Exporting Images from Chat Database Evidence
Posted by Jack H. Ward, Last modified by Jack H. Ward on 29 January 2018 06:55 AM

Some chat database evidence, such as Hello databases, can include images which can be exported.

A <exported image name>.md5 file is created for each exported image. It is placed in the same folder as the exported image and contains the MD5 value of the file.

 To export an image:

1. Select the Thumbnails node in the Case Content.
2. Select the image in the Data View pane or in the Thumbnails.
3. Right-click and select Export.
4. Select whether you want to save the files to a folder or to an encrypted forensic container. Enter the exported files location or click Browse to navigate to it. Define the password for a forensic container if you have chosen to export the files there.
5. The export process starts. Its status is displayed in the Tasks pane, where it can be stopped, paused, or started.

(0 vote(s))
Not helpful

Comments (0)