Hello
I am a Korean student who studies forensics using Autopsy.
While I was studying, the “S(core) indicators while the item is interesting or notable” item in the file sorting section sometimes appears in the files that I need to be careful about during forensic problems.
However, other normal files may also show this indication.
So I’m curious about the criteria by which the item is checked.
Please tell me more about the criteria such as bad signature
Autopsy User Documentation: Result Viewer Go to the SCO topic and that will explain it for you.