Viewing Evidence
Posted by Jack H. Ward on 16 January 2017 10:02 AM

Evidence structure can be viewed in the Case Content pane.
Evidence content can be viewed in the Data View pane.
Content of email messages can be viewed in the special Email data pane.
Content of chat databases can be viewed in the special RTF viewer.
Content of files in the filesystem and archive evidence as well as content of files attached to emails can be viewed in the Text viewer, Hex viewer, and File viewer.
If evidence contains data that belongs to a different evidence type (e.g., an archive in an email message or a chat database on a disk image), this data will be parsed as if it is added as separate evidence.

Electronic Evidence Examiner displays file size in bytes. When the same file is viewed in Windows, it is displayed in Kbytes, so the sizes may seem different. Divide the file size displayed in Electronic Evidence Examiner by 1024, and you will get the size displayed in Windows.
(0 vote(s))
Not helpful

Comments (0)