Viewing Sorted Data
Posted by Jack H. Ward, Last modified by Jack H. Ward on 02 February 2018 09:07 AM
By default, sorted files/folders in the Data View pane and Case Content pane are marked in blue (sorted files) and purple (sorted files linked to a hash database) and they have the Yes value in the Sorted field on the Content Analysis tab of the Properties pane.
The Sorted Files viewer allows the user to view either sorted files for all case data (grouped by categories) or sorted files for a selected location.
To view sorted files corresponding to a selected location:
To select data only from some subfolders of the selected location:
To view all sorted files from the case:
Managing the Sorted Files Viewer
Use the button in the upper-right part of the pane to expand the Parameters pane. The parameters are the same as used in Sorted Files Search.
To view files with MD5 starting with some value, enter this value in the MD5 begins with field in the top of the screen and click Run Query.
To view files with filename starting with some value, enter this value in the Filename field in the top of the screen and click Run Query.
To view files whose extensions did not match the file header while sorting, select the Only files with extension mismatch option and click Run Query.
Files Linked to Hash Database
Files linked to the hash database (i.e., files whose MD5s are found in the hash database) are displayed in purple and have a link sign in the External Link column.
To view the link of a sorted file to the hash database, right-click the linked file (it will be purple) and select Show links. All hash databases that contain a sorted file MD5 will be displayed.
By default, there are 5,000 items displayed on the page.
To go to the next page, click Continue Query. To return, use the Previous page and First page buttons.
To define the number of items displayed on the page, enter the corresponding value in the Items on page field and click Run Query.
Click Stop Query to stop receiving the results. After this, you can move between the generated pages using Previous page, Next page, Last page, and First page buttons.