III. File list pane

The file list pane is the primary means of viewing item groupings in FTK. Whenever a hierarchical object in the evidence tree is selected in any tab (e.g. Explore tab, Bookmarks tab), the file list populates all items in the object. In FTK, an “item” can be a disk image (termed “Evidence” in the application), a disk partition, a root file directory, a folder, or any file. File metadata presents in columns, while numerous file list features give technical options for analyzing files.

Selecting items

Generally, actions involving items in FTK can be applied to three standard selections. Selections normally work from file lists, though checked files can persist outside of the file list currently being viewed.

1. Listed files: All files in the current file list.

2. Highlighted files: All files currently highlighted. Users can highlight individual files by clicking them in the file list. Users can highlight multiple files by clicking and dragging, holding shift and clicking a range of files, or holding control and clicking a series of individual files.

3. Checked files: Applying actions to checked files affects all checked files, including checked files outside the current file list.

File list toolbar

Open

Figure 1. The file list pane showing the contents of a folder.

The top toolbar in the file list pane contains many of the most important tools for analyzing, arranging, and viewing items:

1. Check all files in file list

2. Uncheck all files in file list

3. Uncheck all files in case

4. Bookmark color toggle: Enables or disables the option to show bookmarked items in pink text.

5. Create a bookmark: Opens a dialog to create a bookmark from a selection of files.

6. Create VIC bookmark: “VIC” is short for “victim.” This feature is designed for organizing media that exploits victims simply by viewing it. This feature is not used.

7. Open labels dialog

8. Labels drop-down menu

9. Apply labels switcher: Change the selection type for applying labels. The options are All Highlighted, All Checked, and All Listed.

10.  Copy special: Copy to clipboard a selection of items in a column profile. This is useful for quickly copying and pasting metadata.

11.  Export file list: Export a selection of items as a file in a column profile. For example, export the current file list as a CSV file.

12.  Column settings dialog: Open a menu to edit, switch between, and import column profiles.

13.  Drop-down column profile selection menu

14.  Show the total logical file size of the file list

15.  File heatmap: Present a heatmap breakdown of file categories or file extensions by file count or file size.

16.  Visualize geo-location data: Uses data from file formats such as JPEG EXIF to show a visualization of all locations identified from files in the case.

17.  Visualize file list: Show a general visualization of the file list, such as a timeline of items in the file list.

18.  Leave query running when switching tabs: Do not use. Changing this setting can potentially cause the application to crash.

19.  Cancel row data processing: Manually cancel the file list loading process.

20.  File list loading icon: Buffering icon that shows whether row data is loading.

Open

Figure 2. Functions in the file list pane.

Column settings

The column settings drop-down menu includes default column profiles for FTK and user-created column profiles. Normally, a Schlesinger-designed column settings profile is added to the case following case creation.

The Schlesinger column settings profile includes the standard metadata fields used for born-digital archival processing at Schlesinger. The Schlesinger profile is used for preserving metadata in the DRS and BDT. Users can create new column profiles that are individualized per case. Custom profiles can be exported to a user’s desktop and imported to other cases.

Exporting file lists: Two methods

Copy special is a useful feature for quickly copying file metadata to the clipboard for analysis in another piece of software, note-taking for processing work, and reporting between the processor and the Digital Collections and Services. Copy Special can be used via the file list pane toolbar or by right-clicking an item in the file list.

In addition, users can export file lists to external files using the export file list feature.

View item in a different list

Users can select an item and choose to view the item in a different tab view. This is extremely useful, especially for quickly locating bookmarked files in the Explore or Overview tabs. To view items in a different list, right-click on the item, scroll over “View This Item In a Different List” and select the desired tab.

Visualizing file list data

FTK’s file list includes several views for analyzing bulk metadata from the file list in visualization windows. These views can be useful for planning and reporting, though none of them are currently used for departmental reporting at Schlesinger. The views include:

1. Heatmap: Sorts all file categories according to size by file count or size by total file size.

2. Geo-location: For file types that track location coordinates, such as JPEG EXIF, the visualization shows a map of all file creation locations.

3. Visualization: Shows a summation of data from the file list, including a timeline of file timestamps.