In this short How To video, digital forensic specialist Rich Frawley, will show you how to collect and share digital evidence files with prosecutors and third parties using ADF Software. This video is ideal for learning how to share evidence with prosecutors for review.
If you are tasked with the collecting specific files or collecting all files from a specific location, ADF digital forensic software makes this fast and easy. Collecting and sharing evidence can be useful
This lesson is helpful if, for instance, if you have a need to collect only PDF files from a specific computer or collect all files from a specific User Profile. You can accomplish this by creating a Capture to meet the specific requirements and then export the files in the ADF Stand Alone Portable viewer for analysis or review by another party. Note that ADF report viewers do not require an ADF license to review the files.
To create a New File Collection Capture, got to Setup Scans from the main screen. Click on New Profile, New Capture, and then Collect Files. On this screen you will define the files to collect.
Pick a File Type: it is possible to specify which file types to include in your search. Searches for All Files or Specific Files are available. It is possible to add multiple specific file types. If the file type required does not exist it is possible to create one by clicking on View on any File Type group and then following the instructions within the Adding a Custom File Type Section. In this example we are going to collect all PDF files from the Users Profiles.
Select the Capture Options:
Use thorough identification for files without extensions since that capture uses file signature analysis to identify files that have no file extension and fast identification on those that do. Thorough identification for all files uses file signature analysis to identify all files. Note: This will increase the time the scan takes to run.
Search selected file types in -
Next is File Properties where we can set specific parameters based on file properties for the File Collection:
And then...
Select the File Source options:
Entire file system Searches all live files
When all selections are made, select Save and the File Capture is created and available in any Search Profile to be used in conjunction with other Artifact and File Captures or alone as a stand alone File Capture.
When you want to collect all files from a specific location. In this example we'll demonstrate collecting all files from the User Rich Jr. To begin, Select or Create a Capture Group and Capture Name. Select All Files and then Targeted Folders. Add the path to collect all the files from: /users/Rich Jr/.* (for example).
When all selections are made, hit save and the file capture is created and available in any Search Profile to be used in conjunction with other Artifact and File Captures or alone as a stand alone File Capture.
Select Report → Stand Alone Viewer → Export
The entire scan results are now available for review and analysis by a prosecutor, another investigator, or another person.