Re: [sleuthkit-users] autopsy 3.1 - incogrous result in parsing ewf image of a apple partition

[Jason L. <jle...@ba...>]

Hi Alessandro - 

There is a difference between the views node and the mismatch results.  Currently, the views node purely uses the extensions of files to show its results.  We'll better adjust those results in the future to take into account signatures that have been detected.

Jason






------------------------------------------------

Jason Letourneau
Product Manager, Digital Forensics
Basis Technology
jle...@ba...
617-386-2000 ext. 152




On Sep 23, 2014, at 9:48 AM, Alessandro Farina <at...@gm...> wrote:

> Hi 
> I'm testing the last version on some macbook images.
> Analysing the result I've found a out of sync between two branch of the tree.
> In the branch "Images" of the "Views" folder I found not listed any image, while in the module of the extension mismatch I found thousand of images.
> The Exif analysis is (almost, I cannot check the number of images precisely) correct showing some thousands of result.
> 
> Regards
> Alessandro
> ------------------------------------------------------------------------------
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org