This section will cover Bookmarks within MacForensicsLab.
MacForensicsLab uses bookmarks to assist the examiner in collecting files of investigative interest. It is possible to bookmark files and directories for reference and examination at a later time in the case. Likewise, the examiner can bookmark any file or folder, or groups of files. You cannot bookmark devices or specific blocks within a device.
Locating the Bookmarks
The bookmarks can be viewed and managed from the ‘Bookmarks’ window and are accessible at any time by selecting “Show All Bookmarks …” from the Bookmarks menu, or by using the keyboard shortcut "Command + Option + B”.
The Bookmark Window Layout
The ‘Bookmarks’ window is divided into 4 clear portions:
- The folders/groups pane
- The folder note pane
- The bookmark detail pane
- The bookmark note pane
The Folders Pane & Folder Note Pane
Bookmarks can be grouped together using folders. These are listed in the Folders Pane (1). When individually selected, the notes for the respective folder, in editable form, can be seen in the ‘Folder Notes’ pane, directly below (2), while the grouped bookmarks can be seen in the ‘Bookmarks’ pane to the right (3).
The Bookmarks Pane & Bookmark Note Pane
Having selected an individual bookmark folder, the contents of the folder will be displayed in the ‘Bookmarks’ pane (3). Each bookmark is listed with: bookmark name, file path, file size and creation date. Columns can of course be resized and sorted by the examiner simply by clicking on the respective header or by dragging the column separators to the desired size. Having selected a bookmark, the notes for the bookmark item will be displayed, in editable form, in the ‘Bookmark Note’ pane (4).
Resizing Panes
In order to maximize viewing space the examiner can resize the partitions between all four panes of the ‘Bookmarks’ window. To do so, the examiner should click & drag the resize handle of the respective separator, thus being able to minimize and maximize the required viewing space for each pane.
Managing Bookmark Folders
Adding Bookmark Folders
Bookmark folders can be added in one of two ways. The first is to use the ‘Add Bookmark Folder…’ window and the second is to do so from the ‘Bookmarks’ window itself.
Via the ‘Add Bookmark Folder…’ Window
When working with the other functions in MacForensicsLab, it is quickest and easiest to invoke the ‘Add Bookmark Folder…’ window from Bookmarks menu or use the keyboard shortcut: "Command + Shift + N".
If adding a new folder while creating a new bookmark, then simply click the (+) button below the folder title option list in the ‘Add Bookmark’ window.
Once the ‘Add Bookmark Folder…’ window comes to the fore, the examiner need only enter the name of the new folder (1) into the “Name” text input field, and click Save (3). If the examiner so wishes, he or she can enter a note/summary into the “Summary” text field (2) for reference then and there, or do so at a later date in time from the ‘Bookmarks’ window.
Via the ‘Bookmarks’ Window
The second way to add bookmark folders is to bring the ‘Bookmarks’ window to the fore, after which the examiner must click the (+) button under the ‘Bookmark Folders’ pane. This will generate a new folder with an empty title in the pane above ready with the text cursor in the entry field. Once the name is complete, the examiner can either press Enter/Return or simply click out of the name entry field. To add a summary, having created a new folder in this way, the examiner need only select the new folder in the ‘Bookmark Folders’ pane and then enter his or her summary for the selected folder into the ‘Folder Note’ pane below.
Amending Bookmark Folder Names
Should the examiner wish to amend the name of the bookmark folder, he or she can do so from the ‘Bookmarks’ window by simply double-clicking on the respective bookmark folder’s name in the ‘Bookmark Folders’ pane and make the edits accordingly, before clicking out of the text entry field.
Removing Bookmark Folders
Removing bookmark folders, either collectively or individually, can be done from the ‘Bookmarks’ window.
Clearing ALL Folders
To clear ALL folders, and lose the bookmarks contained within them, the examiner must click the (clear) button under the ‘Bookmark Folders’ pane, at which point MacForensicsLab will prompt him or her to confirm the deletion - as it cannot be undone. Having clicked OK, the examiner will be returned to the ‘Bookmarks’ window with a cleared ‘Bookmark Folders’ pane.
Clearing Individual Folders
To remove folders individually, the examiner must select each item in turn and click the (-) button beneath the ‘Bookmark Folders’ pane. As before, there will be a prompt confirming the deletion and the examiner need only click OK to follow through with the the action.
Clearing Actions
Removing Bookmarks
Removing bookmarks, either collectively or individually, can be done from the ‘Bookmarks’ window.
Clearing ALL Bookmarks
To clear ALL bookmarks from within a bookmark folder, the examiner should select the desired bookmark folder in the ‘Bookmark Folders’ pane and then click the (clear) button under the ‘Bookmarks’ pane (1), at which point MacForensicsLab will prompt him or her to confirm the request to delete ALL bookmarks. Having clicked OK, the examiner will be returned to the ‘Bookmarks’ window with a cleared ‘Bookmarks’ pane.
Clearing Individual Bookmarks
To remove bookmarks individually, the examiner must first select the requisite bookmark folder and then, once the bookmarks load, select each item in turn and click the (-) button underneath the ‘Bookmark’ pane (2). As before, there will be a prompt confirming the action and the examiner need only click OK to follow through with the action
