Purpose
It is helpful sometimes to find out what processing options were checked when the case was processed for troubleshooting purposes.
Procedure
First of all, make sure you have a python version greater than 3.5 is installed on your computer.
1) Create a directory In the root of your C: drive and call it “Script”
2) Copy the attached python script into that "c:\script" directory .
3) Copy the "JobInformation.log" file into that "c:\script" directory as well.
Note: The "jobinformation.log" file is specific to a processing job, and is found in a case's "jobs" folder within the correlated subfolder.
4) Open the processing_profile_extraction.py on python IDLE editor. Click on Run Menu -> Run Module or hit F5 to run the script.
5) Once you run the script, you will see a Processing_Rules.xml file in your C:\Script directory.
6) Open FTK
7) Click on Manage Menu -> Evidence Processing Profiles..
8) Manage Evidence Processing Profiles dialog box opens.
9) Click on the Import button and navigate to C:\script\ and import the file Processing_Rules.xml. Once the file has been imported, you will see it appears in the processing profile list as “test”.
9) Select it in the list and then click on the “Edit…” button. The detailed options dialog box will open and you will see the options checked with which the evidence was processed.