Section 10 LAb Question 4

Online Training
1

Was the file “IMG_20191024_155744.jpg” seen in any other folders/and or directories on the hard drive? If so, what was the name of the other file(s)?
Can someone help me with steps for above question (with images if possible),
Thanks,
Tahir

2

If you haven’t already, find the file. You can do this a few ways:

  1. By Name

Tools menu --> File Search by Attributes --> Name

  1. By Type

Left panel --> Views --> By MIME Type --> image

Then, select the file in the top-right panel, and occurrences in the bottom right panel. You wlll see other file name(s) than match based on MD5 hash value. The occurrences tab appears with the central repository option, and has the added benefit of showing other devices and cases containing the same file.

Alternatively, If you did not use a central repository, you can us the File Search by Attributes dialog to search by MD5 hash. You can copy the MD5 of the file from the File Metadata tab in the bottom right panel and paste it into the File Search by Attributes tool. Remember, MD5 hashes match when the file content is the same, not the file attributes (name, dates, permissions, etc) because file attributes are stored in file system structures, not with the file data.

1 Like
3

Thanks John
Appreciate that