Running MacForensicsLab Web Agent
Configuring MacForensicsLab Web Agent
The first step in configuring Web Agent is entering the URL the user desires to examine. Once they have entered the URL, the user should then set the options including File Size, Horizontal and Vertical pixels. They must also select if they would like the URL to be crawled and if so, to what depth using the drop-down menu. Once these options have been set, the user can click the Start button at the bottom of the window. The user will then be prompted to select a folder to save the downloaded data to. Once a folder has been selected, the search will begin. Once the search has started, statistics will be displayed in the ‘Statistics’ area and images will start to appear in the thumbnail area. Clicking on images in the thumbnail area will display more information about them in the ‘File Information’ area.
Saving images
Users may select one or more images to be saved to the location of their choice. To do this, click on the image (or Command-Click on a Mac and Option-Click on a PC to select multiple images) the user wishes to save. Then select Save from the File menu. The user will be prompted to select a location to save these images. Select the location and click the Save button. The images will be saved in the desired location in a folder labeled with the website’s name.
Writing a report
To write a report, first select the images to include in the report. Once the images are selected, choose Write Report... from the File menu. The user will be prompted to select a location to save the report. This is the location the report will be written to in a folder labeled with the website address along with a folder containing thumbnails and the actual images. Once the location has been selected, click the Choose button. A progress window will be displayed briefly while the report is written.
Once the report has been written, it will automatically be opened in the default web browser. The report will show the selected images along with where the image was found with a link to both the HTML page and the URL of the actual image, information about each image plus hash numbers in three different standards (MD-5, SHA-1, and SHA-256).
The report formatting can be change by editing the HTML file titled index.html containing in the MacForensicsLab Web Agent Template folder within the Shared Resources folder in the same directory as the MacForensicsLab Web Agent application.
