case:FT-SS-10-Regex
engine:Indexed
dataset:Windows
tool:Autopsy
version:4.6
tester:JRL
host:Hathor
date:2018-08-14 11:08:40
active_hit:0896 LIVE-Extinct-Lupus-fat-ascii.txt
active_hit:0898 LIVE-Extinct-Lupus-exfat-ascii.txt
active_hit:0900 LIVE-Extinct-Lupus-ntfs-ascii.txt
active_hit:0912 LIVE-Lycan-fat-ascii.txt
active_hit:0914 LIVE-Lycan-exfat-ascii.txt
active_hit:0916 LIVE-Lycan-ntfs-ascii.txt
deleted_hit:0897 DELETED-Extinct-Lupus-fat-ascii.txt
deleted_hit:0899 DELETED-Extinct-Lupus-exfat-ascii.txt
deleted_hit:0901 DELETED-Extinct-Lupus-ntfs-ascii.txt
deleted_hit:0913 DELETED-Lycan-fat-ascii.txt
deleted_hit:0915 DELETED-Lycan-exfat-ascii.txt
deleted_hit:0917 DELETED-Lycan-ntfs-ascii.txt
unalloc_hit:0902 500323512 977194 DireWolf utf-8
unalloc_hit:0918 500393145 977330 WereWolf utf-8
n_active_targets:6
n_active_hits:6
n_deleted_targets:6
n_deleted_hits:6
n_unalloc_targets:2
n_unalloc_hits:2
comments:
Search target strings located in deleted files are reported twice, once from the deleted file and again as from unallocated storage.