User Manual - Forensic Explorer Home

1 user Manual Published: 12-Mar-15 at 09:36:51 Chapter Contents Published: 12-Mar-15 at 09:36:48 Chapter 1 - Introduction .. 11 Introducing Forensic Explorer .. 12 Supported file formats .. 12 Supported file systems .. 12 Key program features .. 13 Chapter 2 - 30 Day Evaluation Version .. 15 30 day evaluation 16 Activating the 30 day evaluation version .. 16 Chapter 3 - Purchase .. 23 Purchase .. 24 License maintenance .. 25 Chapter 4 - Installation .. 27 System requirements .. 29 Download .. 29 Installation .. 29 Uninstall Forensic Explorer .. 34 Chapter 5 - Dongle Activation .. 35 Dongle activation of the purchased version.

2 36 Activate a Remote Computer .. 40 Applying maintenance updates to your Wibu dongle .. 42 Chapter 6 - Forensic Acquisition .. 43 Write block .. 44 GetData s Forensic Imager .. 45 Chapter 7 - Forensic Explorer Interface .. 55 Modules .. 56 4 | P a g e Copyright GetData Forensics Pty Ltd 2010 - 2015, All rights reserved. Module data views .. 59 Customizing layouts .. 61 Task Processes List .. 62 Process Logging and Priority .. 63 Reference Library .. 64 Chapter 8 - Data 69 Data views summary .. 71 Tree view .. 74 List view .. 77 Disk view .. 78 Gallery view .. 84 Hex view .. 86 Text view .. 88 Display view.

3 89 Byte Plot and Character Distribution .. 91 Filesystem Record view .. 96 File Metadata .. 98 File Extent .. 100 Chapter 9 - Working with data .. 101 Working with data .. 102 Highlighted and checked items .. 102 Add and edit bookmarks .. 104 Open with .. 104 Expand compound file .. 105 105 Send to Module .. 110 Columns .. 110 Sorting .. 111 5 | P a g e Copyright GetData Forensics Pty Ltd 2010 - 2014, All rights reserved. Flags .. 113 Filtering Data .. 114 Copy rows to clipboard .. 119 Chapter 10 - Evidence Module .. 121 Preview .. 122 New case .. 124 Open an existing case .. 127 Adding evidence.

4 129 Evidence Processor .. 135 Adding additional evidence to a case .. 139 Saving a case .. 140 Closing a case .. 141 Chapter 11 - File System Module .. 143 File System module .. 144 Toolbar .. 144 Folders view .. 144 Categories view .. 146 File List view .. 147 Other data views .. 149 Chapter 12 - Keyword Search Module .. 151 Keyword search .. 152 Keyword management .. 153 Search results .. 160 Keyword result list .. 162 Keyword search data views .. 163 Chapter 13 - Index Search Module .. 165 Index search .. 166 Considerations prior to creating an index .. 167 6 | P a g e Copyright GetData Forensics Pty Ltd 2010 - 2015, All rights reserved.

5 Creating an index .. 167 Searching an index .. 169 Search 172 Index Search Compound Files .. 173 Export Word List .. 173 Chapter 14 - Email Module .. 175 Email .. 176 Email module .. 176 Microsoft Outlook .PST email .. 176 Index Search the Email module .. 177 keyword Search the Email module .. 178 Chapter 15 - Registry Module .. 179 Registry module .. 180 Adding a REGISTRY FILE to the registry module .. 181 Registry Data Views .. 182 Deleted registry keys .. 183 Examining registry files using scripts .. 184 Chapter 16 - Bookmarks Module .. 187 Adding Bookmarks .. 188 Bookmarks Module .. 190 Identifying Bookmarked files other modules.

6 193 Chapter 17 - Reports Module .. 194 Reporting & Bookmarks .. 195 The Reports Module .. 196 ReportS Tree .. 197 Report Editor .. 201 Creating Reports .. 203 7 | P a g e Copyright GetData Forensics Pty Ltd 2010 - 2014, All rights reserved. Chapter 18 - Scripts Module .. 215 Scripts Module .. 216 Managing scripts in the scripts window .. 222 Introduction to Scripting .. 223 .. 227 Chapter 19 Custom Modules .. 231 About Custom Modules .. 232 Browser History Module .. 232 Phone Module .. 232 Chapter 20 - Date and Time .. 235 Date and time in computer forensics .. 236 FAT, HFS, CDFS file system date and time.

7 236 NTFS, HFS+ file system date and time .. 236 Date and time information in the Windows registry .. 236 Daylight saving time (DST) .. 240 Adjusting Date in Forensic Explorer .. 241 Chapter 21 - Hashing .. 245 Hash Values .. 246 Hash Algorithms .. 246 Acquisition Hash .. 246 Verification Hash .. 247 Hashing files in a case .. 248 Hash sets .. 251 Download Hash Sets .. 252 Creating hash sets .. 252 Apply a Hash Set in a Case .. 256 Chapter 22 - File Signature Analysis .. 259 File signature analysis .. 260 8 | P a g e Copyright GetData Forensics Pty Ltd 2010 - 2015, All rights reserved. Why run file signature analysis?

8 260 Running a file signature analysis .. 260 Examine the results of a file signature analysis .. 262 Chapter 23 - Data Recovery .. 263 DATA Recovery - Overview .. 264 FAT data recovery .. 265 NTFS data recovery .. 272 File carving .. 276 Chapter 24 - RAID .. 281 RAID - Introduction .. 282 Preparation .. 282 Adding a RAID to a case .. 283 Chapter 25 Shadow Copy .. 287 Shadow Copy Introduction .. 288 Examining Shadow Copies With Forensic Explorer .. 293 Chapter 26 Mount Image Pro .. 297 Mount Image Pro .. 298 Chapter 27 Live Boot .. 301 Live Boot .. 302 Requirements .. 302 Compatibility .. 304 Live Boot Working Folder.

9 304 How to Live Boot a Forensic 305 Live Boot and Windows user Passwords .. 310 TroubleShooting Live Boot .. 313 Chapter 28 Working With .. 315 ITunes Backups .. 316 Thumbnails .. 326 9 | P a g e Copyright GetData Forensics Pty Ltd 2010 - 2014, All rights reserved. Thumbnail in Forensic Explorer .. 327 Chapter 29 - Legal .. 331 This user 332 Copyright .. 332 License agreement .. 332 Disclaimer .. 334 Appendix 1 - Technical Support .. 335 Appendix 2 - Write Blocking .. 337 Appendix 3 - File carving .. 339 Appendix 4 - Summary of Date and Time .. 345 Appendix 5 - References .. 347 Appendix 6 - Definitions.

10 351 Appendix 7 - Sample Script .. 363 Appendix 8 - Icon Key .. 365 Appendix 9 - Index .. 367 C h a p t e r 1 - I n t r o d u c t i o n 11 | P a g e Copyright GetData Forensics Pty Ltd 2010 - 2014, All rights reserved. Chapter 1 - Introduction In This Chapter C HAPT ER 1 - I N T RODUC T I ON Introducing Forensic Explorer .. 12 Supported file formats .. 12 Supported file systems .. 12 Key program features .. 13 12 | P a g e C h a p t e r 1 - I n t r o d u c t i o n Copyright GetData Forensics Pty Ltd 2010 - 2015, All rights reserved. I N T RODUC IN G FOREN SIC EX PLORER Forensic Explorer is a computer forensics software program written by GetData Forensics Pty Ltd ( ).