case:FT-SS-07-CJK-char
engine:Indexed
dataset:Windows
tool:Autopsy
version:4.6
tester:JRL
host:Hathor
date:2018-08-14 13:08:11
active_hit:1985 LIVE-NewChina-fat-utf-8.txt
active_hit:1986 LIVE-NewChina-fat-utf-16-le.txt
active_hit:1987 LIVE-NewChina-fat-utf-16-be.txt
active_hit:1993 LIVE-NewChina-exfat-utf-8.txt
active_hit:1994 LIVE-NewChina-exfat-utf-16-le.txt
active_hit:1995 LIVE-NewChina-exfat-utf-16-be.txt
active_hit:2001 LIVE-NewChina-ntfs-utf-8.txt
active_hit:2002 LIVE-NewChina-ntfs-utf-16-le.txt
active_hit:2003 LIVE-NewChina-ntfs-utf-16-be.txt
active_hit:2881 LIVE-Tokyo-fat-utf-8.txt
active_hit:2882 LIVE-Tokyo-fat-utf-16-le.txt
active_hit:2883 LIVE-Tokyo-fat-utf-16-be.txt
active_hit:2889 LIVE-Tokyo-exfat-utf-8.txt
active_hit:2890 LIVE-Tokyo-exfat-utf-16-le.txt
active_hit:2891 LIVE-Tokyo-exfat-utf-16-be.txt
active_hit:2897 LIVE-Tokyo-ntfs-utf-8.txt
active_hit:2898 LIVE-Tokyo-ntfs-utf-16-le.txt
active_hit:2899 LIVE-Tokyo-ntfs-utf-16-be.txt
deleted_hit:1989 DELETED-NewChina-fat-utf-8.txt
deleted_hit:1990 DELETED-NewChina-fat-utf-16-le.txt
deleted_hit:1991 DELETED-NewChina-fat-utf-16-be.txt
deleted_hit:1997 DELETED-NewChina-exfat-utf-8.txt
deleted_hit:1998 DELETED-NewChina-exfat-utf-16-le.txt
deleted_hit:1999 DELETED-NewChina-exfat-utf-16-be.txt
deleted_hit:2005 DELETED-NewChina-ntfs-utf-8.txt
deleted_hit:2006 DELETED-NewChina-ntfs-utf-16-le.txt
deleted_hit:2007 DELETED-NewChina-ntfs-utf-16-be.txt
deleted_hit:2885 DELETED-Tokyo-fat-utf-8.txt
deleted_hit:2886 DELETED-Tokyo-fat-utf-16-le.txt
deleted_hit:2887 DELETED-Tokyo-fat-utf-16-be.txt
deleted_hit:2893 DELETED-Tokyo-exfat-utf-8.txt
deleted_hit:2894 DELETED-Tokyo-exfat-utf-16-le.txt
deleted_hit:2895 DELETED-Tokyo-exfat-utf-16-be.txt
deleted_hit:2901 DELETED-Tokyo-ntfs-utf-8.txt
deleted_hit:2902 DELETED-Tokyo-ntfs-utf-16-le.txt
deleted_hit:2903 DELETED-Tokyo-ntfs-utf-16-be.txt
unalloc_hit:2009 500516033 977570 中国 utf-8
unalloc_hit:2905 500630703 977794 東京 utf-8
n_active_targets:18
n_active_hits:18
n_deleted_targets:18
n_deleted_hits:18
n_unalloc_targets:6
n_unalloc_hits:2
comments:
Search target 中国 strings encoded as UTF-8 and located in deleted files are reported twice, once from the deleted file and again as from unallocated storage.