This section will describe the core functionality of the Browse function of MacForensicsLab.
Overview
The ‘Browse’ window provides the examiner with an exceedingly quick and easy way to search for files (primarily images and multimedia) in directories, view the results found based on the preset search criteria, bookmark, make notes and even perform closer analysis.
The Browse Window
The Browse window allows the examiner a range of variable options to include in his/her search. These options include:
File Checks (1):
-File size (min-max range in kilobytes)
Image Checks:
-Image-only results (yes or no) (2)
-Horizontal & vertical dimensions (min-max range in pixels) (3) & (4)
To invoke the Browse, select the "Browse" (5) button at the bottom of the window.
After clicking Browse, as MacForensicsLab scans the selected location for matching files, a progress dialog will be displayed providing the examiner with a status report. If the examiner needs to end the scan prematurely, clicking the Cancel button under the progress bar will end the scan and return to the ‘Main’ window. When the scan is complete a finish prompt will appear and chime can be heard, upon clicking OK the prompt will close and the ‘Browse’ window will come to the fore.
Reviewing the Results
Upon completion, the Browse window will display a thumbnail view of all files meeting the aforementioned criteria set forth by the examiner. When an image is selected, it is highlighted in red (as seen above) and the metadata for that file appears on the right (1).
Bookmarking the Findings
Once the appropriate images are highlighted, the examiner can bookmark the results by choosing "Bookmarks" from the Main window or using the keyboard shortcut of Command + D. In the above example, a bookmark labeled "images" (1) was created, with a note "suspicious images" (2) to save the previously selected file.
Viewing Bookmark
The examiner can review the bookmark by navigating to the Bookmark window by selecting "Bookmark -> Show All Bookmarks" from the Main window.
