case:FT-SS-07-Norm
engine:Indexed
dataset:UNIX
tool:Autopsy
version:4.6
tester:JRL
host:Hathor
date:2018-08-08 16:08:02
active_hit:2993 LIVE-NFC-tomorrow-ext4-utf-8.txt
active_hit:2994 LIVE-NFC-tomorrow-ext4-utf-16-le.txt
active_hit:2995 LIVE-NFC-tomorrow-ext4-utf-16-be.txt
active_hit:3001 LIVE-NFC-tomorrow-osxj-utf-8.txt
active_hit:3002 LIVE-NFC-tomorrow-osxj-utf-16-le.txt
active_hit:3003 LIVE-NFC-tomorrow-osxj-utf-16-be.txt
active_hit:3009 LIVE-NFC-tomorrow-osxc-utf-8.txt
active_hit:3010 LIVE-NFC-tomorrow-osxc-utf-16-le.txt
active_hit:3011 LIVE-NFC-tomorrow-osxc-utf-16-be.txt
active_hit:3017 LIVE-NFC-tomorrow-apfs-utf-8.txt
active_hit:3057 LIVE-NFC-freedom-ext4-utf-8.txt
active_hit:3058 LIVE-NFC-freedom-ext4-utf-16-le.txt
active_hit:3059 LIVE-NFC-freedom-ext4-utf-16-be.txt
active_hit:3065 LIVE-NFC-freedom-osxj-utf-8.txt
active_hit:3066 LIVE-NFC-freedom-osxj-utf-16-le.txt
active_hit:3067 LIVE-NFC-freedom-osxj-utf-16-be.txt
active_hit:3073 LIVE-NFC-freedom-osxc-utf-8.txt
active_hit:3074 LIVE-NFC-freedom-osxc-utf-16-le.txt
active_hit:3075 LIVE-NFC-freedom-osxc-utf-16-be.txt
active_hit:3081 LIVE-NFC-freedom-apfs-utf-8.txt
active_hit:3082 LIVE-NFC-freedom-apfs-utf-16-le.txt
active_hit:3083 LIVE-NFC-freedom-apfs-utf-16-be.txt
active_hit:3121 LIVE-NFC-mice-ext4-utf-8.txt
active_hit:3122 LIVE-NFC-mice-ext4-utf-16-le.txt
active_hit:3123 LIVE-NFC-mice-ext4-utf-16-be.txt
active_hit:3129 LIVE-NFC-mice-osxj-utf-8.txt
active_hit:3130 LIVE-NFC-mice-osxj-utf-16-le.txt
active_hit:3131 LIVE-NFC-mice-osxj-utf-16-be.txt
active_hit:3137 LIVE-NFC-mice-osxc-utf-8.txt
active_hit:3138 LIVE-NFC-mice-osxc-utf-16-le.txt
active_hit:3139 LIVE-NFC-mice-osxc-utf-16-be.txt
active_hit:3145 LIVE-NFC-mice-apfs-utf-8.txt
active_hit:3185 LIVE-NFD-tomorrow-ext4-utf-8.txt
active_hit:3186 LIVE-NFD-tomorrow-ext4-utf-16-le.txt
active_hit:3187 LIVE-NFD-tomorrow-ext4-utf-16-be.txt
active_hit:3193 LIVE-NFD-tomorrow-osxj-utf-8.txt
active_hit:3194 LIVE-NFD-tomorrow-osxj-utf-16-le.txt
active_hit:3195 LIVE-NFD-tomorrow-osxj-utf-16-be.txt
active_hit:3201 LIVE-NFD-tomorrow-osxc-utf-8.txt
active_hit:3202 LIVE-NFD-tomorrow-osxc-utf-16-le.txt
active_hit:3203 LIVE-NFD-tomorrow-osxc-utf-16-be.txt
active_hit:3249 LIVE-NFD-freedom-ext4-utf-8.txt
active_hit:3250 LIVE-NFD-freedom-ext4-utf-16-le.txt
active_hit:3251 LIVE-NFD-freedom-ext4-utf-16-be.txt
active_hit:3257 LIVE-NFD-freedom-osxj-utf-8.txt
active_hit:3258 LIVE-NFD-freedom-osxj-utf-16-le.txt
active_hit:3259 LIVE-NFD-freedom-osxj-utf-16-be.txt
active_hit:3265 LIVE-NFD-freedom-osxc-utf-8.txt
active_hit:3266 LIVE-NFD-freedom-osxc-utf-16-le.txt
active_hit:3267 LIVE-NFD-freedom-osxc-utf-16-be.txt
active_hit:3313 LIVE-NFD-mice-ext4-utf-8.txt
active_hit:3314 LIVE-NFD-mice-ext4-utf-16-le.txt
active_hit:3315 LIVE-NFD-mice-ext4-utf-16-be.txt
active_hit:3321 LIVE-NFD-mice-osxj-utf-8.txt
active_hit:3322 LIVE-NFD-mice-osxj-utf-16-le.txt
active_hit:3323 LIVE-NFD-mice-osxj-utf-16-be.txt
active_hit:3329 LIVE-NFD-mice-osxc-utf-8.txt
active_hit:3330 LIVE-NFD-mice-osxc-utf-16-le.txt
active_hit:3331 LIVE-NFD-mice-osxc-utf-16-be.txt
active_hit:3376 LIVE-AndBeyond-ext4-ascii.txt
active_hit:3377 LIVE-AndBeyond-ext4-utf-8.txt
active_hit:3378 LIVE-AndBeyond-ext4-utf-16-le.txt
active_hit:3379 LIVE-AndBeyond-ext4-utf-16-be.txt
active_hit:3384 LIVE-AndBeyond-osxj-ascii.txt
active_hit:3385 LIVE-AndBeyond-osxj-utf-8.txt
active_hit:3386 LIVE-AndBeyond-osxj-utf-16-le.txt
active_hit:3387 LIVE-AndBeyond-osxj-utf-16-be.txt
active_hit:3392 LIVE-AndBeyond-osxc-ascii.txt
active_hit:3393 LIVE-AndBeyond-osxc-utf-8.txt
active_hit:3394 LIVE-AndBeyond-osxc-utf-16-le.txt
active_hit:3395 LIVE-AndBeyond-osxc-utf-16-be.txt
active_hit:3400 LIVE-AndBeyond-apfs-ascii.txt
active_hit:3401 LIVE-AndBeyond-apfs-utf-8.txt
active_hit:3402 LIVE-AndBeyond-apfs-utf-16-le.txt
active_hit:3403 LIVE-AndBeyond-apfs-utf-16-be.txt
active_hit:3441 LIVE-LigatureAndBeyond-ext4-utf-8.txt
active_hit:3442 LIVE-LigatureAndBeyond-ext4-utf-16-le.txt
active_hit:3443 LIVE-LigatureAndBeyond-ext4-utf-16-be.txt
active_hit:3449 LIVE-LigatureAndBeyond-osxj-utf-8.txt
active_hit:3450 LIVE-LigatureAndBeyond-osxj-utf-16-le.txt
active_hit:3451 LIVE-LigatureAndBeyond-osxj-utf-16-be.txt
active_hit:3457 LIVE-LigatureAndBeyond-osxc-utf-8.txt
active_hit:3458 LIVE-LigatureAndBeyond-osxc-utf-16-le.txt
active_hit:3459 LIVE-LigatureAndBeyond-osxc-utf-16-be.txt
deleted_hit:2997 DELETED-NFC-tomorrow-ext4-utf-8.txt
deleted_hit:3005 DELETED-NFC-tomorrow-osxj-utf-8.txt
deleted_hit:3013 DELETED-NFC-tomorrow-osxc-utf-8.txt
deleted_hit:3021 DELETED-NFC-tomorrow-apfs-utf-8.txt
deleted_hit:3061 DELETED-NFC-freedom-ext4-utf-8.txt
deleted_hit:3062 DELETED-NFC-freedom-ext4-utf-16-le.txt
deleted_hit:3063 DELETED-NFC-freedom-ext4-utf-16-be.txt
deleted_hit:3069 DELETED-NFC-freedom-osxj-utf-8.txt
deleted_hit:3070 DELETED-NFC-freedom-osxj-utf-16-le.txt
deleted_hit:3071 DELETED-NFC-freedom-osxj-utf-16-be.txt
deleted_hit:3077 DELETED-NFC-freedom-osxc-utf-8.txt
deleted_hit:3078 DELETED-NFC-freedom-osxc-utf-16-le.txt
deleted_hit:3079 DELETED-NFC-freedom-osxc-utf-16-be.txt
deleted_hit:3085 DELETED-NFC-freedom-apfs-utf-8.txt
deleted_hit:3086 DELETED-NFC-freedom-apfs-utf-16-le.txt
deleted_hit:3087 DELETED-NFC-freedom-apfs-utf-16-be.txt
deleted_hit:3125 DELETED-NFC-mice-ext4-utf-8.txt
deleted_hit:3133 DELETED-NFC-mice-osxj-utf-8.txt
deleted_hit:3141 DELETED-NFC-mice-osxc-utf-8.txt
deleted_hit:3149 DELETED-NFC-mice-apfs-utf-8.txt
deleted_hit:3380 DELETED-AndBeyond-ext4-ascii.txt
deleted_hit:3381 DELETED-AndBeyond-ext4-utf-8.txt
deleted_hit:3382 DELETED-AndBeyond-ext4-utf-16-le.txt
deleted_hit:3383 DELETED-AndBeyond-ext4-utf-16-be.txt
deleted_hit:3388 DELETED-AndBeyond-osxj-ascii.txt
deleted_hit:3389 DELETED-AndBeyond-osxj-utf-8.txt
deleted_hit:3390 DELETED-AndBeyond-osxj-utf-16-le.txt
deleted_hit:3391 DELETED-AndBeyond-osxj-utf-16-be.txt
deleted_hit:3396 DELETED-AndBeyond-osxc-ascii.txt
deleted_hit:3397 DELETED-AndBeyond-osxc-utf-8.txt
deleted_hit:3398 DELETED-AndBeyond-osxc-utf-16-le.txt
deleted_hit:3399 DELETED-AndBeyond-osxc-utf-16-be.txt
deleted_hit:3404 DELETED-AndBeyond-apfs-ascii.txt
deleted_hit:3405 DELETED-AndBeyond-apfs-utf-8.txt
deleted_hit:3406 DELETED-AndBeyond-apfs-utf-16-le.txt
deleted_hit:3407 DELETED-AndBeyond-apfs-utf-16-be.txt
n_active_targets:100
n_active_hits:84
n_deleted_targets:100
n_deleted_hits:36
n_unalloc_targets:0
n_unalloc_hits:0
comments:
Tool did not normalize the search string.
Search strings entered in NFC form found all targets in active files and deleted files and all targets located in unallocated space if encoded in UTF-8, but sometimes targets encoded in UTF-16 were missed.
Search strings entered in NFD form found all targets in active files, no targets located in unallocated space were found.
Search results were the same if the combining characters (or ligature) are replaced with a regular expression of mathc any character.