Evidence Processing

Compound Files

Search Text Index

Data Carving

Creating Thumbnails for Videos

Creating Common Video Files

Optical Character Recognition

Explicit Image Detection

Cerberus Analysis

Document Content Analysis

Language Identification

Entity Extraction

Lab/E-discovery Options

Evidence Refinement

Index Refinement

Processing Profiles

MD5 Hash

Creates a digital fingerprint using the Message Digest 5 algorithm, based on the contents of the file. This fingerprint can be used to verify file integrity and to identify duplicate files.

SHA-1 Hash

Creates a digital fingerprint using the Secure Hash Algorithm-1, based on the contents of the file. This fingerprint can be used to verify file integrity and to identify duplicate files.

SHA-256 Hash

Creates a digital fingerprint using the Secure Hash Algorithm-256, based on the contents of the file. This fingerprint can be used to verify file integrity and to identify duplicate files. SHA-256 is a hash function computed with 32-bit words, giving it a longer digest than SHA-1.

Flag Duplicate Files

Identifies files that are found more than once in the evidence. This is done by comparing file hashes.

KFF

Enables the Known File Filter (KFF) that lets you identify either known insignificant files that you can ignore or known illicit or dangerous files that you want to be alerted to. See Known File Filter section.

Expand Compound Files

Automatically extracts and processes the contents of compound files such as ZIP, email, and OLE files.

Expand Compound Image Files

For any given evidence image file, expand any other evidence image files it contains and add their contents to the evidence.

Enhanced File Identification

Enables additional processing to determine the contents of multimedia files. 

Note: You are advised to perform this processing since some multimedia files may be misidentified without this processing.

File Signature Analysis

File Signature Analysis is an optional processing option. This lets you initially see the contents of compound files without necessarily having to process them. Processing can be done later, if it is deemed necessary or beneficial to the case by selecting File Signature Analysis.

Flag Bad Extensions

Identifies files whose types do not match their extensions, based on the file header information. Enabling this automatically forces File Signature Analysis to be selected.

Entropy Test

Performs an entropy test. This is useful when used in conjunction with indexing to not index binary data, etc.

Include Deleted Files

Scan enumerated objects (e.g. file systems, ZIP, email archives) for deleted items.

Note: If this is not selected it cannot be done later.

Search Text Index

Stores the words from evidence in an index for quick retrieval. Using this processing option adds up to the memory consumption, approximately 25% of the memory required for the total evidence in the case.

When FTK Central creates a full text index of evidence or places all text characters in an index file with a case, it does not capture spaces or the following symbols: 

Create Thumbnails for Graphics

Creates thumbnails for all graphics in the case. The thumbnails are always created in JPG format, regardless of the original graphic file type.

Create Thumbnails for Videos

Creates thumbnails for all videos in the case. The thumbnails are always created in JPG format, regardless of the original video file type.

Note: You can set the frequency for picking a thumbnail from the video. You can do it by either providing the percent (1 thumbnail per n% of the video) or the time interval (1 thumbnail per n seconds of the video).

Generate Common Video File

When you process the evidence in your case, you can choose to create a common video type for all the videos in your case. These common video types are not the actual video files from the evidence, but a copied conversion of the media that is generated and saved as an MP4 file that can be previewed on the video tab.

EXIF for Videos

Parses XMP metadata (similar to EXIF data) from processed MP4 and most of the other modern video file formats. When parsed from a video file, the metadata values are displayed on the Properties tab of the file viewer pane.

HTML File Listing

Creates a HTML version of the File Listing in the case folder.

CSV File Listing

Creates a File Listing Database in CSV format instead of an MDB file.

Data Carve

Carves data immediately after pre-processing. This uses file signatures to identify deleted files contained in the evidence.

Meta Carve

Carves deleted directory entries and other metadata. The deleted directory entries often lead to data and file fragments that can prove useful to the case, that could not be found otherwise.

Optical Character Recognition (OCR)

Scans graphic files for text and converts graphics-text into actual text. That text can then be indexed, searched and treated as any other text in the case.

Explicit Image Detection

Generates explicit image scores (range 0-100) for graphic files.

Cerberus Analysis

Calculates the Cerberus Stage 1 Score for the evidence. See Cerberus Analysis section.

Process Internet Browser History for Visualization

Processes internet browser history files so that you can see them in the detailed visualization timeline.

Language Identification

Analyses the first two pages of every document to identify the languages contained within.

Document Content Analysis

Analyzes the content and groups it according to topic in the Overview tab.

Entity Extraction

Identifies and extracts specific types of data in your evidence. See Entity Extraction section.

Enable File Encryption Detection

Identifies files which may be encrypted.

Perform Automatic Decryption

Attempts to decrypt files using a list of passwords that you provide.

Populate Family for FTK Central

Makes the SMS and MMS messages (and their associated family objects / attachments) available for review in FTK Central.

Category

Description

All

This is the full list of supported Compound File Expansion Options.

All Communication

This option includes all supported file types that are used for communication.

All Mobile

This option includes all supported file types found on any mobile device.

Archives

This option includes all supported archive file types.

Browsers

This option includes all supported file types used within a browser.

Email

This option includes all supported email file types.

Logs

This option includes all supported log file types.

Other Forensic Tools

This option includes all support third-party forensic tool image types.

Windows

This option includes all supported file types used within a Windows system.

Letters

Specifies the letters and numbers to index. Specifies Original, Lowercase, Uppercase, and Unaccented. Choose Add or Remove to customize the list.

You may need to add characters to this list for specific index searches to function properly. For example, you may want to do an index search for ‘Password#123’. By default, the # symbol is treated as a space and is not indexed.

To have the # symbol included in the index, you would need to do two things:

Noise Words

A list of words to be considered “noise” and ignored during indexing. Choose Add or Remove to customize the list.

Hyphens

Specifies which characters are to be treated as hyphens. You can add standard keyboard characters, or control characters. You can remove items as well.

Hyphen Treatment

Specifies how hyphens are to be treated in the index. Options are:

Hyphens will be treated as if they never existed. For example, the term “coun- ter-culture” would be indexed as “counterculture.”

Hyphens will be treated literally. For example, the term “counter-culture” would be indexed as “counter-culture.”

Hyphens will be replaced by a non-breaking space. For example, the term “counter-culture” would be indexed as two separate entries in the index being “counter” and “culture.”

Terms with hyphens will be indexed using all three hyphen treatments. For example, the term “counter-culture” will be indexed as “counterculture”, “coun- ter-culture”, and as two separate entries in the index being “counter” and “cul- ture.”

Spaces

Specifies which special characters should be treated as spaces. Remove characters from this list to have them indexed as any other text. Choose Add or   Remove to customize the list. 

You may need to remove characters from this list for specific index searches to function properly. For example, you may want to do an index search for ‘Password’123’. By default, the # symbol is treated as a space and is not indexed.

To have the # symbol included in the index, you would need to do two things:

Note: If special characters (e.g. @, ., etc. used in emails or other strings) are configured as spaces within the indexing options, users must search for single words beginning/ending with an asterisk *. dtSearch will not allow partial words to be searched for without a wildcard asterisk.

Ignore

Specifies which control characters or other characters to ignore. Choose Add or Remove to customize the list.

Max Word Length

Allows you to set a maximum word length to be indexed.

Index Binary Files

Specify how binary files will be indexed. Options are:

Enable Date Recognition

Choose to enable or disable this option.

Presumed Date Format        for Ambiguous Dates

If date recognition is enabled, specify how ambiguous dates should be formatted when encountered during indexing. Options are:

Set Max Memory

Allows you to set a maximum size for the index.

Auto-Commit Interval (MB)

Allows you to specify an Auto-Commit Interval while indexing the case. When the index reaches the specified size, the indexed data is saved to the index. The size resets, and indexing continues until it reaches the maximum size, and saves again, and so forth.

Cache Filtered Text in Index

Filtered Text is being cached in the dtSearch index by default, however it can be toggled on or off. The advantage to caching filtered text is that it produces more reliable search hit highlighting and it reduces the time to return index search results. However, NOT caching filtered text will result in a smaller index and shorter time to complete the indexing process.

Modify for TR1 Expressions

Configures the indexing engine to index TR1 regular expressions.

On selecting this option, a set of special characters (example: /, @ , :) will be automatically added under 'Letters' section and these characters will be included in the search index and search results will be generated including these characters. The special characters added should be removed from spaces box.

Create Optional Accent Sensitive Index

Generates the index in such a way that, when the “Accents are Significant” option is enabled for index searching, the investigator can optionally control whether characters with accent marks are distinguished from those without. 

For example: "abc" versus "äbc". 

FTK has always and still does default to an Accent Sensitive Index. This means that,

 "abc" will only find "abc" 

 "äbc" will only find "äbc"

Options

Description

File Types

Specify which file types to include in the OCR process during case processing. For PDF files, you can also control the maximum filtered text size for which to run OCR against.

Filtering Options

Specify a range in file size to include in the OCR process. You can also specify whether or not to only run OCR against black and white, and grayscale. The Restrict File Size option is selected by default. By default, OCR file generation is restricted to files larger than 5K. If you do not want to limit the size of OCR files, you must disable this option.

Language

Specify the output language for the OCR text.

Engine

Specify the processing engine to use for the OCR process.

Options

Description

1-100%

The OCR confidence % score for a document that had a successful OCR process; the higher the score, the higher the confidence.

No Score Available (2)

The OCR results are from a previous version.

Minimal Confidence (1)

The OCR extraction is not in a supported language or is not clear.

No Text Found (0)

The OCR process did not identify any text to extract.

OCR Skipped (-1)

The OCR process was skipped due to some condition.

OCR Extraction Error (-2)

The OCR process failed for that file.

Blank

The file does not need the OCR process; for example, a .DOC file or email.

X-DFT

Default (XS1)

This is the most generally accurate. It is always selected.

X-FST

Fast (XTB)

This is the fastest. It scores a folder by the number of files it contains that meet the criteria for a high likelihood of explicit material.

It is built on a different technology than X-DFT and does not use “regular” DNAs. It is designed for very high volumes, or real-time page scoring. Its purpose is to quickly reduce, or filter, the volume of data to a meaningful set.

X-ZFN

Less False Negatives (XT2)

This is a profile similar to X-FST but with more features and with fewer false negatives than X-DFT.

You can apply this filter after initial processing to all evidence, or to only the folders that score highly using the X-FST option. Check-mark or highlight those folders to isolate them for Additional Analysis.

In Additional Analysis, File Signature Analysis must be selected for EID options to work correctly.

Options

Description

To run stage 1 analysis only

Deselect the option to Perform Cerberus Analysis stage 2 if stage 1 threshold is greater than, then only Cerberus Analysis stage 1 is run.

To run both stage 1 and 2 analysis

Select the option to Perform Cerberus Analysis stage 2 if stage 1 threshold is greater than n. 

Specify a threshold for a minimum threat score against which you want to run the stage 2 analysis. If a file’s threat score is higher than the threshold value that you set, then stage 2 is run.

If a file’s threat score is lower than the threshold value, then stage 2 analysis is not run. By default, the threshold automatically runs stage 2 analysis against files with a threat score greater than +20.

Network

+5

The Network category is triggered when a program contains the functionality to access a network. This could involve any kind of protocol from high-level HTTP to a custom protocol written using low-level raw sockets.

Persistence

+20

Persistence indicates that the application may try to persist permanently on the host. For example, the application would resume operation automatically even if the machine were rebooted.

Process

+5

Process indicates the application may start a new a process or attempt to gain access to inspect or modify other processes. Malicious applications attempt to gain access to other processes to obfuscate their functionality or attack vector or for many other reasons. For example, reading or writing into a process’s memory, or injecting code into another process.

Crypto

+6

Crypto is triggered when an application appears to use cryptographic functionality. Malicious software uses cryptography to hide data or activity from network monitors, anti-virus products, and investigators.

Protected Storage

+10

ProtectedStorage indicates that the application may make use of the Windows “pstore” functionality. This is used on some versions of Windows to store encrypted data on the system. For example, Internet Explorer stores a database for form-filling in protected storage.

Registry

+5

Registry is triggered when a target application attempts to use the registry to store data. The registry is commonly used to store application settings, auto-run keys, and other data that the application wants to store permanently but not in its own file.

Security

+5

Imports functions used to modify user tokens. For example, attempting to clone a security token to impersonate another logged on user.

Obfuscation

+30

Stage 1 searches for signs that the application is 'packed', or obfuscated in a way that hinders quick inspection. The Obfuscation category is triggered when the application appears to be packed, encrypted, or otherwise obfuscated. This represents a deliberate decision on behalf of the developer to hinder analysis.

Process Execution Space

+2

Unusual activity in the Process Execution Space header. For example, a zero length raw section, unrealistic linker time, or the file size doesn't match the Process Execution Space header.

Bad Signed

+20

This category is triggered when a binary is cryptographically signed, but the signature is invalid. A signature is generally used to demonstrate that some entity you trust (like a government or legitimate company, called a 'signing authority') has verified the authorship and good intentions of the signed application. However, signatures can be revoked and they can expire, meaning that the signature no longer represents that the signing authority has trust in the application.

Embedded Data

+10

This category is triggered when an application contains embedded executable code. While all programs contain some program code, this category indicates that the application has an embedded 'resource', which contains code separate from the code which runs normally as part of the application.

Bad / Bit-Bad

+20

This category is triggered when the application contains signatures indicating it uses the IRC protocol or shellcode signature. Many malware networks use IRC to communicate between the infected hosts and the command-and-control servers.

Signed / Bit-Bad

-20

This category is triggered when a program is signed. A program that is signed is verified as 'trusted' by a third party, usually a legitimate entity like a government or trusted company. The signature may be expired or invalid though; check the 'BadSigned' category for this information.

PE Good

-10

Scores for good artifacts in PE headers.

PE Malware

+30

Scores for known malware artifacts in PE headers.

File Size

Displays the size of the file in bytes.

Import Count

Displays the number of functions that Cerberus examined.

Entropy Score

Displays a score of the binaries entropy used for suspected packing or encrypting.

Entropy may be packed

Displays if the files are possibly packed.

Interesting Functions

Displays the name of functions from the process execution space that contributed to the file’s threat score.

Suspected Packer List

Attempts to display a list of suspected packers whose signature matches known malware packers.

Modules

Displays the DLL files included in the binary.

Has Version

Displays whether or not the file has a version number.

Version Info

Displays information about the file that is gathered from the Windows API including the following:

Is Signed

Displays whether or not the file is signed. If the file is signed the following information is also provided:

Unpacker results

Attempts to show if and which packers were used in the binary.

File Access Functions that manipulate (read, write, delete, modify) files on the local file system.

Filesystem.File.Read.ExecutableExtension

This is triggered by functionality which reads executable files from disk. The executable code can then be executed, obfuscated, stored elsewhere, transmitted, or otherwise manipulated.

FileSystem.Physical.Read

This application may attempt to read data directly from disk, bypassing the filesystem layer. This is very uncommon in normal applications, and may indicate subversive activity.

FileSystem.Physical.Write

This application may attempt to write data directly to disk, bypassing the filesystem layer in the operating system. This is very uncommon in normal applications, and may indicate subversive activity. It is also easy to do incorrectly, so this may help explain any system instability seen on the host.

FileSystem.Directory.Create:

This indicates the application may attempt to create directory. Modifications to the file system are useful for diagnosing how an application persists, where its code and data are stored, and other useful information.

FileSystem.Directory.Create.Windows:

This indicates an application may try to create a directory in the \Windows directory. This directory contains important operating system files, and legitimate applications rarely need to access it.

FileSystem.Directory.Recursion:

This indicates the application may attempt to recurse through the file system, perhaps as part of a search functionality.

FileSystem.Delete:

This indicates the application may delete files. With sufficient permissions, the application may be able to delete files which it did not write or even system files which could affect system stability.

FileSystem.File.DeleteWindows:

This indicates the application may try to delete files in the \Windows directory, where important system files are stored. This is rarely necessary for legitimate applications, so this is a strong indicator of suspicious activity.

FileSystem.File.DeleteSystem32:

This indicates the application may try to delete files in the \Windows\System32 directory, where important system files are stored. This is rarely necessary for legitimate applications, so this is a strong indicator of suspicious activity.

FileSystem.File.Read.Windows

This indicates the application may attempt to read from the \Windows directory, which is very uncommon for legitimate applications. \Windows is where many important system files are stored.

FileSystem.File.Write.Windows:

This indicates the application may attempt to write to the \Windows directory, which is very uncommon for legitimate applications. \Windows is where many important system files are stored.

FileSystem.File.Read.System32:

This indicates the application may attempt to read from the \Windows\System32 directory, which is very uncommon for legitimate applications. \Windows\System32 is where many important system files are stored.

FileSystem.File.Write.

System32:

This indicates the application may attempt to write to the \Windows\System32 directory, which is very uncommon for legitimate applications. \Windows\System32 is where many important system files are stored.

FileSystem.File.Write.ExecutableExtension:

This indicates the application may attempt to write an executable file to disk. This could indicate malicious software that has multiple ‘stages’, or it could indicate a persistence mechanism used by malware (i.e. write an executable file into the startup folder so it is run when the system starts up).

FileSystem.File.Filename.Compression:

This indicates the program may write compressed files to disk. Compression can be useful to obfuscate strings or other data from quick, automated searches of every file on a filesystem.

FileSystem.File.Filename.Autorun:

This indicates the application may write a program to a directory so that it will run every time the system starts up. This is a useful persistence mechanism.

Networking Functionality - Functions that enable sending and receiving data over a network.

Network.FTP.Get:

Describes the use of FTP to retrieve files. This could indicate the vector a malware application uses to retrieve data from a C&C server.

Network.Raw:

 Functions in this category indicate use of the basic networking commands used to establish TCP, UDP, or other types of connections to other machines. Programmers who use these build their own communication protocol over TCP (or UDP or other protocol below the application layer) rather than using an application-layer protocol such as HTTP or FTP.

Network.Raw.Listen:

Functionality in this category indicates the application accepts incoming connections over TCP, UDP, or other lower-level protocol.

Network.Raw.Receive:

Functionality in this bucket indicates that the application receives data using a socket communicating over a lower-level protocol such as TCP, UDP, or a custom protocol.

Network.DNS.Lookup.Country.XX:

This indicates the application may attempt to resolve the address of machines in one of several countries. “XX” will be replaced by the ‘top level domain’, or TLD associated with the lookup, indicating the application may attempt to establish contact with a host in one of these countries.

Network.HTTP.Read:

The application may attempt to read data over the network using the HTTP protocol. This protocol is commonly used by malware so that its malicious traffic appears to ‘blend in’ with legitimate web traffic.

Network.HTTP.Connect.Nonstandard.Request:

This indicates the application may make an HTTP request which is not a head, get, or post request. The vast majority of web applications use one or more of these 3 kinds of requests, so this category indicates anomalous behavior.

Network.HTTP.Connect.Nonstandard.Port:

Most HTTP connections occur over either port 80 or 443. This indicates the application is communicating with the server over a non-standard port, which may be a sign that the server is not a normal, legitimate web server.

Network.HTTP.Connect.Nonstandard.Header:

HTTP messages are partially composed of key-value pairs of strings which the receiver will need to properly handle the message. This indicates the application includes non-standard or very unusual header key-value pairs.

Network.HTTP.Post:

This indicates the application makes a ‘post’ http request. ‘post’ messages are normally used to push data to a server, but malware may not honor this convention.

Network.HTTP.Head:

This indicates the application makes a ‘head http request. ‘head’ messages are normally used to determine information about a server’s state before sending a huge amount of data across the network, but malware may not honor this convention.

Network.Connect.Country.XX:

This indicates the application may attempt to connect to a machine in one of several countries. “XX” will be replaced by the ‘top level domain’, or TLD associated with the lookup.

FTP.Put:

The application may attempt to send files over the network using FTP. This may indicate an exfiltration mechanism used by malware.

Process Manipulation – May contain functions to manipulate processes.

ProcessManagement.Enumeration:

This functionality indicates the application enumerates all processes. This could be part of a system survey or other attempt to contain information about the host.

ProcessManagement.Thread.Create:

This indicates the target application may create multiple threads of execution. This can give insight into how the application operates, operating multiple pieces of functionality in parallel.

ProcessManagement.Thread.Create.Suspended:

This indicates the application may create threads in a suspended state. Similar to suspended processes, this may indicate that the threads are only executed sometime after they’re created or that some properties are modified after they are created.

ProcessManagement.Thread.Create:

This indicates the application may attempt to create a thread in another process. This is a common malware mechanism for ‘hijacking’ other legitimate processes, disguising the fact that malware is on the machine.

ProcessManagement.Thread.Create.Remote:

This indicates that the application may create threads in other processes such that they start in a suspended state. Thus, their functionality or other properties can be modified before they begin executing.

ProcessManagement.Thread.Open:

The application may try to gain access to observe or modify a thread. This behavior can give insight into how threads interact to affect the host.

ProcessManagement.Process.Open:

This application may attempt to gain access to observe or modify other processes. This can give strong insight into how the application interacts with system and what other processes it may try to subvert.

ProcessManagement.Process.Create:

This application may attempt to create one or more other processes. Similar to threads, multiple processes can be used to parallelize an application’s functionality. Understanding that processes are used rather than threads can shed insight on how an application accomplishes its goals.

ProcessManagement.Process.Create.Suspended:

Describes functionality to create new processes in a suspended state. Processes can be created in a ‘suspended’ state so that none of the threads execute until it is resumed. While a process is suspended, the creating process may be able to substantially modify its behavior or other properties.

Security Access - Functions that allow the program to change its security settings or impersonate other logged on users.

Security:

This category indicates use of any of a large number of security related functions, including those manipulating security tokens, Access Control Entries, and other items. Even without using an exploit, modification of security settings can enable a malicious application to gain more privileges on a system than it would otherwise have.

Windows Registry – Functions that manipulate (read, write, delete, modify) the local Windows registry. This also includes the ability to modify autoruns to persist a binary across boots. 

Registry.Key.Create:

The application may attempt to create a new key in the registry. Keys are commonly used to persist settings and other configuration information, but other data can be stored as well.

Registry.Key.Delete:

This application may attempt to delete a key from the registry. While it is common to delete only keys that the application itself created, with sufficient permissions, Windows may not prevent an application from deleting other applications’ keys as well.

Registry.Key.Autorun:

This indicates the application may use the registry to try to ensure it or another application is run automatically on system startup. This is a common way to ensure that a program continues to run even after a machine is restarted.

Registry.Value.Delete:

This indicates the application may attempt to delete the value associated with a particular key. As with the deletion of a key, this may not represent malicious activity so long as the application only deletes its own keys’ values.

Registry.Value.Set:

The application may attempt to set a value in the registry. This may represent malicious behavior if the value is set in a system key or the key of another application.

Registry.Value.Set.Binary:

This indicates the application may store binary data in the registry. This data could be encrypted, compressed, or otherwise is not plain text.

Registry.Value.Set.Text:

This indicates the application may write plain text to the registry. While the ‘text’ flag may be set, this does not mandate that the application write human-readable text to the registry.

Registry.Value.Set.Autorun:

The application may set a value indicating it will use the registry to persist on the machine even after it restarts.

Category

Description

Surveillance – Usage of functions that provide audio/video monitoring, keylogging, etc.

Driver.Setup:

Functionality in this category involves manipulation of INF files, logging, and other driver-related tasks. Drivers are used to gain complete control over a system, potentially even gaining control of other security products.

Driver.DirectLoad:

Functionality in this category involves loading drivers. As noted in ‘driver.setup’, drivers represent ultimate control over a host system and should be extremely trustworthy.

Uses Cryptography – Usage of the Microsoft CryptoAPI functions.

Crypto.Hash.Compute:

This indicates a hash function may be used by the target application. Hash functions are used to verify the integrity of communications or files to ensure they were not tampered with.

Crypto.Algorithm.XX:

The “XX” could be any of several values, including ‘md5’, ‘sha-1’, or ‘sha-256’. These represent particular kinds of hashes which the target application may use.

Crypto.MagicValue:

This indicates that the target contains strings associated with cryptographic functionality. Even if the application does not use Windows OS functionality to use cryptography, the ‘magic values’ will exist so long as the target uses standard cryptographic algorithms.

Low-level Access – Functions that access low-level operating system resources, for example reading sectors directly from disk.

Driver.Setup:

Functionality in this category involves manipulation of INF files, logging, and other driver-related tasks. Drivers are used to gain complete control over a system, potentially even gaining control of other security products.

Driver.DirectLoad:

Functionality in this category involves loading drivers. As noted in ‘driver.setup’, drivers represent ultimate control over a host system and should be extremely trustworthy.

Debugging.dbghelp:

This indicates use of functionality included in the dbghelp.dll module from the "Debugging Tools for Windows" package from Microsoft. With the proper permissions, the functionality in this library represents a power mechanism for disguising activity from investigators or for gaining control of other processes.

Misc.SystemRestore:

Describes functionality involved in the System Restore feature, including removing and adding restore points. Restore points are often used as part of a malware-removal strategy, so removal of arbitrary restore points, especially without user interaction, may represent malicious activity.

Debugging.ChecksForDebugger:

This is triggered if the application tries to determine whether it is being debugged. Malicious applications commonly try to determine whether they’re being analyzed so that they can modify the behavior seen by analysts, making it difficult to discover their true functionality.

Category

Description

Loads a driver

Function that loads drivers into a running system.

Category

Description

Subverts API

Undocumented API functions, or unsanctioned usage of Windows APIs (for example, using native API calls).

Document Types to Process

You can select to process the following file types:

Languages to Identify

You can select to identify the following:

Credit Card Numbers

16-digit numbers used by VISA, MasterCard, and Discover

Credit Card Numbers

15-digit numbers used by American Express

Phone Numbers

Standard 7-digit numbers 

Phone Numbers

Standard 10-digit numbers

(A leading 1, for long-distance or 001 for international, is not included in the extraction, however, a +1 is.)

International Phone Numbers 

Social Security Numbers

Standard 9-digit number

Email Address

A prefix to the left of the @ symbol and a domain to the right of the @ symbol.

Enable Advanced De-duplication Analysis.

Enable this option to perform de-duplication on the email items and non-email items. This acts as the parent function for all the child function options listed in the page.

Email Items - De-duplication Scope

Choose whether you want this de-duplication process to be applied at the Case level, or at the Custodian (People) level.

Email Items - De-duplication Options

Select the duplicates to be eliminated from the case as it processes through the collected evidence. 

Options available: 

Non-email items - De-duplication Scope

Choose whether you want this de-duplication process to be applied at the Case level, or at the Custodian (People) level.

There is only one option available for non-email items; either you are going to deduplicate just the actual files, or if unmarked, you will de-duplicate actual files only, or all files, including children, zipped, OLE, and carved files.

Propagate Email Attribute

When an email has attachments or OLE items, marking this option causes the email’s attributes to be copied and applied to all “child” files of the email “parent.”

Cluster Analysis

Invokes the extended analysis of documents to determine related, near duplicates, and email threads.

This lets you specify the options for Cluster Analysis.

You can specify which document types to process:

You can also specify the similarity threshold, which determines the level of similarity required for documents to be considered related or near duplicates.

Click Cluster Analysis Options to select the document types for performing Cluster Analysis. 

Include Extended Information in the Index

Enable this to make the index data fully compatible with Summation/eDiscovery. This is generally enabled if you created a case in Exterro FTK and need to review it in Summation or eDiscovery. 

Create Email Threads

Enable this to sort and group emails by conversation threads.

Include File Slack

To include file slack space in which evidence may be found.

Include Free Space

To include unallocated space which evidence may be found.

Include KFF Ignorable Files

To include files flagged as ‘Ignorable’ in the KFF for analysis.

Include OLE Streams 

To include Object Linked and Embedded (OLE) data streams that are layered, linked, or embedded.

eDiscovery Refinement

To exclude files and folders that are not useful for most eDiscovery cases.

Don’t Expand Embedded Graphics

This option lets you skip processing the graphics embedded in the email files. 

Deleted

To decide how to treat the deleted files. You can choose to: 

Encrypted

To decide how to treat encrypted files. You can choose to: 

From Email

To decide how to treat email files. You can choose to:

File Types

To select the required file types. You can exclude the files by proceeding to the next step without selecting it. 

Only add items to the case that match both File Status and File Type criteria

To add files matching all the criteria selected in both.

Exclude by Category

To exclude any categories from indexing.

Include File Slack

Mark to include free space between the end of the file footer, and the end of a sector, in which evidence may be found.

Include Free Space

Mark to include both allocated (partitioned) and unallocated (unpartitioned) space in which evidence may be found.

Include KFF Ignorable Files

Mark to include files flagged as ignorable in the KFF for analysis.

Include Message Headers

Marked by default. Includes the headers of messages in filtered text. Unmark this option to exclude message headers from filtered text.

Do not include document metadata in filtered text

Not marked by default. This option lets you turn off the collection of internal metadata properties for the indexed filtered text. The fields for these metadata properties are still populated to allow for field level review, but the you will no longer see information such as Author, Title, Keywords, Comments, etc in the Filtered text panel of the review screen. If you use an export utility such as ECA or eDiscovery and include the filtered text file with the export, you will also not see this metadata in the exported file.

Include OLE Streams

Includes Object Linked or Embedded (OLE) data streams that are part of files that meet the other criteria.

Deleted

Specifies the way to treat deleted files. Options are:

Encrypted

Specifies the way to treat encrypted files. Options are:

Email

Specifies the way to treat email files. Options are:

File Types

Specifies types of files to include and exclude.

Only add items to the index that match both File Status and File Type criteria

Applies selected criteria from both File Status and File Types tabs to the refinement. Will not add items that do not meet all criteria from both pages.

Refine Index by File Date

To refine index content by file date:

Refine Index by File Size

To refine index content by file size: