Re: [sleuthkit-users] Showing HEX or ASCII in Autopsy?????

[Brian C. <ca...@sl...>]

On Sep 21, 2004, at 9:09 PM, Rich Thompson wrote:
> I am working a web email case.  When I look at the web
> pages or fragments in Autopsy - sometimes they show in
> ASCII and sometimes they show in garblygook which
> looks like HEX.  The files are live files in the
> directory and $MFT (Win XP machine) - show one would
> think they should show, right...
>
> example: looking at showmsg[1].htm  - looks fine
>                     showmsg[4].htm  - looks fine
>                     showmsg[6].htm  - junk
>                     showmsg[9].htm  - junk
>                     showmsg[11].htm - looks fine

What 'File Type' is being reported for the "junk" files.  If you change 
to the "Metadata" mode for those files, are they resident or 
non-resident?  I know that some of the free e-mail sites cause cached 
files to be gziped.

brian