This step allows the user to define exactly what will be exported, what properties will be included, etc.
This page is not available if the Don't include file system evidence checkbox on the Filesystem types page is selected.
Properties of the Included Files:
Each file in the File system evidence has properties that are displayed in the Properties pane.
To define which file properties will be added to the report, select the required category in the Category list and select the required file system properties in the list to the right. In the Category list, select only the file system(s) evidence added to Electronic Evidence Examiner. If the selected file system evidence is not added to Electronic Evidence Examiner, selected properties will not be added to the report.
Select this check box to set the date parameters for the searched data.
To set the date parameters:
1. Click the Add Filter.
2. A new filter is added.
3. In the Operator column, select the necessary operator. The following operators are available:
4. In the Type of Date column, select the type for the date. The following types are available:
- AND: All search results will match this condition.
- OR: The search result can match this or any other condition.
- AND NOT: All search results will not match this condition.
- OR NOT: Some search results will match this condition.
5. In the From and To columns, select the date in the drop-down Calendar or simply enter its new value in the field.
- Any data between: Locates all data that was created, modified, accessed, or changed during the specified date range.
- Created between: Locates items created during the specified date range.
- Modified between: Locates items whose contents were modified during the specified date range.
- Last accessed between: Locates items that were last accessed during the specified date range.
- Last changed between: Locates items whose MFT records were changed between the specified period of time (available only for NTFS file system).
To remove the filter, select it in the table and click the Remove Filter(s) button.
Multi-selection is available.
- Include EXIF information: If this option is selected, additional properties of the image made by digital camera or scanner will be added to the description of the graphic files.
- Include graphic files as thumbnails: If this option is selected, thumbnails will be added to the description of the graphic files.
- Include NTFS/STFS attributes: If this option is selected, the attributes of the parsed NTFS/STFS files will be added to the report.