case:FT-SS-07-Norm
engine:Indexed
dataset:Windows
tool:Autopsy
version:4.6
tester:JRL
host:Hathor
date:2018-08-14 10:08:10
active_hit:2961 LIVE-NFC-tomorrow-fat-utf-8.txt
active_hit:2962 LIVE-NFC-tomorrow-fat-utf-16-le.txt
active_hit:2963 LIVE-NFC-tomorrow-fat-utf-16-be.txt
active_hit:2969 LIVE-NFC-tomorrow-exfat-utf-8.txt
active_hit:2970 LIVE-NFC-tomorrow-exfat-utf-16-le.txt
active_hit:2971 LIVE-NFC-tomorrow-exfat-utf-16-be.txt
active_hit:2977 LIVE-NFC-tomorrow-ntfs-utf-8.txt
active_hit:2978 LIVE-NFC-tomorrow-ntfs-utf-16-le.txt
active_hit:2979 LIVE-NFC-tomorrow-ntfs-utf-16-be.txt
active_hit:3025 LIVE-NFC-freedom-fat-utf-8.txt
active_hit:3026 LIVE-NFC-freedom-fat-utf-16-le.txt
active_hit:3027 LIVE-NFC-freedom-fat-utf-16-be.txt
active_hit:3033 LIVE-NFC-freedom-exfat-utf-8.txt
active_hit:3034 LIVE-NFC-freedom-exfat-utf-16-le.txt
active_hit:3035 LIVE-NFC-freedom-exfat-utf-16-be.txt
active_hit:3041 LIVE-NFC-freedom-ntfs-utf-8.txt
active_hit:3042 LIVE-NFC-freedom-ntfs-utf-16-le.txt
active_hit:3043 LIVE-NFC-freedom-ntfs-utf-16-be.txt
active_hit:3089 LIVE-NFC-mice-fat-utf-8.txt
active_hit:3090 LIVE-NFC-mice-fat-utf-16-le.txt
active_hit:3091 LIVE-NFC-mice-fat-utf-16-be.txt
active_hit:3097 LIVE-NFC-mice-exfat-utf-8.txt
active_hit:3098 LIVE-NFC-mice-exfat-utf-16-le.txt
active_hit:3099 LIVE-NFC-mice-exfat-utf-16-be.txt
active_hit:3105 LIVE-NFC-mice-ntfs-utf-8.txt
active_hit:3106 LIVE-NFC-mice-ntfs-utf-16-le.txt
active_hit:3107 LIVE-NFC-mice-ntfs-utf-16-be.txt
active_hit:3153 LIVE-NFD-tomorrow-fat-utf-8.txt
active_hit:3154 LIVE-NFD-tomorrow-fat-utf-16-le.txt
active_hit:3155 LIVE-NFD-tomorrow-fat-utf-16-be.txt
active_hit:3161 LIVE-NFD-tomorrow-exfat-utf-8.txt
active_hit:3162 LIVE-NFD-tomorrow-exfat-utf-16-le.txt
active_hit:3163 LIVE-NFD-tomorrow-exfat-utf-16-be.txt
active_hit:3169 LIVE-NFD-tomorrow-ntfs-utf-8.txt
active_hit:3170 LIVE-NFD-tomorrow-ntfs-utf-16-le.txt
active_hit:3171 LIVE-NFD-tomorrow-ntfs-utf-16-be.txt
active_hit:3217 LIVE-NFD-freedom-fat-utf-8.txt
active_hit:3218 LIVE-NFD-freedom-fat-utf-16-le.txt
active_hit:3219 LIVE-NFD-freedom-fat-utf-16-be.txt
active_hit:3225 LIVE-NFD-freedom-exfat-utf-8.txt
active_hit:3226 LIVE-NFD-freedom-exfat-utf-16-le.txt
active_hit:3227 LIVE-NFD-freedom-exfat-utf-16-be.txt
active_hit:3233 LIVE-NFD-freedom-ntfs-utf-8.txt
active_hit:3234 LIVE-NFD-freedom-ntfs-utf-16-le.txt
active_hit:3235 LIVE-NFD-freedom-ntfs-utf-16-be.txt
active_hit:3281 LIVE-NFD-mice-fat-utf-8.txt
active_hit:3282 LIVE-NFD-mice-fat-utf-16-le.txt
active_hit:3283 LIVE-NFD-mice-fat-utf-16-be.txt
active_hit:3289 LIVE-NFD-mice-exfat-utf-8.txt
active_hit:3290 LIVE-NFD-mice-exfat-utf-16-le.txt
active_hit:3291 LIVE-NFD-mice-exfat-utf-16-be.txt
active_hit:3297 LIVE-NFD-mice-ntfs-utf-8.txt
active_hit:3298 LIVE-NFD-mice-ntfs-utf-16-le.txt
active_hit:3299 LIVE-NFD-mice-ntfs-utf-16-be.txt
active_hit:3344 LIVE-AndBeyond-fat-ascii.txt
active_hit:3345 LIVE-AndBeyond-fat-utf-8.txt
active_hit:3346 LIVE-AndBeyond-fat-utf-16-le.txt
active_hit:3347 LIVE-AndBeyond-fat-utf-16-be.txt
active_hit:3352 LIVE-AndBeyond-exfat-ascii.txt
active_hit:3353 LIVE-AndBeyond-exfat-utf-8.txt
active_hit:3354 LIVE-AndBeyond-exfat-utf-16-le.txt
active_hit:3355 LIVE-AndBeyond-exfat-utf-16-be.txt
active_hit:3360 LIVE-AndBeyond-ntfs-ascii.txt
active_hit:3361 LIVE-AndBeyond-ntfs-utf-8.txt
active_hit:3362 LIVE-AndBeyond-ntfs-utf-16-le.txt
active_hit:3363 LIVE-AndBeyond-ntfs-utf-16-be.txt
active_hit:3409 LIVE-LigatureAndBeyond-fat-utf-8.txt
active_hit:3410 LIVE-LigatureAndBeyond-fat-utf-16-le.txt
active_hit:3411 LIVE-LigatureAndBeyond-fat-utf-16-be.txt
active_hit:3417 LIVE-LigatureAndBeyond-exfat-utf-8.txt
active_hit:3418 LIVE-LigatureAndBeyond-exfat-utf-16-le.txt
active_hit:3419 LIVE-LigatureAndBeyond-exfat-utf-16-be.txt
active_hit:3425 LIVE-LigatureAndBeyond-ntfs-utf-8.txt
active_hit:3426 LIVE-LigatureAndBeyond-ntfs-utf-16-le.txt
active_hit:3427 LIVE-LigatureAndBeyond-ntfs-utf-16-be.txt
deleted_hit:2965 DELETED-NFC-tomorrow-fat-utf-8.txt
deleted_hit:2966 DELETED-NFC-tomorrow-fat-utf-16-le.txt
deleted_hit:2967 DELETED-NFC-tomorrow-fat-utf-16-be.txt
deleted_hit:2973 DELETED-NFC-tomorrow-exfat-utf-8.txt
deleted_hit:2974 DELETED-NFC-tomorrow-exfat-utf-16-le.txt
deleted_hit:2975 DELETED-NFC-tomorrow-exfat-utf-16-be.txt
deleted_hit:2981 DELETED-NFC-tomorrow-ntfs-utf-8.txt
deleted_hit:2982 DELETED-NFC-tomorrow-ntfs-utf-16-le.txt
deleted_hit:2983 DELETED-NFC-tomorrow-ntfs-utf-16-be.txt
deleted_hit:3029 DELETED-NFC-freedom-fat-utf-8.txt
deleted_hit:3030 DELETED-NFC-freedom-fat-utf-16-le.txt
deleted_hit:3031 DELETED-NFC-freedom-fat-utf-16-be.txt
deleted_hit:3037 DELETED-NFC-freedom-exfat-utf-8.txt
deleted_hit:3038 DELETED-NFC-freedom-exfat-utf-16-le.txt
deleted_hit:3039 DELETED-NFC-freedom-exfat-utf-16-be.txt
deleted_hit:3045 DELETED-NFC-freedom-ntfs-utf-8.txt
deleted_hit:3046 DELETED-NFC-freedom-ntfs-utf-16-le.txt
deleted_hit:3047 DELETED-NFC-freedom-ntfs-utf-16-be.txt
deleted_hit:3093 DELETED-NFC-mice-fat-utf-8.txt
deleted_hit:3094 DELETED-NFC-mice-fat-utf-16-le.txt
deleted_hit:3095 DELETED-NFC-mice-fat-utf-16-be.txt
deleted_hit:3101 DELETED-NFC-mice-exfat-utf-8.txt
deleted_hit:3102 DELETED-NFC-mice-exfat-utf-16-le.txt
deleted_hit:3103 DELETED-NFC-mice-exfat-utf-16-be.txt
deleted_hit:3109 DELETED-NFC-mice-ntfs-utf-8.txt
deleted_hit:3110 DELETED-NFC-mice-ntfs-utf-16-le.txt
deleted_hit:3111 DELETED-NFC-mice-ntfs-utf-16-be.txt
deleted_hit:3157 DELETED-NFD-tomorrow-fat-utf-8.txt
deleted_hit:3158 DELETED-NFD-tomorrow-fat-utf-16-le.txt
deleted_hit:3159 DELETED-NFD-tomorrow-fat-utf-16-be.txt
deleted_hit:3165 DELETED-NFD-tomorrow-exfat-utf-8.txt
deleted_hit:3166 DELETED-NFD-tomorrow-exfat-utf-16-le.txt
deleted_hit:3167 DELETED-NFD-tomorrow-exfat-utf-16-be.txt
deleted_hit:3173 DELETED-NFD-tomorrow-ntfs-utf-8.txt
deleted_hit:3174 DELETED-NFD-tomorrow-ntfs-utf-16-le.txt
deleted_hit:3175 DELETED-NFD-tomorrow-ntfs-utf-16-be.txt
deleted_hit:3221 DELETED-NFD-freedom-fat-utf-8.txt
deleted_hit:3222 DELETED-NFD-freedom-fat-utf-16-le.txt
deleted_hit:3223 DELETED-NFD-freedom-fat-utf-16-be.txt
deleted_hit:3229 DELETED-NFD-freedom-exfat-utf-8.txt
deleted_hit:3230 DELETED-NFD-freedom-exfat-utf-16-le.txt
deleted_hit:3231 DELETED-NFD-freedom-exfat-utf-16-be.txt
deleted_hit:3237 DELETED-NFD-freedom-ntfs-utf-8.txt
deleted_hit:3238 DELETED-NFD-freedom-ntfs-utf-16-le.txt
deleted_hit:3239 DELETED-NFD-freedom-ntfs-utf-16-be.txt
deleted_hit:3285 DELETED-NFD-mice-fat-utf-8.txt
deleted_hit:3286 DELETED-NFD-mice-fat-utf-16-le.txt
deleted_hit:3287 DELETED-NFD-mice-fat-utf-16-be.txt
deleted_hit:3293 DELETED-NFD-mice-exfat-utf-8.txt
deleted_hit:3294 DELETED-NFD-mice-exfat-utf-16-le.txt
deleted_hit:3295 DELETED-NFD-mice-exfat-utf-16-be.txt
deleted_hit:3301 DELETED-NFD-mice-ntfs-utf-8.txt
deleted_hit:3302 DELETED-NFD-mice-ntfs-utf-16-le.txt
deleted_hit:3303 DELETED-NFD-mice-ntfs-utf-16-be.txt
deleted_hit:3348 DELETED-AndBeyond-fat-ascii.txt
deleted_hit:3349 DELETED-AndBeyond-fat-utf-8.txt
deleted_hit:3350 DELETED-AndBeyond-fat-utf-16-le.txt
deleted_hit:3351 DELETED-AndBeyond-fat-utf-16-be.txt
deleted_hit:3356 DELETED-AndBeyond-exfat-ascii.txt
deleted_hit:3357 DELETED-AndBeyond-exfat-utf-8.txt
deleted_hit:3358 DELETED-AndBeyond-exfat-utf-16-le.txt
deleted_hit:3359 DELETED-AndBeyond-exfat-utf-16-be.txt
deleted_hit:3364 DELETED-AndBeyond-ntfs-ascii.txt
deleted_hit:3365 DELETED-AndBeyond-ntfs-utf-8.txt
deleted_hit:3366 DELETED-AndBeyond-ntfs-utf-16-le.txt
deleted_hit:3367 DELETED-AndBeyond-ntfs-utf-16-be.txt
deleted_hit:3413 DELETED-LigatureAndBeyond-fat-utf-8.txt
deleted_hit:3414 DELETED-LigatureAndBeyond-fat-utf-16-le.txt
deleted_hit:3415 DELETED-LigatureAndBeyond-fat-utf-16-be.txt
deleted_hit:3421 DELETED-LigatureAndBeyond-exfat-utf-8.txt
deleted_hit:3422 DELETED-LigatureAndBeyond-exfat-utf-16-le.txt
deleted_hit:3423 DELETED-LigatureAndBeyond-exfat-utf-16-be.txt
deleted_hit:3429 DELETED-LigatureAndBeyond-ntfs-utf-8.txt
deleted_hit:3430 DELETED-LigatureAndBeyond-ntfs-utf-16-le.txt
deleted_hit:3431 DELETED-LigatureAndBeyond-ntfs-utf-16-be.txt
unalloc_hit:2985 500466880 977474 mañana utf-8
unalloc_hit:3049 500442292 977426 libertà utf-8
unalloc_hit:3113 500454584 977450 Mäuse utf-8
unalloc_hit:3114 500450692 977442 Mäuse utf-16-le
unalloc_hit:3115 500446600 977434 Mäuse utf-16-be
unalloc_hit:3368 500188330 976930 infinity utf-8
unalloc_hit:3369 500200620 976954 infinity utf-8
unalloc_hit:3370 500196740 976946 infinity utf-16-le
unalloc_hit:3371 500192640 976938 infinity utf-16-be
n_active_targets:75
n_active_hits:75
n_deleted_targets:75
n_deleted_hits:75
n_unalloc_targets:25
n_unalloc_hits:9
comments:
Tool did not normalize the search string.
Search strings entered in NFC form found all targets in active files and deleted files and all targets located in unallocated space if encoded in UTF-8, but sometimes targets encoded in UTF-16 were missed.
Search strings entered in NFD form found all targets in active files and deleted files and no targets located in unallocated space.
Search results were the same if the combining characters (or ligature) are replaced with a regular expression of mathc any character.