case:FT-SS-08-Email
engine:Indexed
dataset:Windows
tool:Autopsy
version:4.6
tester:JRL
host:Hathor
date:2018-08-14 10:08:18
active_hit:0944 LIVE-email-iron-fat-ascii.txt
active_hit:0945 LIVE-email-iron-fat-utf-8.txt
active_hit:0946 LIVE-email-iron-fat-utf-16-le.txt
active_hit:0947 LIVE-email-iron-fat-utf-16-be.txt
active_hit:0952 LIVE-email-iron-exfat-ascii.txt
active_hit:0953 LIVE-email-iron-exfat-utf-8.txt
active_hit:0954 LIVE-email-iron-exfat-utf-16-le.txt
active_hit:0955 LIVE-email-iron-exfat-utf-16-be.txt
active_hit:0960 LIVE-email-iron-ntfs-ascii.txt
active_hit:0961 LIVE-email-iron-ntfs-utf-8.txt
active_hit:0962 LIVE-email-iron-ntfs-utf-16-le.txt
active_hit:0963 LIVE-email-iron-ntfs-utf-16-be.txt
active_hit:1248 LIVE-email-capitol-fat-ascii.txt
active_hit:1250 LIVE-email-capitol-exfat-ascii.txt
active_hit:1252 LIVE-email-capitol-ntfs-ascii.txt
active_hit:1264 LIVE-email-kgb-fat-ascii.txt
active_hit:1266 LIVE-email-kgb-exfat-ascii.txt
active_hit:1268 LIVE-email-kgb-ntfs-ascii.txt
active_hit:1280 LIVE-email-berlin-fat-ascii.txt
active_hit:1282 LIVE-email-berlin-exfat-ascii.txt
active_hit:1284 LIVE-email-berlin-ntfs-ascii.txt
deleted_hit:0948 DELETED-email-iron-fat-ascii.txt
deleted_hit:0949 DELETED-email-iron-fat-utf-8.txt
deleted_hit:0950 DELETED-email-iron-fat-utf-16-le.txt
deleted_hit:0951 DELETED-email-iron-fat-utf-16-be.txt
deleted_hit:0956 DELETED-email-iron-exfat-ascii.txt
deleted_hit:0957 DELETED-email-iron-exfat-utf-8.txt
deleted_hit:0958 DELETED-email-iron-exfat-utf-16-le.txt
deleted_hit:0959 DELETED-email-iron-exfat-utf-16-be.txt
deleted_hit:0964 DELETED-email-iron-ntfs-ascii.txt
deleted_hit:0965 DELETED-email-iron-ntfs-utf-8.txt
deleted_hit:0966 DELETED-email-iron-ntfs-utf-16-le.txt
deleted_hit:0967 DELETED-email-iron-ntfs-utf-16-be.txt
deleted_hit:1249 DELETED-email-capitol-fat-ascii.txt
deleted_hit:1251 DELETED-email-capitol-exfat-ascii.txt
deleted_hit:1253 DELETED-email-capitol-ntfs-ascii.txt
deleted_hit:1265 DELETED-email-kgb-fat-ascii.txt
deleted_hit:1267 DELETED-email-kgb-exfat-ascii.txt
deleted_hit:1269 DELETED-email-kgb-ntfs-ascii.txt
deleted_hit:1281 DELETED-email-berlin-fat-ascii.txt
deleted_hit:1283 DELETED-email-berlin-exfat-ascii.txt
deleted_hit:1285 DELETED-email-berlin-ntfs-ascii.txt
unalloc_hit:0968 500679865 977890 iron.man@marvel.com utf-8
unalloc_hit:0969 500692153 977914 iron.man@marvel.com utf-8
unalloc_hit:0970 500688250 977906 iron.man@marvel.com utf-16-le
unalloc_hit:0971 500684160 977898 iron.man@marvel.com utf-16-be
unalloc_hit:1254 500675773 977882 potus@capitol.gov utf-8
unalloc_hit:1270 500696251 977922 kgb@moscow.red.square.ru utf-8
unalloc_hit:1286 500671665 977874 berlin@deutchland.net utf-8
n_active_targets:21
n_active_hits:21
n_deleted_targets:21
n_deleted_hits:21
n_unalloc_targets:7
n_unalloc_hits:7
comments:
Search target strings located in deleted files are reported twice, once from the deleted file and again as from unallocated storage.