Device Database.
“Please run LicenseManager’s “Refresh Device” feature in order to complete the process of binding
these product licenses to this Security Device.” You may close this window at any time.

Click Yes if LicenseManager prompts, “Were you able to associate a new product with this device?”

Click Refresh Device in the Licenses tab of LicenseManager. Click Yes when prompted.

You will see the newly added license in the License Options list.

Adding and Removing Product Licenses Remotely
While LicenseManager requires an connection to use some features, you can add or remove licenses from a
dongle packet file for a dongle that resides on a computer, such as a forensic lab computer, that does not have
an connection.
If you cannot connect to the , the easiest way to move licenses from one dongle to another is to physically move
the dongle to a computer with an connection, add or remove product licenses as necessary using
LicenseManager, and then physically move the dongle back to the original computer. However, if you cannot
move the dongle—due to organization policies or a need for forensic soundness—then transfer the packet files
and update files remotely.

Adding a License Remotely
To remotely add (associate or bind) a product license
1.

On the computer where the security device resides:
1a.

Run LicenseManager.

1b.

From the Licenses tab, click Reload from Device to read the dongle license information.

1c.

Click Save to File to save the dongle packet file to the local machine.

Copy the dongle packet file to a computer with an connection.

On the computer with an connection:
3a.

Remove any attached security device.

3b.

Launch LicenseManager. You will see a notification, “No security device found”.

3c.

Click OK.

3d.

An “Open” dialog box will display. Highlight the .PKT file, and click Open.

3e.

Click on the Licenses tab.

3f.

Click Add Existing License.

3g.

Complete the process to add a product license on the Website page.

Managing Security Devices and Licenses

Installing LicenseManager

| 468

3h.

Click Yes when the LicenseManager prompts, “Were you able to associate a new product with this
dongle?”

3i.

When LicenseManager does not detect a dongle or the serial number of the dongle does not
match the serial number in the dongle packet file, you are prompted to save the update file,

[serial#].wibuCmRaU.
3j.

Save the update file to the local machine.

After the update file is downloaded, copy the update file to the computer where the dongle resides:

On the computer where the dongle resides:
5a.

Run the update file by double-clicking it. ([serial#].wibuCmRaU is an executable file.)

5b.

After an update file downloads and installs, click OK.

5c.

Run LicenseManager.

5d.

From the Licenses tab, click Reload from Device to verify the product license has been added to
the dongle.

Removing a License Remotely
To remotely remove (unassociate, or unbind) a product license
1.

On the computer where the dongle resides:
1a.

Run LicenseManager.

1b.

From the Licenses tab, click Reload from Device to read the dongle license information.

1c.

Click Save to File to save the dongle packet file to the local machine.

Copy the file to a computer with an connection.

On the computer with an connection:
3a.

Launch LicenseManager. You will see a notification, “No security device found”.

3b.

Click OK.

3c.

An “Open” dialog box will display. Highlight the .PKT file, and click Open.

3d.

Click on the Licenses tab.

3e.

Mark the box for the product license you want to unassociate; then click Remove License.

3f.

When prompted to confirm the removal of the selected license from the dongle, click Yes.

3g.

When LicenseManager does not detect a dongle or the serial number of the dongle does not
match the serial number in the dongle packet file, you are prompted save the update file.

3h.

Click Yes to save the update file to the local computer.

3i.

The Step 1 of 2 dialog details how to use the dongle packet file to remove the license from a
dongle on another computer.

3j.

Save the update file to the local machine.

After the update file is downloaded, copy the update file to the computer where the dongle resides.

On the computer where the dongle resides:
5a.

Run the update file by double-clicking it. This runs the executable update file and copies the new
information to the security device.

5b.

Run LicenseManager

5c.

On the Licenses tab, click Reload from Device in LicenseManager to read the security device and
allow you to verify the product license is removed from the dongle.

5d.

Click Save to File to save the updated dongle packet file to the local machine.

Managing Security Devices and Licenses

Installing LicenseManager

| 469

Copy the file to a computer with an connection.

Updating Products
You can use LicenseManager to check for product updates and download the latest product versions.

Checking for Product Updates
To check for product updates, on the Installed Components tab, click Newest. This refreshes the list to display
what version you have installed, and the newest version available.

Downloading Product Updates
To install the newest version, mark the box next to the product to install, then click Install Newest.
Note: Some products are too large to download, and are not available. A notification displays if this is the case.

To download a product update
1.

Ensure that LicenseManager displays the latest product information by clicking the Installed
Components tab. Click Newest to refresh the list showing the latest releases, then compare your
installed version to the latest release.
If the latest release is newer than your installed version, you may be able to install the latest release
from our Website.

Ensure that the program you want to install is not running.

Mark the box next to the program you want to download; then click Install Newest.

When prompted, click Yes to download the latest install version of the product.
4a.

If installing the update on a remote computer, copy the product update file to another computer.

Install the product update. You may need to restart your computer after the update is installed.

Purchasing Product Licenses
Use LicenseManager to link to the AccessData Web site to find information about all our products.
Purchase product licenses through your AccessData Sales Representative. Call 801-377-5410 and follow the
prompt for Sales, or send an email to sales@accessdata.com.
Note: Once a product has been purchased and appears in the AccessData License Server, add the product
license to a CodeMeter Stick, dongle, or security device packet file by clicking Refresh Device.

Sending a Dongle Packet File to Support
Send a security device packet file only when specifically directed to do so by AccessData support.

Managing Security Devices and Licenses

Installing LicenseManager

| 470

To create a dongle packet file
1.

Run LicenseManager

Click on the Licenses tab.

Click Load from Device.

Click Refresh Device if you need to get the latest info from AD’s license server.

Click Save to File, and note or specify the location for the saved file.

Attach the dongle packet file to an e-mail and send it to:

support@accessdata.com.

Managing Security Devices and Licenses

Installing LicenseManager

| 471

Virtual CodeMeter Activation Guide
Introduction
A Virtual CodeMeter (VCM) allows the user to run licensed AccessData products without a physical CodeMeter
device. A VCM can be created using AccessData License Manager, but requires the user to enter a
Confirmation Code during the creation process.
The latest revision of this guide can be found at:
http://accessdata.com/downloads/media/VCM_Activation_Guide.pdf

Preparation
Contact

your AccessData sales rep to order a VCM confirmation code.

Install

CodeMeter Runtime 4.10b or newer (available on the AccessData download page).

Install

the latest release of License Manager (available on the AccessData download page).

The

following steps are to be run on the system where you want to permanently attach the VCM.

Note: Once created, the VCM cannot be moved to any other system.
AD

Lab WebUI and eDiscovery administrators, please also follow steps outlined under in Additional
Instructions for AD Lab WebUI and eDiscovery (page 474) in order to enable VCM licensing on the
AccessData License Service.

Setup for Online Systems
To setup a Virtual CodeMeter
1.

Unplug any AccessData dongles you currently have connected.

Launch License Manager.
Note: When creating a VCM on Windows Server 2003 or 2008, please refer to the special set of steps
written for those platforms. See Creating a Virtual CM-Stick with Server 2003/2008 Enterprise
Editions (page 473).

Select Create A Local Virtual CMStick

Click OK.
The Confirmation Code Required dialog appears.

Enter your confirmation code.

Click OK, AccessData License Manager will automatically synchronize with the License Server over the
.

Click OK when the update completes. License Manager will then create the VCM on your system.

At this point, AccessData License Manager now displays a serial number for the VCM on the Licenses
tab and the VCM can now operate in a similar way to a hardware CodeMeter device.

Managing Security Devices and Licenses

Virtual CodeMeter Activation Guide

| 472

Setting up VCM for Offline Systems
You can setup a Virtual CodeMeter on a system that is not connected to the internet (offline). You must also have
one machine that connects to the internet to perform certain steps. This section details what to do on which
machine.

Perform these steps on the Online system
1.

Unplug any AccessData dongles you currently have connected.

Launch License Manager.
Note: When creating a VCM on Windows Server 2003 or 2008 Enterprise Edition, please refer to the
special set of steps written for those platforms. See Creating a Virtual CM-Stick with Server 2003/
2008 Enterprise Editions (page 473).

Select Create Empty Virtual CMStick (offline).

Click OK.

The resulting dialog prompts you to save the *.wibucmrau file. Enter a name and path for the file, then
click Save.

Transfer the *.wibucmrau to the Online system.

Perform these steps on the Online system
7.

Unplug any AccessData dongles you currently have connected.

Launch License Manager.

Select Create Activation File (online).

10. Click OK.
11. In the Confirmation Code Required dialog, enter your confirmation code and click OK.
12. AccessData License Manager will automatically synchronize with the License Server over the internet.

Data synchronized from the server will be written to the *.wibucmrau file. Click OK when the update
completes.

13. Transfer *.wibucmrau back to the offline system.

Perform these steps on the Offline system
14. Unplug any AccessData dongles you currently have connected.
15. Launch License Manager.
16. Select Create Activate Virtual CMStick (offline).
17. Click OK.
18. The resulting dialog prompts you to browse to the location of the newly updated *.wibucmrau file.

Locate the file, then click Open. License Manager creates the VCM on your system.
19. 19.At this point, AccessData License Manager should now display a serial number for the VCM on the

“Licenses” tab and the VCM can now operate in a similar way to a hardware CodeMeter device.

Creating a Virtual CM-Stick with Server 2003/2008 Enterprise Editions
This section contains special instructions for using a VCM with Windows Server 2003 or 2008 Enterprise
Editions. Complete each section in order.

Managing Security Devices and Licenses

Virtual CodeMeter Activation Guide

| 473

To Create an Empty CodeMeter License Container
1.

On the Server 2003/2008 machine, unplug any CodeMeter devices.

Open the CodeMeter Control Center. Make sure the window on the License tab is, empty indicating that
no licenses are currently loaded.

Select File > Import License.

Browse to the License Manager program files directory.
32

bit systems: C:\Program Files\AccessData\LicenseManager\

64

bit systems: C:\Program Files (x86)\ AccessData\LicenseManager\

Highlight the TemplateDisc5010.wbb file, then click Import.

Click the Activate License button.

When the CmFAS Assistant opens, click Next.

Select Create license request, and click Next.

Confirm the desired directory and filename to save .WibuCmRaC. (Example: Test1.WibuCmRaC)

10. Click Commit.
11. Click Finish.

To Copy to another machine
1.

Copy the new .WibuCmRaC to another machine that is not running Windows Server 2003/2008
Enterprise.
Note: The destination system must have an active internet connection.

Unplug any AccessData dongles you currently have connected.

Launch License Manager.

Select Create Activation File (online).

Click OK.

In the Confirmation Code Required dialog enter your confirmation code and click OK.

AccessData License Manager will automatically synchronize with the License Server over the internet.
Data synchronized from the server will be written to the *.wibucmrau file. Click OK when the update
completes.

To Finish the activation on the Windows Server 2003/2008 Enterprise system
1.

Copy the activated .WibuCmRaC file to the Server 2003/2008 machine.

On the Server 2003/2008 machine, unplug any CodeMeter devices.

Open the CodeMeter Control Center. Make sure the window on the License tab empty indicating that no
licenses are currently loaded.

Select File > Import License.

Browse to the location where the activated .WibuCmRaC is stored. Click Import.

AccessData License Manager now displays a serial number for the VCM on the Licenses tab and the
VCM can now operate in a similar way to a hardware CodeMeter device.

Additional Instructions for AD Lab WebUI and eDiscovery
This section provides additional information for enabling the Web User Interface to recognize a VCM.

Managing Security Devices and Licenses

Virtual CodeMeter Activation Guide

| 474

To enable AD Lab WebUI and eDiscovery to use VCM
1.

Open Registry Editor.

Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Products
Add the following DWORD registry string to the key and set the value to 1:

HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Products | EnableACTTest
The AccessData License Service will know to expect a VCM when EnableACTTest is set to “1.”

Virtual CodeMeter FAQs
Q: How do I get a Virtual CodeMeter (VCM)?
A: Contact your AccessData product sales representative. They will provide you with a VCM confirmation code.

Q: How do VCMs work?
A: A VCM operates in almost exactly the same way as a hardware CodeMeter device, except that they exist as
a file stored on the hard disk. During activation, the VCM file (named with a WBB extension) is tied to the
hardware of the system using unique hardware identifiers. Those unique identifiers make VCMs non-portable.
When AccessData License Manager is launched, it will automatically load the VCM and display its license
information. From there, you can refresh, remove, add existing licenses, etc just the same you would with a
hardware security device.

Q: Are VCMs supported on virtual machines (VM)?
A: No. Due to the fact that virtual machines are portable and VCMs are not, VCMs are not supported on virtual
machines. Currently it is recommended to use AccessData Network License Service (NLS) to license systems
running as virtual machines. CLICK HERE for more information.

Q: Does the AccessData Network License Service (NLS) support VCMs?
A: The current release of NLS does not support using VCM as a network dongle. AccessData is considering this
support for a future release.

Q: How can I “unplug” a VCM?
A: If you want to prevent License Manager from automatically loading the VCM you can "unplug" it by stopping
the CodeMeter Runtime Service server and then moving (cut and paste) the WBB file to a new location
(renaming the file does not suffice). By default the WBB file is located at:
32 bit systems:

C:\Program Files\CodeMeter\CmAct\
64 bit systems:

C:\Program Files (x86)\CodeMeter\CmAct\
Q: I have activated a VCM on my system, but now I need to activate it on a different system. What should I do?

Managing Security Devices and Licenses

Virtual CodeMeter Activation Guide

| 475

A: Since a VCM is uniquely tied to the system on which it is activated, it cannot be moved to any other system. If
you need to activate a VCM on a different system, you need to contact your AccessData Sales Representative.

Q: What if I need to reinstall Windows, format my drive, change my system's hardware, or back up my VCM in
case of a disaster? Will the VCM still work?
A: The VCM can be backed up by simply copying the WBB file to a safe location. It can be restored by copying
the WBB file to the CmAct folder. The VCM cannot be restored without a WBB file. If you do not have a backup
of your WBB file, you will need to get a new confirmation code from your AccessData Sales Representative.

Q: My AccessData product does not seem to recognize the license stored on a VCM. What am I doing wrong?
A: VCMs are supported by the following versions of AccessData products:
FTK

1.81.6 and newer

FTK

3.1.0 and newer

PRTK
DNA
RV

6.5.0 and newer

3.5.0 and newer

1.6.0 and newer

eDiscovery

3.1.2 and newer

AD

Lab 3.1.2 and newer

AD

Enterprise 3.1.0 and newer

MPE+

4.0.0.1 and newer

Ensure that the version of the product you are running support VCMs. If the version you are running is listed as
supported, verify that according to License Manager, the release date of the version you are running falls before
the expiration date of the license.

Managing Security Devices and Licenses

Virtual CodeMeter Activation Guide

| 476

Network License Server (NLS) Setup Guide
Introduction
This section discusses the installation steps and configuration notes needed to successfully setup an
AccessData Network License Server (NLS).
Note: Click on this link to access the latest version of this guide:
Network License Server (NLS) Setup Guide.

Preparation Notes
CodeMeter

Runtime 3.30a or newer must be installed on all Client and Server systems

AccessData

License Manager must be used to prepare the network dongle. The system running License
Manager must have internet access and have CodeMeter Runtime installed.

The

current release of NLS supports the following versions of Windows:

Windows

XP 32/64 bit

Windows

Server 2003 32/64 bit

Windows

Vista 32/64 bit

Windows

Server 2008 R1 32/64 bit

Windows

7 32/64 bit

Windows

Server 2008 R2 64 bit

Setup Overview
To setup NLS
1.

Download the latest release of NLS located in the utilities section of the AccessData download page.

Extract contents of ZIP to a folder of your choice.

On the NLS server system, run through the NLS Installation MSI and accept all defaults.

Prepare network dongle:
4a.

Provide the serial number to AD Support and request to have the “Network Dongle Flag” applied.

4b.

Migrate any additional licenses to the network dongle

4c.

Refresh the network dongle device using AccessData License Manager.

Launch the AccessData product on the NLS client system.

Enter the NLS server configuration information:


IP address or hostname of NLS server system

Port

6921

Click, OK.

If you encounter any problems, please read the notes below for troubleshooting information.

Managing Security Devices and Licenses

Network License Server (NLS) Setup Guide

| 477

Network Dongle Notes
AccessData

License Manager 2.2.6 or newer should be installed in order to manage licenses on the
network dongle.

Network

dongles can hold up to 120 physical licenses. Each License has a capacity to hold thousands of
sub licenses (i.e. Client count or worker count).

Contact

AccessData Technical Support to have your CodeMeter device flagged as a Network Dongle
(required for NLS).

NLS Server System Notes
Make

sure the CodeMeter device is flagged as Network Dongle (i.e. License Manager will show the serial
as “1181234N”. To have this flag set on your CodeMeter device, please contact AccessData Technical
Support).

Server

system must be configured to allow incoming and outgoing traffic on TCP port 6921.

A

web interface to view and revoke licenses all licenses is accessible at
http://localhost:5555
This page can be reached only from a web browser running locally on the NLS server system.

A

Network Dongle cannot be used to run AccessData products locally unless the NLS server is running
locally.

Some

versions of Windows may not find a local NLS server when the DNS hostname of the server is
provided. In those cases, it is recommended to use a static IP address.

When

using the NLS across domains, users must have permissions to access resources on both
domains (either by dual-domain membership or cross-domain trust).

When

running NLS on Windows Server 2008, Terminal Services must be installed and accepting
connections. If Terminal Services is not configured it will not open the port and share out the licenses
correctly.

The

name of the service according to Windows is “AccessData Network License Service.”

NLS Client System Notes
When

launched, any NLS client application that needs to lease a license from the NLS server will
automatically check for the following values within the Windows Registry.
NetDonglePath:

The IP address or DNS hostname of the system hosting the Network License Server
service which is found in the following registry key on the client system:

HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Products\Common
The TCP port number through which the client and server systems have been
configured to use. This value is located in the same key as NetDonglePath.

NetDonglePort:

uniqueId:

In order to lease a license from the server, the client system must first posses a unique
identification value. This value is automatically generated by applications such as FTK, PRTK, or
DNA. (Registry Viewer and FTK 1.x cannot be used setup initial client NLS configuration at this time.)
You can find the each client system’s uniqueId by inspecting the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Shared
The Client system must be configured to allow all incoming and outgoing traffic on TCP port 6921.
The

following products support the ability to lease a license from a NLS server:

FTK

2.2.1 and newer

FTK

1.81.2 and newer

Managing Security Devices and Licenses

Network License Server (NLS) Setup Guide

| 478

FTK

Pro 3.2 and newer

PRTK
DNA

6.4.2 and newer

3.4.2 and newer

Registry

Viewer 1.5.4 and newer

AD

Enterprise 3.0.3 and newer

AD

Lab 3.0.4 and newer

AD

Lab Lite 3.1.2 and previous

Mobile

Phone Examiner 3.0 and newer

Explicit

Image Detection (EID) Add-on

Glyph

Add-on

Use

AccessData License Manager (ver. 2.2.4 or newer) to migrate licenses off other devices and onto a
network device.

When

running AccessData products on Windows Vista, 7, or Server 2008 you must choose Run as
administrator at least once in order to lease a license from a NLS server.

If

the NLS client application is having trouble leasing a license either from the NLS server, AccessData
recommends that you reset the licensing configuration to default.

To

reset the licensing configuration, delete and recreate the NLS registry key located at:

HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Products\Common

Managing Security Devices and Licenses

Network License Server (NLS) Setup Guide

| 479

Chapter 39

Configuring for Backup and Restore

Configuration for a Two-box Backup and Restore
By default, a two-box installation (also known as a distributed installation, where the application and its
associated database have been installed on separate systems) is not configured to allow the user to back up
and restore case information. Some configuration changes must be performed manually by the system
administrator to properly configure a two-box installation. Please note that the steps required to complete this
configuration differ slightly for domain systems than for workgroup systems.

Configuration Overview
The following steps are required before you can perform two-box case back ups and restoration.
Create
Share

a service account common to all systems involved. See Create a Service Account on page 480.

the case folder and assign appropriate permissions. See Share the Case Folder on page 481.

Configure

the database services to run under service account. See Configure Database Services on

page 482.
Share

back up destination folder with appropriate permissions. See Share the Backup Destination Folder
on page 482.

Note: When prompted to select the backup destination folder, always use the UNC path of that shared folder,
even when the backup destination folder is local.
Each of these items is explained in detail later in this chapter.

Create a Service Account
To function in a distributed configuration, all reading and writing of case data should be performed under the
authority of a single Windows user account. Throughout the rest of this document, this account is referred to as
the “service account.” If all the systems involved are members of the same domain, choosing a domain user
account is the recommended choice. If not all of the systems are members of the same domain, then you can
configure “Mirrored Local Accounts” as detailed in the following steps:

Configuring for Backup and Restore

Configuration for a Two-box Backup and Restore

| 480

To set up Mirrored Local Accounts
1.

On the Examiner host system, create (or identify) a local user account.

Ensure that the chosen account is a member of the Local Administrators group.

On the database host system, create a user that has the exact same username and password as that
on the Examiner host system.

Ensure that this account is also a member of the Local Administrators group on the database host
system.

Instructions for Domain User Accounts
Choose (or create) a domain user account that will function as the service account. Verify that the chosen
domain user has local administrator privilege on both the Examiner host system and the database host system.

To verify the domain user account privileges
1.

Open the “Local Users and Groups” snap-in.

View the members of the Administrators group.

Ensure that the account selected earlier is a member of this group (either explicitly or by effective
permissions).

Perform this verification for both the examination and the database host systems.

Share the Case Folder
On the system hosting the Examiner, create a network share to make the main case folder available to other
users on the network. The case folder is no longer assigned by default. The user creating the case creates the
case folder. It is that folder that needs to be shared.
For this example, it is located at the root of the Windows system volume, and the pathname is:

C:\FTK-Cases.
To share the case folder
1.

Before you can effectively share a folder in Windows you must make sure that network file sharing is
enabled. Windows XP users should disable Simple File Sharing before proceeding. Windows Vista/7
users will find the option in the Sharing and Discovery section of the Network and Sharing Center. If you
encounter any issues while enabling file sharing, please contact your IT administrator.

Open the Properties dialog for the case folder.

Click the Sharing tab to share the folder.

Edit the permissions on both the Sharing and Security tabs to allow the one authoritative user Full
Control permissions.

Test connectivity to this share from the database system:
5a.

Open a Windows Explorer window on the system hosting the database.

5b.

Type \\servername\sharename in the address bar, where “servername” = the hostname of the
Examiner host system, and “sharename” = the name of the share assigned in Step 1.
For example: If the name of the system hosting the Examiner is ForensicTower1 and you named
the share “FTK-Cases” in Step #1 above, the UNC path would be \\forensictower1\FTK-Cases.

5c.

Click OK. Check to see if the contents of the share can be viewed, and test the ability to create
files and folders there as well.

Configuring for Backup and Restore

Configuration for a Two-box Backup and Restore

| 481

Configure Database Services
To ensure access to all the necessary resources, the services upon which the database relies must be
configured to log on as a user with sufficient permissions to access those resources.

To configure the database service(s) to Run As [ service account ]
1.

On the database server system, open the Windows Services Management console:
1a.

Click Start > Run.

1b.

Type services.msc.

1c.

Press Enter.

Locate the following services:
Oracle
TNS Listener service listed as OracleFTK2TNSListener or
OracleAccessDataDBTNSListener (Found on Oracle System)

Oracle

OracleServiceFTK2

(Found on Oracle System)

PostgreSQL
postgresql-x64-9.0

or
postgresql-x86-9.0

Open the properties of the service and click the Log On tab.

Choose This account.

Click Browse to locate the service account username on the local system or domain. Ensure that “From
this location” displays the appropriate setting for the user to be selected. Note that “Entire Directory” is
used to search for a domain user account, while the name of your system will be listed for a workgroup
system user.

In the object name box, type in the first few letters of the username and click Check Names. Highlight
the desired username. Click OK when finished.

Enter the current password for this account and then enter it again in the Confirm Password box. Click
Apply and then OK.

Repeat Steps #3-8 for each database service.

Restart database service(s) when finished.

Share the Backup Destination Folder
Using the same steps as when sharing the main case folder, share the backup destination folder. Use the UNC
path to this share when performing backups. For a two-box backup to work correctly, you must use a single UNC
path that both the examiner, and the database application have read/write access to.

Test the New Configuration
To test the new configuration
1.

Launch the Case Manager and log in normally.

Select (highlight) the name of the case you want to backup.
2a.

Click Case > Back up.

Configuring for Backup and Restore

Configuration for a Two-box Backup and Restore

| 482

2b.

Select a back up destination folder.

Note: The path to the backup location must be formatted as a UNC path.
The Data Processing window opens, and when the progress bar turns green, the backup is complete. If the Data
Processing window results in a red progress bar (sometimes accompanied by “Error 120”), the most likely cause
is that the database service does not have permission to write to the backup location. Please double check all
the steps listed in this document.

Configuring for Backup and Restore

Configuration for a Two-box Backup and Restore

| 483

Chapter 40

AccessData Distributed Processing

Distributed Processing allows the installation of the Distributed Processing Engine (DPE) on additional
computers in your network, allowing you to apply additional resources of up to three additional computers at a
time to the processing of your cases.
Distributed Processing may not help reduce processing times unless the number of objects to be processed
exceeds 1,000 times the number of cores. For example, on a system with eight cores, the additional distributed
processing engine machines may not assist in the processing unless the evidence contains greater than 8,000
items.
This appendix includes the following topics
See

Distributed Processing Prerequisites on page 484.

See

Installing Distributed Processing on page 486.

See

Configuring Distributed Processing on page 488.

See

Using Distributed Processing on page 490.

Distributed Processing Prerequisites
Before installing the AccessData (AD) Distributed Processing Engine, the following prerequisites must be met (if
you are not familiar with any one of these tasks, contact your IT administrator):
The

following software must be installed:

Evidence

Processing Engine installed on the local examination machine.

CodeMeter

Runtime software and either a USB or a Virtual CmStick.
(For more information regarding the CmStick, see (page 459).)

Database
KFF

either on the same computer, or on a second computer.

Library.

McAfee

Virus Scan must have an exception added for processes added to and run from the Temp
Directory.

The

Windows Temp directory must be set as default.

A

New user account that is a member of the Administrators group on the examiner machine. If you are
installing on a Microsoft network with a Domain Controller, this is easily accomplished. If you are on a
non-domain network or workgroup, create this same user account and password on each DPE machine,
as well as on the machine holding the Case Folder and the machine holding the Evidence Folder.
Make

a note of the user account, domain or workgroup, and the IP address of each machine.

AccessData Distributed Processing

Distributed Processing Prerequisites

| 484

A

familiarity with UNC paths. UNC paths are required whenever a path statement is needed during
installation and configuration of the DPE, and when the path to the Case Folder, or the path to the
Evidence Folder is required.
The

UNC format is \\[machine name or IP address]\[pathname]\[casefolder].

Computers

that are all on the same network, and in the same domain or workgroup.

familiarity with the Windows Services.msc to ensure appropriate Login rights for the DPE, and for
restarting the service, if necessary.

A

familiarity with IP addresses and how to find them on a computer.

A

knowledge of the case folder path. The case folder must be shared for DPE to access it and write to it
as it processes case data.

AccessData Distributed Processing

Distributed Processing Prerequisites

| 485

Installing Distributed Processing
Important: Do not install the Distributed Processing Engine on the examiner machine. The install required the
installation of the local Evidence Processing Engine on that machine.
Installing the Distributed Processing Engine on the examination machine disables both processing
engines.
Remedy: If you have already installed both the Evidence Processing Engine and the Distributed
Processing Engine on a single machine, you must:
a) stop the processes
b) uninstall from both the examination machine and the Evidence Processing Engine machines
c) restart your machine
d) install on the examination machine.
e) start the Evidence Processing Engine again

To install AccessData Distributed Processing
1.

Install the Distributed Processing Engine (AccessData Distributed Processing Engine.EXE) on the
computers that are to participate in case processing, (record the IP address of each one for use when
configuring the DPE on the examination machine).
The DPE install file can be found on the installation disc in the following path:

[Drive]:\FTK\AccessData Distributed Processing Engine.EXE
If you do not know the IP address of the machine you are installing on, do the following:
1a.

Click Start on the Windows Startbar.

1b.

Click Run.

1c.

Enter cmd.EXE in the Run text box.

1d.

If the prompt is not c:\>, type c: and press Enter.
At the new prompt, type cd\ and press Enter.
The resulting prompt should be c:\>.

1e.

At the c:\> prompt, type ipconfig /all.

1f.

From the resulting information, locate the Ethernet adapter Local Area Connection, and find the
associated IP address. That is what you will need when you configure the Distributed Processing
Engine.

Note: AccessData recommends that you write down the IP addresses for all machines on which the
DPE will be installed.
1g.

At the prompt, type exit and press Enter to close the cmd.EXE box.

Note: The domain listed here is not necessarily the correct one to use in installation. To find the correct
domain or workgroup name, right-click My Computer (On Vista or Server 2008, click Computer),
click Properties > Computer Name. The Domain or Workgroup name is listed midway down the
page. Please make a note of it for future use.
2.

If a Security Warning appears, click Run to continue.

If you want to stop the install, click Cancel on the Preparing to Install screen.

Click Next on the Welcome screen to continue the install.

Read and accept the License Agreement.

AccessData Distributed Processing

Installing Distributed Processing

| 486

Click Next to continue.

Accept the default destination folder (recommended), or click Change to specify a different destination
folder.

Click Next to continue.

Enter the credentials to be used for running the service.
User

name: This user account must be a member of the Administrators group on the DPE machine,
and must also have access to both the case folder, and the evidence folder. If this user account is not
a member of the Administrators group, or if you are not sure, check with your IT services
department.

While

it is not generally necessary on a domain, it is recommended that whether you are on a domain
network, a non-domain network, or a workgroup network, you create this same user account with the
same password as a member of the Administrators group on all machines involved. This acts as a
fail-safe in case the domain server goes down.

Domain:

The name of the domain all related computers are on. If a non-domain or workgroup
network is in place, use the local DPE’s machine name or IP address in place of the domain name
for this step in the installation.

Password:

This user account’s password for authenticating to the domain, or to the machine on the
non-domain network or workgroup. The password must be the same for this user account on each
machine.
The figure below illustrates the user name and password setup.
The components on the top row of the figure can be all on one machine, all on separate machines, or on
any combination of machines. The key is that the administrator account and password (or user account
in the Administrators group—it can be any name as long as the correct permissions are assigned, and
the same name/password combination is used on each machine) must exist on all the machines related
to the DPE installation, including the examination and database machines, and on both the Case Folder
machine and on the Evidence Folder machine. This means physically going to those machines and
adding the correct user accounts manually.
10. When you have finished adding the User Credentials, click Next to continue.
11. Click Install when the Ready to Install the Program screen appears.
12. Wait while the AccessData Distributed Processing Engine files are copied into the selected path on the

local machine.
13. The default path is:

[Drive]:\Program Files\AccessData\Distributed Processing Engine\.
14. Click Finish to complete the install and close the wizard.

If the service fails to start
1.

Leave the Retry/Quit dialog open and launch the Services (services.msc) dialog from the run
command.

Open the Properties dialog for the AccessData Processing Engine Service.

Click the Log On tab.

Verify that the logon credentials used have full Administrative rights.

Save the settings and exit the Properties dialog.

Stop and start the service manually.

Click Retry on the installer screen.

AccessData Distributed Processing

Installing Distributed Processing

| 487

Configuring Distributed Processing
Once the AccessData Distributed Processing Engine is installed on the non-examination machines, configure
Distributed Processing to work with the local Processing Engine.

To configure Distributed Processing to work with the local Lab Processing Engine
1.

In Case Manager, click Tools > Processing Engine Config.

Enter the appropriate information in each field, according to the following guidelines:
Computer

Name/IP: Enter the IP address of the computers where the Distributed Processing Engine
is installed. The computer name can also be used if the name can be resolved.

Port:

The default port is 34097. This is the port the processing host will use to communicate with the
remote processing engines.

Add:

Adds the computer and port to the list. You can add up to three remote processing engines (for
a total of 4 engines). When the maximum number of DPE machines is reached, the Add button will
become inactive.

Remove:

Removes a processing engine from the list of available engines. The localhost engine
cannot be removed.

Enable:

Enables the engine for use by the processing host. Until implemented, each engine you add
will be set to enabled (Disabled = False) by default. When implemented, you will be able to change
the selected computer’s status from Disabled to Enabled.

Disable:

Makes the engine unavailable for use in processing. When implemented, you will be able to
change the selected computer’s status from Enabled to Disabled. The disabled remote engine will
remain on the list, but will not be used.

Disabled

= True: Displays for that engine in the DPE list.

Maintain

UI performance while processing: Allows you to decide whether processing speed or UI
performance is more important.

Note: This will slow processing, and when selected, applies to all Remote DPEs.
3.

When all DPE machines have been added to the Processing Engine Configuration dialog, click Close.

If you have not yet configured the Distributed Processing Engine on the remote computers, or if you have, but it
is not working properly, you will see the warning shown in the following figure.

To correct this
1.

On the remote computer having the Distributed Processing Engine installed, click Start.
1a.

Right-click My Computer.

1b.

Click Manage.

1c.

Under System Tools, click Local Users and Groups.

1d.

Click Groups.

1e.

Double-click Administrators.

1f.

Verify that the user account name that was used in installation is in this group.

1g.

Click OK to close this dialog.

Under Local Users and Groups, click Users.
2a.

Find the user account name in the list, and double-click it.

2b.

Mark the box User cannot change password.

2c.

Mark the box Password never expires.

AccessData Distributed Processing

Configuring Distributed Processing

| 488

2d.

Click Apply.

2e.

Click OK.

Do one of the following:
Under

Services and Applications, click Services.

you already closed the Computer Management dialog, launch the Services (services.msc) dialog
from the Run command on the Start menu.

If

3a.

Open the Properties dialog for the AccessData Processing Engine Service.

3b.

In the General tab, find Startup Type. If it says Automatic, proceed to the next step. If it says
anything else, click the drop-down on the right side of the text box and select Automatic from the
list. Click Apply and proceed to the next step.

3c.

Open the Log On tab.

3d.

Verify that the Log On information is set to the user name, domain or DPE machine name, and
password that matches the user account you just verified (should be the one that was entered
during installation).

3e.

Click OK.

Right-click on the AccessData Processing Engine Service.

Click Stop to stop the service.

Click Start to re-start the service manually.

Click Retry on the installer screen.

Ensure that the user name provided during installation is a member of the Administrators account.

AccessData Distributed Processing

Configuring Distributed Processing

| 489

Using Distributed Processing
To utilize the Distributed Processing Engine when adding evidence to a case
1.

Make sure the case folder is shared before trying to add and process evidence.

Enter the path to the case folder in the Create New Case dialog in UNC format.

Click Detailed Options, and select options as you normally would.

Click OK to return to the New Case Options dialog.

Mark Open the case and then click OK to create the new case and open it.

The new case is opened and the Manage Evidence dialog is automatically opened. Click Add. Select
the evidence type to add. Select the evidence file to add and then click Open.

The path to the evidence is designated by drive letter by default. Change the path to UNC format by
changing the drive letter to the machine name or IP address where the evidence file is located,
according to the following syntax:

\\[computername_or_IP_address]\[pathname]\[filename]
8.

Leave the remaining path as is.

Click OK.

Checking the Installation
When you have completed the installation, open the Task Manager on the remote computer, and keep it open
while you add the evidence and begin processing. This will allow you to watch the activity of the

ProcessingEngine.EXE in the Processes tab.
The Distributed Processing Engine does not activate until a case exceeds approximately 30,000 items. When it
does activate, you will see the CPU percentage and Memory usage increase for the ProcessingEngine.EXE in
Task Manager.

AccessData Distributed Processing

Using Distributed Processing

| 490

Chapter 41

AccessData Oradjuster

AccessData Oradjuster.EXE optimizes certain settings within an AccessData Oracle database, and this allows
peak performance during investigative analysis to be obtained. This utility is particularly useful for 64-bit systems
with large amounts of RAM on board. It is included in the AD Lab Database install disc.
This document describes Oradjuster’s role in making maximum use of AD Oracle. To see a webinar that
demonstrates Oradjuster, look under the Core Forensic Analysis portion of the web page: http://
www.accessdata.com/Webinars.html.
This chapter includes the following topics
See

Oradjuster System Requirements on page 491.

See

Introduction on page 491.

See

The First Invocation on page 492.

See

Tuning for Large Memory Systems on page 494.

Oradjuster System Requirements
Oradjuster operates on all supported Windows platforms (both 32 and 64-bit) where and AD Oracle database
has been installed.

Introduction
The Oracle database system’s behavior is governed, in part, by its numerous Initialization Parameters, which
define many internal database settings. Oradjuster is concerned with two small groups of these parameters. The
first group regulates the memory usage of oracle.EXE, and the second group controls the number of client
programs that can be connected simultaneously to the database.
Although Oradjuster is not mandatory, it is very helpful. For many investigators, it is ideal to run Oradjuster
immediately following the AD Oracle install by clicking the Optimize the Database button on the Database
installation autorun menu. Later on, Oradjuster can be invoked again (one or more times) in order to fluctuate
database memory usage and derive even greater performance gains throughout the several phases of an
investigation.

AccessData Oradjuster

Oradjuster System Requirements

| 491

The First Invocation
When Oradjuster is invoked for the first time, it does the following
1.

Detect AD Oracle.

Query Windows to discover the size of RAM.

If necessary, prompt for the database’s administrative password.

Display the current values of the parameters of interest.

Compute new values (based on the size of RAM) and modify the parameters with them.

Shut down and restart the database.

Display the updated parameter values.

Record the new values in a Windows Registry key.

Some of these steps will be treated in greater detail in what follows.
Note: When Oradjuster is invoked from the install autorun menu, it does not linger on screen. It disappears as
soon as it has completed successfully, which is done in deference to those who may not take an interest
in its esoteric display information.
Oradjuster’s first invocation brings great improvement to performance, and many investigators may find this
satisfactory. However, as mentioned previously, subsequent use of Oradjuster can yield additional performance
improvements.

Subsequent Invocations
The use case scenarios described in this section illustrate how to employ Oradjuster to greatest effect in
configurations knows as One-Box and Two-Box.
Note: Some of the instructions below describe the invocation of Oradjuster from the command prompt. Working
from the command prompt may be a foreign experience for many, but any time/effort spent becoming
familiar with the command prompt and command line programs is worthwhile because it facilitates
advanced use of Oradjuster, and it opens a door to the large number of valuable and intriguing command
line programs available (serving many diverse purposes, including digital forensics).

One-Box Deployment
Oradjuster’s default behavior is to assume that the Examiner and the database are installed on the same
computer. The settings it applies on its first run strikes a balance between the memory needs of Examiner, AD
Oracle, and the operating system. Additional performance gains can be won by reducing oracle.EXE memory
consumption during evidence processing and then increasing oracle.EXE’s memory consumption during
investigative analysis after automatic processing has completed.

To accomplish this fluctuating of oracle.EXE memory usage
1.

After creating a case, but before adding and processing evidence, launch Oradjuster from the Case
Manager’s Tools menu.

AccessData Oradjuster

The First Invocation

| 492

Oradjuster will display its normal output and then prompt the user to make a temporary change to
SGA_TARGET (one of the Oracle database parameters having direct impact on memory consumption).
The value for SGA_TARGET is specified as a percentage of the size of physical memory, and the
allowable range is typically between 10% and 50%. Enter a percentage in the lower half of the allowed
range.

Add and process the case’s evidence.

After processing is complete, launch Oradjuster again from the Case Manager’s Tools menu.

Modify SGA_TARGET to a percentage in the upper half of the allowed range.

Complete the investigation of the case without modifying SGA_TARGET again unless more evidence is
added and processed.

Some trial-and-error experimenting is required to find the most optimal percentages. For example, it may be
desirable to set SGA_TARGET to the maximum allowable percentage in Step 5, rather than just some
percentage in the upper half of the range, so that the case window is most responsive. Also, it may be good to
reduce SGA_TARGET during Live searching (in spite of Step 6) as Live searching is similar in nature to
evidence processing.

Two-Box Deployment
When Examiner is installed on computer A, and AD Oracle is installed on computer B, oracle.EXE should be
even more aggressive in consuming memory on computer B since it does not need to share memory resources
with the Examiner. The following procedure should be conducted.
To begin, log in to computer B.
Note: If Oradjuster has been run on this computer before (as part of AD Oracle install and setup), then its
Registry key must be deleted before proceeding. Select Start Menu > Run. Enter “regedit” in the Run
prompt and press Enter. Within the Registry Editor dialog, navigate to and delete the following key:

HKEY_LOCAL_MACHINE\Software\AccessData\Shared\Version Manager\sds\oradjuster
Important: Do not delete or modify any other Registry keys or your system may become unstable.
Open the command prompt (select Start Menu > All Programs > Accessories > Command Prompt). Then,
issue the following commands (press the Enter key after each one):

Oradjuster Command Line Options
Command

Explanation

C:\> cd “Program
Files\AccessData\
Oracle\Oradjuster”

Move to the directory containing Oradjsuter.EXE. On a 64-bit version
of Windows, the directory path should be “Program
Files(x86)\AccessData\Oracle\Oradjuster”.

C:\[path]>
Oradjuster.EXE -mem
remoteworker

Assign parameter values appropriate for a dedicated AD Oracle
database.

As with Step 6 in section The First Invocation, and the database will be restarted. Some of the Oracle
parameters managed by Oradjuster cannot be modified “on the fly,” so the database must be restarted in order
for their changes to take effect. Therefore, when invoking Oradjuster from the command prompt, first close the
Examiner (by closing all case windows and the case management window).

AccessData Oradjuster

The First Invocation

| 493

Tuning for Large Memory Systems
When AD Oracle resides on a computer with a 64-bit Windows operating system, and with a large quantity of
RAM (from 8 GB to 128 GB, or higher), additional considerations are in order. As was hinted in section One-Box
Deployment, Oradjuster’s first run assigns oracle.EXE’s maximum memory consumption to roughly ½ the size of
RAM. (That is why the upper limit for SGA_TARGET is typically 50%.) Instead of sharing memory proportionally
between AD Oracle and the operating system, Oradjuster can be used to give oracle.EXE the lion’s share of
memory, which would not be safe on a computer with a lesser quantity of RAM. This is best accomplished by
editing Oradjuster’s key in the Registry and then running Oradjuster again, which causes Oradjuster to apply the
new, manually-entered values in the Registry key to AD Oracle.
Consider an investigative computer with 64 GB of RAM that hosts AD Oracle and the Examiner. Suppose that
the investigator ran Oradjuster in conjunction with the AD Oracle install, and has since conducted several large
cases (containing millions of discovered items each). The investigator is generally content with the case
window’s responsiveness in loading and sorting its File List pane, but wonders if that responsiveness could be
improved. So, she prepares to edit the SGA_MAX_SIZE and SGA_TARGET values in the Oradjuster key in the
Registry. When she opens Registry Editor and first navigates to the key, she sees that current values read:

Example of Oradjuster Settings
Name

Type

Data

...

sga_max_size

REG_SZ

37795712204

sga-target

REG_SZ

13743895347

...

These values represent quantities expressed in Bytes, and therefore the investigator can see that Oradjuster
has set SGA_MAX_SIZE to about 37 GB, and SGA_TARGET value of roughly 13 GB. She knows that she can
temporarily alter the value of SGA_TARGET using the technique shown in One-Box Deployment, but she can
only increase it to the upper limit imposed by SGA_MAX_SIZE. So, she decides to make the following edits:

Example of User-Modified Oradjuster Settings
Name

Type

Data

...

sga_max_size

REG_SZ

48795712204

sga-target

REG_SZ

32743895347

...

By modifying only the first two digits of Data field for each value, the investigator has paved the way for
Oradjuster to make the desired change to AD Oracle. (If she had wanted, the investigator could have edited the
Data field to contain a number that would be easier to read, such as “48000000000,” but the net effect would be
the same. And, the smaller the edit, the less chance of loosing a digit or inserting an extra one, both of which
may require a troubleshooting effort to repair.) As soon as Oradjuster is again invoked, the new upper limit for

AccessData Oradjuster

Tuning for Large Memory Systems

| 494

oracle.EXE memory usage will be approximately 48 GB (a jump from about ½ to about ¾ of RAM), and
SGA_TARGET will be set to about ½ of RAM by default.
The investigator closes the Examiner (knowing that her edit of SGA_MAX_SIZE in the Registry will cause
Oradjuster to restart AD Oracle) and runs Oradjuster again. (In this context, she can do so either by invoking it
from the command prompt, or by launching it with a double-click.) When Oradjuster completes its assignment
changes, and prompts the investigator to make a temporary change to SGA_TARGET if desired, she pauses to
review the before and after values in the Oradjuster output to confirm that the changes to SGA_MAX_SIZE and
SGA_TARGET are correct.
Note: When Oradjuster assigns a new value to SGA_MAX_SIZE, oracle.EXE will modify it rounding it up the
nearest multiple of 16 MB. Therefore, when inspecting Oradjuster output, remember to confirm that the
first (or left-most) digits of SGA_MAX_SIZE are correct. Do not be alarmed if trailing digits have been
altered.
Finally, the investigator creates several more large cases with her new settings. She observes that the case
window is in fact more responsive and she pays attention to evidence processing times to see whether or not

oracle.EXE’s increased claim on system memory appears to slow down evidence processing...
In conclusion, and although the vast majority of tuning needs have been addressed by the preceding
information, additional explanation will allow a curious investigator to go even further in using Oradjuster.
First, the list of supported command line arguments can be displayed with the command:

C:\[path]> Oradjuster.exe -help
Second, the following table provides a listing of the values Oradjuster records in its Registry key.

Oradjuster Values Found in its Registry Key

Value Name

Provokes DB
Restart

Type

_pga_max_size

Memory Usage

_smm_max_size

Memory Usage

commit_write

Memory Usage

open_cursors

Memory Usage

pga_aggregate_target

Memory Usage

processes

YES

Number of Concurrent Connections

session_cached_cursors

YES

Memory Usage

sessions

YES

Number of Concurrent Connections

sga_max_size

YES

Memory Usage

sga_target

Memory Usage

Transactions

YES

Number of Concurrent Connections

VERSION

N/A

Oradjuster Version Information — Do not edit

AccessData Oradjuster

Tuning for Large Memory Systems

| 495

Chapter 42

Installing the Windows Agent

This chapter covers the manual installation of the agent in a Windows environment.
This appendix includes the following topics:
See

Manually Installing the Windows Agent on page 496.

See

Using Your Own Certificates on page 501.

Manually Installing the Windows Agent
Perform the following steps to manually install the Enterprise Agent in Windows:
See

Preparing the AD Enterprise Agent Certificate on page 496. (AD Enterprise only)

See

Installing the Agent on page 497.

See

Configuring Execname and Servicename Values on page 499.

Preparing the AD Enterprise Agent Certificate
About Enterprise Security Certificates:
When installing AccessData Enterprise Examiner, you need a security certificate. Enterprise Management
Server creates Enterprise security certificates, the CRT public key and the PEM public and private key pair files.
However, the Enterprise Configuration Management Tool now also accepts PKCS#12 certificates.
If you have a third-party certificate chain in the PKCS#12 format, the Enterprise Configuration Management Tool
reads the PKCS#12 certificate and asks for the user password. The certificate is decrypted only long enough to
gather the information necessary for the Enterprise installation, then re-encrypts the private key. The public key,
regardless of source, must be in standard binary or base-64 encoding.
If the Agent is installed, or pushed, to the workstations using Enterprise, the certificate information will
automatically be read from the Enterprise Configuration Management Tool. If the Agent is pushed out through
ePO or any other method, the certificate information (paths and filenames) must be re-entered. The public
certificate itself must be in an area of the network where it can be accessed by the Agent machine during
installation, but does not need to be stored on the Agent machine.
In addition, the Agent uses only a public key. As long as that public key is in binary or base-64 format, it will
automatically be read by the Agent. For more information, see Using Your Own Certificates (page 501).

Installing the Windows Agent

Manually Installing the Windows Agent

| 496

To prepare the certificate
1.

Prepare the Agent Certificate.

Copy the needed certificate from the Management Server to your deployment location.
Management Server creates certificates during the setup in:

[Drive]:\Program Files\AccessData\AccessData Management Server\certificates.
The certificate name is the ManagementServer.crt.
3.

Copy ManagementServer.crt to a folder of your choice where it can be accessed while installing the
Agent.

Installing the Agent
To install the Agent
1.

Run AccessDataAgent.msi or AccessDataAgent(64bit) using msiexec.
Note: These .msi files are located in the Program Files\AccessData\Forensic Toolkit\5.1\Bin\Agent\
folder after installation.
There are several command line parameters available to use with this .msi as documented below. Here
is an example command line that will install with the defaults:
If AccessDataAgent.msi resides in the folder C:\enterprise and ManagementServer.crt resides in
[Drive]:\certificates, type the following command line to install the agent with defaults:

msiexec /i [Drive]:\enterprise\AccessDataAgent.msi
CER=[Drive]:\certificates\ManagementServer.crt.
The following table lists the command line options available for use with this AccessDataAgent.msi:

Command Line Options
Option

Action

/i (i or x required)

Specifies install.

/x (i or x required)

Specifies un-install.

/qn (optional)

Allows you to install in quiet mode with no user interaction.

(required)

If running from the folder where the .msi is located you do not have to
include path, only the filename.

CER= (required)

Specifies the certificate the agent uses.

ALLUSERS=

Configures the installer to be available to all users. The default option
varies per operating system.
The options are:
 allusers=1 configures the installer to be available to all users.
 allusers=0 configures the installer to be available to only the user
who is installing the agent.

INSTALLDIR= (optional)

Allows you to change the install location from the default folder:
(C:\Program Files\AccessData\Agent).

PORT= (optional)

Allows you to change the port from the default port (3999).

Installing the Windows Agent

Always include the path, regardless of location.

Manually Installing the Windows Agent

| 497

Command Line Options (Continued)
Option

Action

LIFETIME= (optional)

Allows you to configure the life cycle of the agent. The “d” value
equals the Time To Live (TTL) measured in days. Adding a number
preceded by a dash measures the TTL in minutes. For example: <-d >.

CONNECTIONS=

Allows you to configure the number of maximum connections for the
agent.

STORESIZE=

Allows you to configure the size of the data store.

TRANSIENT=1

Allows you to configure the agent as a Transient Agent. Transient
Agents have no protected storage and remove themselves when the
agent machine is restarted.

FOLDER_STORAGE=1

Allows you to configure the agent as a Persistent Agent. Persistent
Agents use a “local” file system based storage and not protected
storage. Persistent Agents also remain on the agent machine after the
machine is restarted.

SERVICELESS=1

Allows you to configure the agent to install with no protected storage
and no installed service. The agent removes itself when the agent
machine restarts or when the lifetime option expires, whichever comes
first.

PCD= (optional)

Enterprise Only: Allows you to configure the Proxy Cycle Delay
(PCD). The PCD is the time interval at which the agent attempts to
connect to proxy to check if any work has been assigned. The PCD “x”
value is measured in seconds. The default is 1200 (20 minutes).

PROXY= (see example below)
(optional)

Enterprise Only: Allows you to configure a proxy-able agent.
PrimaryIP should refer to the IP address to which the agent should try
to communicate. (Usually this will be the internal private network IP of
the proxy server.)
The “SecondaryIP” should refer to the IP address to which the agent
should try to connect when the attempts to connect to the “PrimaryIP”
have failed. (Often this IP will represent the public IP of the proxy
server.)
PrimaryIP2 and SecondaryIP2 should refer to an additional proxy
server address and is delimited by a tilde (~). Additional proxy servers
can be added by following this same pattern.

,:~,:

MAMA=

ResolutionOne, CIRT, and eDiscovery Only: Allows you to configure
the IP Address of the Site Server to which the agent reports.

PUBSS=

ResolutionOne, CIRT, and eDiscovery Only: Allows you to configure
the agent to connect to a Public Site Server. See About Site Servers
on page 541.

Example Command Line Install
msiexec /i "C:\AgentInstall\AccessData Agent (64-bit).msi” cer=”C:\AgentInstall\AccessData E1.crt”
mama=10.10.35.32:54545 TRANSIENT=1 Persistent=1 Serviceless=1 lifetime=1 or lifetime=-5
pubss=192.192.192.192 5432

Installing the Windows Agent

Manually Installing the Windows Agent

| 498

Configuring Execname and Servicename Values
The Execname and Servicename values change the names of the agent executable and agent service
respectively. These values are added to the MSI using an MSI editor (such as ORCA.exe — a free MSI editor).

Changing the Execname Value
To make changes to the execname value
1.

Run Orca.EXE.

Click File > Open.

Browse to the folder containing the “AccessData Agent.msi” or “AccessData Agent (64-bit).msi” file
and open the file. The default path is:

[Drive]:\Program Files\AccessData\Forensic Toolkit\3.2\Bin\Agent\x32 (or x64)\
4.

In the Tables list, select File...

In the FileName column, double-click “u4jwdc7h.exe|agentcore.exe”.
5a.

Enter the filename to use for the agent core executable.

Note: Replace the entire string with the filename.
6.

Press Enter.

Click File > Save.

Note: Do not close Orca if you are also changing the service name.

Changing the Servicename Value
To make changes to the Servicename value
If you closed Orca, begin with Step 1. Otherwise, skip to Step 4.
1.

Run Orca.EXE.

Click File > Open.

Browse to the folder containing the “AccessData Agent.msi” or “AccessData Agent (64-bit).msi” file
and open the file. The default path is:

[Drive]:\Program Files\AccessData\Forensic Toolkit\3.2\Bin\Agent\x32 (or x64)\
4.

In the Tables list, select “ServiceControl”.

In the Name column, double-click “AgentService”.
5a.

Enter the name to use for the AgentService and press Enter.

Note: Use the same value in steps 5a, 7a and 8a.
6.

In the Tables list, select “ServiceInstall”.

In the Name column, double-click “AgentService”.
7a.

Enter the name to use for the AgentService (use the same value entered in step 5a) and press
Enter.

In the DisplayName column, double-click “AgentService”.

Installing the Windows Agent

Manually Installing the Windows Agent

| 499

8a.
9.

Enter the name to use for the AgentService (use the same value entered in steps 5a and 7a) and
press Enter.

Click File > Save.

10. Click File > Close.

Installing the Windows Agent

Manually Installing the Windows Agent

| 500

Using Your Own Certificates
Definitions:
PKCS#12:

Standard certificate packaging to securely transfer public/private key pairs

PKCS#7:

Standard certificate package to store certificates for S/MIME encryption. We are using for
storing sets of public key chains.

To export the public certificate when using a PFX (PKCS#12) key
1.

Using the PKCS#12 provided by the Certificate Administrator, double-click PKCS#12 to open it.

Install the certificate into a local Microsoft certificate store by following the wizard supplied when you
double-click the certificate file.

View the public certificate of the installed certificate by opening the local machine’s certificate store.
(This can be done with Microsoft Management Console or in Internet Explorer under Tools > Internet
Options > Content > Certificates)

Find the bottom level certificate and double-click the certificate to view it.

Click the Certification Path tab to verify that the certificate has a full verification path, meaning that
nothing is missing from the top of the chain to the bottom.

Click the Details tab and click Copy to File.

Click Next and click Cryptographic Message Syntax Standard - PKCS #7 Certificates.

Select Include all certificates in the certificate path if possible.

Click Next and enter a file export path.

10. Click Next.
11. Click Finish.
12. Double-click the exported PKCS#7 and verify that all of the public certificates in the chain are in the

PKCS#7.
The exported file you created will be used as the certificate for the agent installation.

Installing the Windows Agent

Using Your Own Certificates

| 501

eDiscovery Additional Instructions
1.

Obtain the public key and private key pair (pfx and cer).

Copy the private certificates to the collection workers. The only certificates that need to be changed are
the ones that talk with the agent (collectors).
2a.

(Optional) You can make the certificates available to the processing worker in the event you want
to use it for collection testing in the interim.

Run CollectorCfgTool.EXE:

[Drive}:\[Program Files]\AccessData\eDiscovery\WorkManager\.

3a.

Select the new private key.

3b.

Provide the password.

3c.

(Optional) Delete the original private key.

Uninstall the agent:
4a.

Click Start > Control Panel -> Add or Remove Programs.

4b.

If the previous agent was installed using the “allusers” option, you must use the following to
uninstall from the command prompt using msiexec

msiexec /x [Path to Installer]Adagentinstaller.msi
5.

Install the agent:
5a.

Assuming the Certificates are installed on the C: drive, in the Run Command box, type:

msiexec /i [Path to Installer]Adagentinstaller.msi CER=”[Full Path to Certificate File]”

Installing the Windows Agent

eDiscovery Additional Instructions

| 502

Chapter 43

Installing the Unix / Linux Agent

This chapter discusses the Unix Agent Installer. It includes the following topics:
See

Installing The Enterprise Agent on Unix/Linux on page 503.

Installing The Enterprise Agent on Unix/Linux
The AccessData Agent is available for Unix-, Linux-, and Mac-based operating systems as well as for Windows.
This appendix discusses the specific installation files to use for supported Unix and Linux platforms.

Supported Platforms
The Unix Agent Installer supports the following platforms:

Unix Agent Supported Platforms
Installer

agent-rh5.sh or agent-rh5x64.sh

RedHat 5 (32- & 64-bit)
SLED 11 (Suse Linux Enterprise Desktop) (32- & 64-bit)
CentOS Enterprise 5 (32- & 64-bit)
Ubuntu 9 (and newer) (64-bit)

agent-rh3.sh or agent-rh3x64.sh

RedHat 3 (32- & 64-bit)
Novell Linux Desktop (NLD) 9 (32-bit)
SLED 10 (Suse Linux Enterprise Desktop) (32- & 64-bit)

Be sure to use the correct installer file for your 32- or 64-bit architecture/OS)
To install the Unix Agent
Execute the following command as root, and provide the appropriate information:

agent-.sh [-installpath| -i ]
where is the operating system agent that is being used, and where is the location of the public
certificate to be used for identification, and where [-i | -installpath] indicates the directory to install the agent in.

Installing the Unix / Linux Agent

Installing The Enterprise Agent on Unix/Linux

| 503

This defaults to:

/usr/AccessData/agent
Enterrpise Unix/Linux Agent Install Parameters and Options
Option

Result

-installpath, -i

The destination path for installing the agent. Default: /usr/
AccessData/agent/.

-lifetime, -l

The lifetime of the agent. Default: 0.
If ==0, it will never uninstall itself.
If >0 it is days before uninstall.
If <0 it is in minutes before uninstall.

-port, -p

The port the agent listens on. Default: 3999.

-connections, -c

The maximum number of concurrent connections allowed by the
agent. Default is 10.

-size, -s

The protected storage area size. Default is 16777216 (16 MB)

Uninstallation
To uninstall the Unix Agent, execute the following command as root:

agent-.sh [-remove | -r]

Configuration
The configuration file is located in the install path and is named ADAgent.conf. It supports the following
parameters:
Port:

Port on which to listen for activity.

MinThreadCount:
MaxThreadCount:

Minimum number of threads to have ready, waiting for connections.
Maximum number of threads servicing connections.

CertificatePath:

Fully qualified network path or local path to the certificate. The installer, by default, puts
the certificate in the installation path.

Starting the Service
To start the Unix Agent service, execute the following command as root:

/etc/init.d/adagentd start

Stopping the Service
To stop the Unix Agent service, execute the following command as root:

/etc/init.d/adagentd stop

Installing the Unix / Linux Agent

Installing The Enterprise Agent on Unix/Linux

| 504

Chapter 44

Installing the Mac Agent

This chapter discusses the Agent Installer for Apple Macintosh. It includes the following topics:
See

Configuring the AccessData Agent installer on page 505.

See

Installing the Agent on page 507.

See

Uninstalling the Agent on page 507.

Configuring the AccessData Agent installer
The AccessData Agent requires an X.509 certificate in order to establish a secure network connection to the
server or for AD Enterprise, the computer running Examiner. The package installer has been provided to aid in
the distribution efforts of these certificates by allowing an Administrator to modify the AccessDataAgent package
installer prior to installation of AccessData Agent software for Apple Macintosh. In addition to certificate
distribution, the port used by the Agent can be configured.
The following instructions allow an Administrator to configure the AccessData Agent package installer.

Bundling a Certificate
The AccessData Agent installer requires that a certificate (or certificate tree) is bundled with the installer. The
following is the sequence of steps that must be followed to bundle a certificate file into the installer.
1.

Create a folder named Configure.

Create a single file, named adagent.cert that contains one or more X.509 certificates to be distributed
to each installation of the Agent, and place it in the Configure folder.

Right-click the AccessDataAgent package installer file on the install disc,
([Drive]:\Enterprise\Agents\agent-Mac.dmg).

Select Show Package Contents popup menu item.

Drag the Configure folder from the Package Contents into the folder opened in Step 4 (alongside the
Contents folder).

Configuring the Port
The AccessDataAgent installer allows an Administrator to (optionally) configure the port the Agent will use to
communicate with an Examiner when installed. This is done by adding a file containing the port number to the

AccessDataAgent package installer. The following is a set of instructions an Administrator will use to configure

Installing the Mac Agent

Configuring the AccessData Agent installer

| 505

the AccessData Agent package installer. To do so, complete Steps 1-5 under Bundling a Certificate, then
continue with Step 1 here. If you do not need to do a custom configuration of the port, skip to Step 6 below..
1.

Create a text file named adagent.port that contains the port number the Agent is to use; this file is to
be distributed to each installation of the Agent.

Place the adagent.port file into the Configure folder (previously created to contain the X.509
certificate).

Right-click the AccessDataAgent package installer file.

Select Show Package Contents popup menu item.

Ensure that the Configure folder is located in the same folder opened in Step 4 (alongside the
Contents folder).

Close the window.
Note: The installer will not run successfully if all of the above steps are not already completed. The
folder and file names must be exactly as documented

Additional Configuration Options
The Mac installer now supports the same settings as the Unix installer. Each setting should be added to the
.mpkg file in a directory called Configure..

Enterprise Mac Agent Configuration Options
Option

Result

- adagent.cert

Specifies the certificate file used for communication

- adagent.port

Specifies the port the agent will listen on. The setting should contain nothing more
than a number. The default port number is 3999

- adagent.lifetime

Specifies the amount of time before the agent dissolves. Again the file should contain
nothing more than a number. Same rules as for the linux agent about sign and value.
The default is 0.

adagent.connection
s

Sets the maximum number of concurrent connections allowed by the agent. The file
should contain only a number. The default is 10.

- adagent.size

Sets the protected storage area size. The file should contain only the number. The
default is 16777216. (16 MB).

Installing the Mac Agent

Configuring the AccessData Agent installer

| 506

Installing the Agent
When the certificate is bundled and the port configuration file is complete and saved, distribute the

AccessDataAgent package installer to each target computer and run it locally.

Uninstalling the Agent
The AccessData Agent can be uninstalled by double-clicking the uninstall utility located in /Library/

Application Support/AccessData. You will be required to enter your password; you must have administration
rights for the uninstall to complete correctly.
Note: The account must have a password assigned to it.

Installing the Mac Agent

Installing the Agent

| 507

Source Exif Data:

File Type                       : PDF
File Type Extension             : pdf
MIME Type                       : application/pdf
PDF Version                     : 1.6
Linearized                      : Yes
Author                          : mkeele
Create Date                     : 2014:05:09 10:54:41Z
Modify Date                     : 2014:05:09 11:13:00-06:00
XMP Toolkit                     : Adobe XMP Core 4.2.2-c063 53.352624, 2008/07/30-18:12:18
Producer                        : Acrobat Distiller 9.5.5 (Windows)
Creator Tool                    : FrameMaker 9.0
Metadata Date                   : 2014:05:09 11:13-06:00
Format                          : application/pdf
Title                           : FTK_User_Guide.book
Creator                         : mkeele
Document ID                     : uuid:7ae5252b-eaf3-433e-b23e-d37beda91ed6
Instance ID                     : uuid:e58c8eab-0a04-4a43-95de-b2c782e4bff7
Page Mode                       : UseOutlines
Page Count                      : 507

EXIF Metadata provided by EXIF.tools

FTK_User_Guide FTK UG

Ftk 5.3.4 User Guide FTK 5.3.4 User Guide FTK 5.3.4 User Guide ad

Ftk Ug FTK_UG FTK_UG 5.3.7 ftk ad

Ftk 5.3.3 Ug FTK 5.3.3 UG FTK 5.3.3 UG ad

Navigation menu

Versions of this User Manual:

Views

Navigation