This lesson demonstrates how to add exported files back into the case so they can be bookmarked and added into the report.
Navigate to exported folder containing the exported files
Open a navigation window (Finder) and navigate to the location of the exported files folder. In this example, I have Salvaged JPEG files onto the Desktop (1) and (2) into a subfolder named "JPEG" (3).
Open Disk Utility
Open the Disk Utility application located in the Applications -> Utilities folder.
Create a "Disk Image from Folder" using the exported folder
From within Disk Utility select "File" from the Main Window and "New -> Disk Image from Folder" from the drop down list.
Navigate the the Exported Folder
Navigate to the location where the exported folder is located (1) select it and select "Image" (2).
Name the new disk image
Name the new disk image (1), leave all the defaults in place (image format and encryption) (2), then select "Save" (3).
Enter your password
Enter your password to create the disk image.
Quit Disk Utility
Once the disk image is created (1), quit the Disk Utility application (2).
Navigate to new disk image
Open a navigation window (Finder) and navigate to the new disk image.
Lock the new disk image
Once you have navigated to the new disk image, use Get Info (command + i) to see the properties (1). From within the Get Info window, select the "Locked" checkbox to lock the image (2), preventing changes to the disk image.
Attach Disk Image to Case
From the MacForensicsLab Main Window, select "File" (1) and "Attach Disk Image ..." (2) from the drop down list.
Navigate to the Disk Image
When the navigation box opens, navigate to your newly created and locked disk image (1) and select "Open" (2).
Highlight Volume of new disk image
From with MacForensicsLab's Main Window, select the Volume of the new disk image (1), then select the Browse function at the bottom of the Window (2).
Configure the Browse Window
Be sure that only the "Images Only" checkbox is marked (1), then select Browse (2).
Select all Files for Bookmarking
Select all the files by highlighting one and selecting (Command + A).
Add Bookmark
From MacForensicsLab's Main Window, select "Bookmarks" (1) and "Add Bookmark" from the drop down list (2).
Select Bookmark Folder
Select the appropriate bookmark folder from the drop down list. In this example, I bookmarked all the files into the "suspicious images" bookmark folder.
Create the Bookmark
Once the appropriate bookmark folder is selected (1), select "Bookmark" (2).
Open Bookmarks
From MacFornensicsLab's Main Window select "Bookmarks" (1) and "Show All Bookmarks" from the drop down list (2).
Review new bookmarks
Select the appropriate bookmark folder (1) and review the newly created bookmarks (2).
Generate a report
From MacForensicsLab's Main Window, select "File" (1) and "Write Report" from the drop down list (2).
Select the "Bookmarks" type checkbox
Select the Bookmarks type check box (1) to include the new bookmarks in your report, then select: "Start" (2).
Save Report
Select a location to save your report to (1) and select "Choose" (2).
Review Bookmarks
From within the newly created report, review the newly created bookmarks.
