Thumbnails in report

[alexflex]

Hello to all
and thanks for what is becoming one off the best FOrensic tool I'm
testing (and I will probably buy it now).

I have just few questions left. Here is one :
How do we manage pictures (and other) thumbnails in the report ?
Is there a way to have them inside, or do you have any suggestion
to resolve that ???

Thanks a lot!
Alex

[David (PassMark)]

While images can be linked to a report, there is no automatic way to get image thumbnails into a report (without some manual editing of the report).

It should be possible to script it. The script would need to find the image links in the report (which is in HTML format), then add some an <img> tag for each image found with the X,Y dimensions you wanted for the thumb.

[alexflex]

Thank you very much for your answer.
So, is there any way to EXPORT those pictures from the 'file name search' (or other) tool ?

Thanks

[David (PassMark)]

There are a few options for exporting pictures.

1) Add the file to the current case. Right click on the file and select "Add to case -> File(s)". The file will be copied into the case folder. The case folder for each case can be found in the "Manage case" window.

2) From the file system browser, right click on the file and select 'Save to disk'

3) Right click on the file and select "Copy of clipboard". You can then paste it into other programs.

4) Whole folders and sub folders can also be copied from the "Forensic Copy" function. Which is available in the main navigation menu.

But it wouldn't be a bad idea if we also added the 'Save to disk' function directly in the File name search function.

[mygeek911]

Alex,

It's not impossible, but it isn't the easiest process. First I use IrfanView to do a batch conversion and rename. I set the output to JPG/JPEG format with advanced options for resize of "Set long side to 100 pixels" and the preserve aspect ratio/use resample functions checked. The name pattern is "$N-t" without the quotes so that it uses the original filename and appends a "-t" to the end of it for the thumbnail; this addition helps me know up front the file is a thumbnail. IrfanView then saves the new file as a JPG regardless of its original extension (JPG, BMP, PNG, GIF). I'll save an entire FILES or UNDELETE folder into an empty temporary folder somewhere so I can copy the output files into the original FILES or UNDELETE folders. (Note: IrfanView is free for private, non-commercial use. I *highly* recommend paying the 10 EUROS to register it as it is such a small price to pay to convert everything quickly and easily.)

To complete the process, I wrote an Excel VBA macro that takes the HTML from the report.html file and adds a new column between the "Title" and "Date Added" columns in both the "Undeleted Files" and "Exported Files" sections. It goes through and adds the code for a clickable thumbail to be shown in the case report. The idea of having it clickable is so that I don't have to provide a Title for each image file. One of my cases, with over 8,000 images, doesn't have a single Title in it, thus making the clickable thumbnails essential for the report.

For some reason OSForensics doesn't copy the Undelete folder to the Case Report folder. As such, I copy the folder there after generating the report from OSForensics but before modifying it further with Excel.

If you are interested in the Excel file, I'd be happy to share. Simply send an e-mail to bill [at[ mygeek911 [dot[ com. If I get enough interest, I'll just put it on Mega.co.nz or something. The one thing I would like, however, is that if you end up making changes to it to make it better, I'd like a copy to add those improvements to my own.

It is still a work in progress and there are a few things I am hoping to accomplish with it yet:

1. Add a dialog box to open the report.html file, remix it, and then save it (saving the original report.html file to something like report.original.html)
2. Remove any duplicate files based off equal SHA-1, SHA-256, and MD5 hash sets
3. For the undeleted files, check the meta file and verify that there are no CreateTimes or ModifiedTimes; if there are then add them to the case (for some reason OSForensics treats undeleted files as not having a created or modified time, but I do have actual undeleted files [found with OSForensics] with those timestamps and this is important to the case)
4. Using the Notes field as a flag so that if I type "Red", "Yellow", or "Green" (or "R", "Y" or "G") without the quotes that it will automatically put those into the correct bookmarks section (I really don't like the current process of bookmarking since it is convoluted and unintuitive)

I have used the Excel spreadsheet with two cases so far. Both have several thousand images in them and it works wonderfully for what it's worth. For some reason, Chrome won't show all of the thumbnails (it cuts off after about 6,000 of them) in the modified report but Firefox does show everything without problem.

Please note that I am using OSForensics Version 2.0 Build 1003 (64-bit) so the report files are tailored to that specific version. I haven't tested on any other builds. And I am using Excel 2013 64-bit.