case:FT-SS-09-Meta
engine:Indexed
dataset:Windows
tool:Autopsy
version:4.6
tester:JRL
host:Hathor
date:2018-08-16 09:08:53
active_hit:0928 LIVE-LOUDBIRD-fat-ascii.txt
active_hit:0930 LIVE-LOUDBIRD-exfat-ascii.txt
active_hit:0932 LIVE-LOUDBIRD-ntfs-ascii.txt
active_hit:2625 LIVE-WADI-fat-utf-8.txt
active_hit:2633 LIVE-WADI-exfat-utf-8.txt
active_hit:2641 LIVE-WADI-ntfs-utf-8.txt
deleted_hit:0929 DELETED-LOUDBIRD-fat-ascii.txt
deleted_hit:0931 DELETED-LOUDBIRD-exfat-ascii.txt
deleted_hit:0933 DELETED-LOUDBIRD-ntfs-ascii.txt
deleted_hit:2629 DELETED-WADI-fat-utf-8.txt
deleted_hit:2637 DELETED-WADI-exfat-utf-8.txt
deleted_hit:2645 DELETED-WADI-ntfs-utf-8.txt
unalloc_hit:0934 500864176 978250 thunderbird utf-8
unalloc_hit:2649 500667561 977866 cañón utf-8
meta_ref:thunderbird:ntfs:52
meta_ref:cañón:fat32:1
meta_ref:cañón:exfat:4
meta_ref:cañón:ntfs:20
meta_hit:thunderbird:ntfs:52
meta_hit:cañón:fat32:1
meta_hit:cañón:exfat:4
meta_hit:cañón:ntfs:20
n_active_targets:6
n_active_hits:6
n_deleted_targets:6
n_deleted_hits:6
n_unalloc_targets:2
n_unalloc_hits:2
comments:
Hits on the string "thunderbird" are reported in the files $MFT and $LogFile.