Table of Contents
About File Search
The File Search tool can be accessed either from the Tools menu or by right-clicking on a data source node in the Data Explorer / Directory Tree. By using File Search, you can specify, filter, and show the directories and files that you want to see from the images in the currently opened case. The File Search results will be populated in a brand new Table Result viewer on the right-hand side.
Note: Currently File Search doesn't support regular expressions. The Keyword Search feature of Autopsy does support regular expressions and can be used for to search for files and/or directories by name.
How To Open File Search
To open the File Search, you can do one of the following thing: Right-click a data source and choose "Open File Search by Attributes".
or select the "Tools", "File Search by Attributes".
How To Use File Search
There are several categories that you can use to filter and show the directories and files within the images in the current opened case. The categories are:
- Name: Search for all files and directories whose name contains the pattern given. Search is on the file/directory name only and does not look at the parent path. Note: it doesn't support regular expression and keyword matching.
- Size: Search for all files and directories whose size matches the pattern given. The pattern can be "equal to", "greater than", and "less than". The unit for the size can be "Byte(s)", "KB", "MB", "GB", and "TB".
- MIME Type: Search for all files with the selected MIME type. Multiple types can be used by holding SHIFT or CTRL while selecting.
- MD5: Search for all files with the given MD5 hash.
- Date: Search for all files and directories whose "date property" is within the date range given. The "date properties" are "Modified Date", "Accessed Date", "Changed Date", and "Created Date". You must also specify the timezone for the date given.
- Known Status: Search for all files whose known status is recognized as either Unknown, Known, or Known Bad. For more on Known Status, see the Hash Lookup Module. To use any of these filters, check the box next to the category and click "Search" button to start the search process. The result will show up in the "Result Viewer".
- Data Source: Search only within the specified data source instead of the entire case. Note that multiple data sources can be selected by holding SHIFT or CTRL while selecting.
Here's a contrived example where we try to get all the directories and files whose name contains "hello", has a size greater than 1000 Bytes, is in JPEG format, was created between 06/01/2018 and 06/08/2017 (in GMT-5 timezone), is an unknown file, has a hash of 1127F348BD4303A4C3D1D587C807B49F, and appears in data source "image3.vhd":
