sleuthkit-users

[sleuthkit-users] Showing HEX or ASCII in Autopsy?????

[Rich T. <te...@ya...>]

Howdy,

I am working a web email case.  When I look at the web
pages or fragments in Autopsy - sometimes they show in
ASCII and sometimes they show in garblygook which
looks like HEX.  The files are live files in the
directory and $MFT (Win XP machine) - show one would
think they should show, right...

example: looking at showmsg[1].htm  - looks fine
                    showmsg[4].htm  - looks fine
                    showmsg[6].htm  - junk
                    showmsg[9].htm  - junk
                    showmsg[11].htm - looks fine

could this be right, or is this a bug.  Using
Sleuthkit-1.72 and Autopsy-2.03 on RH9 using Gnome and
Mozilla.

If this could be normal and I'm being a retard, then
set me straight and help me untard!

Thanks in advance,
Rich

Re: [sleuthkit-users] Showing HEX or ASCII in Autopsy?????

[Brian C. <ca...@sl...>]

On Sep 21, 2004, at 9:09 PM, Rich Thompson wrote:
> I am working a web email case.  When I look at the web
> pages or fragments in Autopsy - sometimes they show in
> ASCII and sometimes they show in garblygook which
> looks like HEX.  The files are live files in the
> directory and $MFT (Win XP machine) - show one would
> think they should show, right...
>
> example: looking at showmsg[1].htm  - looks fine
>                     showmsg[4].htm  - looks fine
>                     showmsg[6].htm  - junk
>                     showmsg[9].htm  - junk
>                     showmsg[11].htm - looks fine

What 'File Type' is being reported for the "junk" files.  If you change 
to the "Metadata" mode for those files, are they resident or 
non-resident?  I know that some of the free e-mail sites cause cached 
files to be gziped.

brian