Knowledgebase:
Viewing File History Data
Posted by Jack H. Ward on 09 July 2019 11:46 AM

Electronic Evidence Examiner detects the File History configuration on the investigated computer. This allows you to find the location of backup files for Contacts, Desktop, Downloads, Favorites, Searches etc. and analyze them.

NOTE: The File History data is only available when the File History is enabled on the investigated computer.

To view the detected File History data:
1. Add a logical/physical drive or logical/physical drive image to the case.
2. In the Case Content pane, select the Data Triage node and select the File History sub-node.
3. In the Data View pane, open the Configuration folder.
4. To view the File History data, open the Config#.xml file.

The content of the Config#.xml file can be viewed in the File Viewer. Such file contains information on the files saved to the File History folder, as well as information on their location.

(0 vote(s))
Helpful
Not helpful

Comments (0)