Re: [sleuthkit-users] autopsy 3.1 - incogrous result in parsing ewf image of a apple partition

[Alessandro F. <at...@gm...>]

Hi Jason
thanks for the answer, I had the same idea.
I think maybe it should only need to make a query for the "views node" that
includes also the mismatch results.
In my case could be useful to know that the mismatched extension is
"jpeg:DATA"

Regards
Alessandro

2014-09-24 21:24 GMT+02:00 Jason Letourneau <jle...@ba...>:

> Hi Alessandro -
>
> There is a difference between the views node and the mismatch results.
> Currently, the views node purely uses the extensions of files to show its
> results.  We'll better adjust those results in the future to take into
> account signatures that have been detected.
>
> Jason
>
>
>
>
>
>
> ------------------------------------------------
>
> Jason Letourneau
> Product Manager, Digital Forensics
> Basis Technology
> jle...@ba...
> 617-386-2000 ext. 152
>
>
>
>
> On Sep 23, 2014, at 9:48 AM, Alessandro Farina <at...@gm...> wrote:
>
> Hi
> I'm testing the last version on some macbook images.
> Analysing the result I've found a out of sync between two branch of the
> tree.
> In the branch "Images" of the "Views" folder I found not listed any image,
> while in the module of the extension mismatch I found thousand of images.
> The Exif analysis is (almost, I cannot check the number of images
> precisely) correct showing some thousands of result.
>
> Regards
> Alessandro
>
> ------------------------------------------------------------------------------
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
>
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>
>