Feature Request - Deleted Files Search

[d8a4n6]

Currently working a case involving illicit images.

Deleted file search revealed a couple hundred picture files of potential interest.

To determine if it is something worthy of including in the case report I must open each file in the viewer and then go back to the file, right click and then select the appropriate action (for me, typically "Add To Case"). I then need to close the viewer so I do not end up with multiple viewers open as I scroll through the file list.

Possible solutions.

1. Allow for viewing of pictures as thumbnails
2. Integrate the right click menu into the file viewer (then I could scroll through the pictures using the file viewer).

- It would be nice to bookmark files in the Deleted Files Search results.
- It would be nice to compare the HASH of a file in the Deleted Files Search against a HASH set.

Added:
- Some indication that a file from the Deleted Files Search has been included in the case.

[David (PassMark)]

You are correct, these functions are missing for deleted file. But we'll add them for the next patch release. In fact all these functions are already available for normal files, so the code is largely already in OSF. It seems they were overlooked for deleted files (which are harder to deal with as they aren't really files, just a collection of disk sectors).

So we'll add if possible,
1) A function to add deleted items to a case directly from the file viewer via a right click in the viewer window. (This will bring the behaviour with deleted files in line with normal files in the viewer)


2) Flags in the deleted file listing to indicate if an item is already in the case (this might not be trivial for files that are carved and don't have a proper name, but maybe we can give them a more unique name, we will need to investigate)

3) Ability to look up a deleted file in the current hash without first needing to undelete all the files.

A work around for all of the above is to select all the Delete files, Save All (from right click) to a temp folder, then work on the temp folder. Once the undeleted files saved back as normal files, the 3 functions above are available.

Update: These 3 features were adding in OSF release V1.1.1003