sleuthkit-users

[sleuthkit-users] autopsy 3.1 - incogrous result in parsing ewf image of a apple partition

[Alessandro F. <at...@gm...>]

Hi
I'm testing the last version on some macbook images.
Analysing the result I've found a out of sync between two branch of the
tree.
In the branch "Images" of the "Views" folder I found not listed any image,
while in the module of the extension mismatch I found thousand of images.
The Exif analysis is (almost, I cannot check the number of images
precisely) correct showing some thousands of result.

Regards
Alessandro

Re: [sleuthkit-users] autopsy 3.1 - incogrous result in parsing ewf image of a apple partition

[Jason L. <jle...@ba...>]

Hi Alessandro - 

There is a difference between the views node and the mismatch results.  Currently, the views node purely uses the extensions of files to show its results.  We'll better adjust those results in the future to take into account signatures that have been detected.

Jason






------------------------------------------------

Jason Letourneau
Product Manager, Digital Forensics
Basis Technology
jle...@ba...
617-386-2000 ext. 152




On Sep 23, 2014, at 9:48 AM, Alessandro Farina <at...@gm...> wrote:

> Hi 
> I'm testing the last version on some macbook images.
> Analysing the result I've found a out of sync between two branch of the tree.
> In the branch "Images" of the "Views" folder I found not listed any image, while in the module of the extension mismatch I found thousand of images.
> The Exif analysis is (almost, I cannot check the number of images precisely) correct showing some thousands of result.
> 
> Regards
> Alessandro
> ------------------------------------------------------------------------------
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] autopsy 3.1 - incogrous result in parsing ewf image of a apple partition

[Alessandro F. <at...@gm...>]

Hi Jason
thanks for the answer, I had the same idea.
I think maybe it should only need to make a query for the "views node" that
includes also the mismatch results.
In my case could be useful to know that the mismatched extension is
"jpeg:DATA"

Regards
Alessandro

2014-09-24 21:24 GMT+02:00 Jason Letourneau <jle...@ba...>:

> Hi Alessandro -
>
> There is a difference between the views node and the mismatch results.
> Currently, the views node purely uses the extensions of files to show its
> results.  We'll better adjust those results in the future to take into
> account signatures that have been detected.
>
> Jason
>
>
>
>
>
>
> ------------------------------------------------
>
> Jason Letourneau
> Product Manager, Digital Forensics
> Basis Technology
> jle...@ba...
> 617-386-2000 ext. 152
>
>
>
>
> On Sep 23, 2014, at 9:48 AM, Alessandro Farina <at...@gm...> wrote:
>
> Hi
> I'm testing the last version on some macbook images.
> Analysing the result I've found a out of sync between two branch of the
> tree.
> In the branch "Images" of the "Views" folder I found not listed any image,
> while in the module of the extension mismatch I found thousand of images.
> The Exif analysis is (almost, I cannot check the number of images
> precisely) correct showing some thousands of result.
>
> Regards
> Alessandro
>
> ------------------------------------------------------------------------------
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
>
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>
>

Re: [sleuthkit-users] autopsy 3.1 - incogrous result in parsing ewf image of a apple partition

[Brian C. <ca...@sl...>]

Hi Alessandro,

So, you are saying that the files have an extension of ".jpeg:DATA" and therefore it is not being shown in the Views area and is coming up as a mismatch?

thanks,
brian


On Sep 26, 2014, at 1:34 PM, Alessandro Farina <at...@gm...> wrote:

> Hi Jason
> thanks for the answer, I had the same idea.
> I think maybe it should only need to make a query for the "views node" that includes also the mismatch results.
> In my case could be useful to know that the mismatched extension is "jpeg:DATA"
> 
> Regards
> Alessandro
> 
> 2014-09-24 21:24 GMT+02:00 Jason Letourneau <jle...@ba...>:
> Hi Alessandro - 
> 
> There is a difference between the views node and the mismatch results.  Currently, the views node purely uses the extensions of files to show its results.  We'll better adjust those results in the future to take into account signatures that have been detected.
> 
> Jason
> 
> 
> 
> 
> 
> 
> ------------------------------------------------
> 
> Jason Letourneau
> Product Manager, Digital Forensics
> Basis Technology
> jle...@ba...
> 617-386-2000 ext. 152
> 
> 
> 
> 
> On Sep 23, 2014, at 9:48 AM, Alessandro Farina <at...@gm...> wrote:
> 
>> Hi 
>> I'm testing the last version on some macbook images.
>> Analysing the result I've found a out of sync between two branch of the tree.
>> In the branch "Images" of the "Views" folder I found not listed any image, while in the module of the extension mismatch I found thousand of images.
>> The Exif analysis is (almost, I cannot check the number of images precisely) correct showing some thousands of result.
>> 
>> Regards
>> Alessandro
>> ------------------------------------------------------------------------------
>> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
>> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
>> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
>> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
>> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk_______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
> 
> 
> ------------------------------------------------------------------------------
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] autopsy 3.1 - incogrous result in parsing ewf image of a apple partition

[Alessandro F. <at...@gm...>]

Exactly, Brian.
The images are listes as "jpeg images" in "extension mismatch", and are not
listed in "views".
If you can point me to the db design schema, I could help in traking the
problem in the data.
Regards
Alessandro

2014-09-30 17:35 GMT+02:00 Brian Carrier <ca...@sl...>:

> Hi Alessandro,
>
> So, you are saying that the files have an extension of ".jpeg:DATA" and
> therefore it is not being shown in the Views area and is coming up as a
> mismatch?
>
> thanks,
> brian
>
>
> On Sep 26, 2014, at 1:34 PM, Alessandro Farina <at...@gm...> wrote:
>
> > Hi Jason
> > thanks for the answer, I had the same idea.
> > I think maybe it should only need to make a query for the "views node"
> that includes also the mismatch results.
> > In my case could be useful to know that the mismatched extension is
> "jpeg:DATA"
> >
> > Regards
> > Alessandro
> >
> > 2014-09-24 21:24 GMT+02:00 Jason Letourneau <jle...@ba...>:
> > Hi Alessandro -
> >
> > There is a difference between the views node and the mismatch results.
> Currently, the views node purely uses the extensions of files to show its
> results.  We'll better adjust those results in the future to take into
> account signatures that have been detected.
> >
> > Jason
> >
> >
> >
> >
> >
> >
> > ------------------------------------------------
> >
> > Jason Letourneau
> > Product Manager, Digital Forensics
> > Basis Technology
> > jle...@ba...
> > 617-386-2000 ext. 152
> >
> >
> >
> >
> > On Sep 23, 2014, at 9:48 AM, Alessandro Farina <at...@gm...>
> wrote:
> >
> >> Hi
> >> I'm testing the last version on some macbook images.
> >> Analysing the result I've found a out of sync between two branch of the
> tree.
> >> In the branch "Images" of the "Views" folder I found not listed any
> image, while in the module of the extension mismatch I found thousand of
> images.
> >> The Exif analysis is (almost, I cannot check the number of images
> precisely) correct showing some thousands of result.
> >>
> >> Regards
> >> Alessandro
> >>
> ------------------------------------------------------------------------------
> >> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> >> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> >> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> >> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
> >>
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk_______________________________________________
> >> sleuthkit-users mailing list
> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> >> http://www.sleuthkit.org
> >
> >
> >
> ------------------------------------------------------------------------------
> > Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> > Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> > Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> > Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk_______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>
>