Elements of MacForensicsLab Web Agent
The ‘Source‘ area
The source window is where the user sets the criteria for the search.
The first required field is the URL for the site and directory the investigator would like to examine. This URL is entered without the HTTP prefix. To the right of the URL field is a drop-down menu that allows the user to select previously entered websites. To clear the sites listed, simply select ‘Clear’ from the bottom of the drop-down menu.
Below the URL field is a checkbox marked ‘Crawl’. With this box checked, MacForensicsLab Web Agent will search links on the depth indicated in the drop-down menu below the ‘Crawl’ checkbox.
‘File Size (KB)’ allows the user to set requirements for images displayed based on the file size measured in kilobytes. The first box sets the minimum size requirement and the second box sets the maximum size requirement.
‘Horizontal (Pixels)’ allows the user to set the requirements for images displayed based on the number of horizontal pixels in the image. The first box sets the minimum size requirement and the second box sets the maximum size requirement.
‘Vertical (Pixels)’ allows the user to set the requirements for images displayed based on the number of vertical pixels in the image. The first box sets the minimum size requirement and the second box sets the maximum size requirement.
The ‘Statistics‘ area
While a search is running, statistical information about the process is displayed in the ‘Statistics’ area in real-time.
‘URL’ displays 3 sets of separated numbers. Starting from the far right, the first number is the number of pages discovered to download. The middle number shows the number of pages downloaded but still waiting to be processed/parsed. The number on the left shows the number of URLs downloaded and processed so far.
‘Images’ displays 3 sets of separated numbers. Starting from the far right, the first number is the number of images discovered to download. The middle number shows the number of images downloaded but still waiting to be processed/parsed. The number on the left shows the number of images downloaded and processed so far.
‘Speed’ displays two numbers as ‘xx + xx’. The first number is the number of the total 40 sockets (connections) that are downloading webpages. The second number is the number of sockets downloading images. The current download speed of those connections is displayed next to these two number sets.
The 40 humps or bubbles below the ‘Speed’ display shows the state of the 40 socket connections. Blue indicates the connection is idle and green indicates the connection is in use.
The thumbnail area
As a search runs, images that meet the criteria set forth in the ‘Source’ area are displayed in the thumbnail area of the Web Agent window. Clicking on any of these images will display information about the file in the ‘File Information’ area.
The Skin Tone slider below the thumbnails can be used to show or hide images based on percentage of skin tones within the image. By default this slider is set to 15% as that has been found to be the optimal range to eliminate many non-human pictures without hiding too many false positives. Increasing this slider will increase the percentage of skin tone that must be present in the image to be displayed in the thumbnail area. Decreasing the slider to 0% will display all images in the thumbnail area.
The ‘File Information‘ area
Information about images that are selected in the thumbnail area is displayed in the ‘File Information‘ area. This contains information like format, dimensions, aspect ratio, colors, file name, size and more. Much of the information displayed in the ‘File Information‘ area is dependent on the metadata contained within the image file itself.
