case:FT-SS-07-Latin
engine:Indexed
dataset:Windows
tool:Autopsy
version:4.6
tester:JRL
host:Hathor
date:2018-08-14 10:08:10
active_hit:2497 LIVE-Beauty-fat-utf-8.txt
active_hit:2498 LIVE-Beauty-fat-utf-16-le.txt
active_hit:2499 LIVE-Beauty-fat-utf-16-be.txt
active_hit:2505 LIVE-Beauty-exfat-utf-8.txt
active_hit:2506 LIVE-Beauty-exfat-utf-16-le.txt
active_hit:2507 LIVE-Beauty-exfat-utf-16-be.txt
active_hit:2513 LIVE-Beauty-ntfs-utf-8.txt
active_hit:2514 LIVE-Beauty-ntfs-utf-16-le.txt
active_hit:2515 LIVE-Beauty-ntfs-utf-16-be.txt
active_hit:2689 LIVE-Boy-fat-utf-8.txt
active_hit:2690 LIVE-Boy-fat-utf-16-le.txt
active_hit:2691 LIVE-Boy-fat-utf-16-be.txt
active_hit:2697 LIVE-Boy-exfat-utf-8.txt
active_hit:2698 LIVE-Boy-exfat-utf-16-le.txt
active_hit:2699 LIVE-Boy-exfat-utf-16-be.txt
active_hit:2705 LIVE-Boy-ntfs-utf-8.txt
active_hit:2706 LIVE-Boy-ntfs-utf-16-le.txt
active_hit:2707 LIVE-Boy-ntfs-utf-16-be.txt
deleted_hit:2501 DELETED-Beauty-fat-utf-8.txt
deleted_hit:2502 DELETED-Beauty-fat-utf-16-le.txt
deleted_hit:2503 DELETED-Beauty-fat-utf-16-be.txt
deleted_hit:2509 DELETED-Beauty-exfat-utf-8.txt
deleted_hit:2510 DELETED-Beauty-exfat-utf-16-le.txt
deleted_hit:2511 DELETED-Beauty-exfat-utf-16-be.txt
deleted_hit:2517 DELETED-Beauty-ntfs-utf-8.txt
deleted_hit:2518 DELETED-Beauty-ntfs-utf-16-le.txt
deleted_hit:2519 DELETED-Beauty-ntfs-utf-16-be.txt
deleted_hit:2693 DELETED-Boy-fat-utf-8.txt
deleted_hit:2694 DELETED-Boy-fat-utf-16-le.txt
deleted_hit:2695 DELETED-Boy-fat-utf-16-be.txt
deleted_hit:2701 DELETED-Boy-exfat-utf-8.txt
deleted_hit:2702 DELETED-Boy-exfat-utf-16-le.txt
deleted_hit:2703 DELETED-Boy-exfat-utf-16-be.txt
deleted_hit:2709 DELETED-Boy-ntfs-utf-8.txt
deleted_hit:2710 DELETED-Boy-ntfs-utf-16-le.txt
deleted_hit:2711 DELETED-Boy-ntfs-utf-16-be.txt
unalloc_hit:2521 500237486 977026 Schönheit utf-8
unalloc_hit:2713 500262051 977074 garçon utf-8
n_active_targets:18
n_active_hits:18
n_deleted_targets:18
n_deleted_hits:18
n_unalloc_targets:6
n_unalloc_hits:2
comments:
Search target strings encoded as UTF-8 and located in deleted files are reported twice, once from the deleted file and again as from unallocated storage.