Question
I export a filter and attempt to import it back to the same case from which it was exported from.
Though the import is "successful", I still do not see the imported filter in "Filter Manager". Why is that?
Answer
The filename of an exported filter xml file has no bearing on the name given to the filter. Instead, the name of the filter is stored inside the exported filter xml file.
To see the import succeed, import the filter into a different case.
If importing into the same case it was exported from, you should see the newly imported filter with the same name as the original source filter, but with an appended number "[1]" before importing the xml file.
A suggested use-case and workflow is below:
1) Define a desired new filter.
2) Export the new filter to xml file.
3) Import the xml file to a different case than it was exported from.
Overview
Imported Filters will not overwrite an existing filter of the same name.
Also the default filter names that come pre-defined in the application cannot be reused.
Applies To
AD Enterprise
AD Lab
Forensic Toolkit (FTK)