Knowledgebase:
File/Folder Exporting
Posted by Jack H. Ward, Last modified by Jack H. Ward on 29 January 2018 04:31 AM

Exporting files (folders) means making a forensic copy on a computer with installed Electronic Evidence Examiner.

File exporting can be performed only for filesystem evidence, archive evidence, E3 mobile data case evidence, Forensic Container evidence, images in Chat databases and Internet Browser Data evidence, iTunes backup evidence, SQLite database evidence, Xbox evidence, and attachments in mailstorage evidence.

A summary.md5 file is created for each exported folder. It is placed in the exported folder and contains a list of all exported files stored in the folder and their MD5 hash codes.

An <exported file name>.md5 file is created when files are exported. It is placed in the same folder as the exported file and contains its MD5.

To export a file:

1.Select it in the Data View.

2. Right-click and select Export or click Export on the Export tab, in the Common Export group.
3. On the Export Options window, define the exporting options.

  • Export to folder: Click this option if you want to exportfile(s) to a folder.
  • Export to forensic container: Click this option if you want to export file(s) to an encrypted forensic container.
  • Destination Path: Define the location of the exported data. Click Browse to navigate to the required location.
  • Password: Enter the password defined during the forensic container creation (required if Export to forensic container is selected). 


4. Click Export.
5. The export process starts. Its status is displayed in the Tasks pane, where it can be stopped, paused, or started.

To export a folder:

1. Select the folder in the Data View pane or in the Case Content.

2. Right-click and select Export, or click Export on the Export tab, in the Common Export.
3. Define the Exporting Options and destination. The following export options are available:

  • Export type:
    • Recursive: If this option is selected, the folder will be exported with all its subfolders.
    • Non recursive: If this option is selected, only files stored directly in the folder will be exported and the subfolder contents will not be exported.
  • Export to:
    • Export to folder: If this option is selected, the data will be exported to a folder.
    • Export to forensic container: If this option is selected, the data will be exported to an encrypted forensic container.
  • Destination:
    • Destination Path: Defines the location of the exported data. Click Browse to navigate to the required location.
    • Password: Enter the password defined during the forensic container creation (required if Export to forensic container is selected).


4. Click Export.
5. The export process starts. Its status is displayed in the Tasks pane, where it can be stopped, paused, or started.


Attachments 
 
 Folder and File exporting.png (8.61 KB)
 Export Options.png (10.37 KB)
(0 vote(s))
Helpful
Not helpful

Comments (0)