±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 5
New Yesterday: 12
Overall: 26994
Visitors: 61

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

A software to show in a tree the FTK Imager filelists?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3, 4  Next 
  

A software to show in a tree the FTK Imager filelists?

Post Posted: Thu Jan 09, 2014 8:17 pm

Update: I wrote a tool for loading the filelists and made it freely available here.

The text below is the original forum post

As the title says I'm looking for a software that can load the FTK Imager filelist (CSV) and show it in a explorer-like tree, is there any?

In case there isn't, would it be a good idea to write one?

Edit: I made an example image, I need something like this, a tool that loads the CSV and shows it similarly to how the disk image it was generated from looked when loaded in Encase/FTK, allowing to easily browse the contained files:
 

Last edited by francesco on Mon Apr 14, 2014 5:03 pm; edited 1 time in total

francesco
Member
 
 
  

Re: A software to show in a tree the FTK Imager filelists?

Post Posted: Fri Jan 10, 2014 4:26 am

I'm not aware of one - it'd certainly be very useful. Have been asked by clients for similar before. Are you proposing to write one?
_________________
Forensic Control
twitter.com/ForensicControl 

Jonathan
Senior Member
 
 
  

Re: A software to show in a tree the FTK Imager filelists?

Post Posted: Fri Jan 10, 2014 7:14 am

Something (loosely) similar to this:
www.dhtmlgoodies.com/i...ree_static
but parsing a .csv?

I would say (cannot say if you use or can use Delphi) the best choice would be to put together a small app making use of this:
www.soft-gems.net/inde...l-treeview

or similar.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: A software to show in a tree the FTK Imager filelists?

Post Posted: Fri Jan 10, 2014 8:29 am

Whilst it doesn't take the .CSV file in, TreeSize has proven very handy on occasions!

www.jam-software.com/treesize_free/  

Doug
Senior Member
 
 
  

Re: A software to show in a tree the FTK Imager filelists?

Post Posted: Fri Jan 10, 2014 9:31 am

- Jonathan
I'm not aware of one - it'd certainly be very useful. Have been asked by clients for similar before. Are you proposing to write one?

I basically already wrote one, the screenshot above is an implementation I put together shortly after posting but will that be enough? People would very likely want to search the filelists, for example to have all the folders containing documents, mail archives or instant-messengering databases pointed out.

- jaclaz
Something (loosely) similar to this:
www.dhtmlgoodies.com/i...ree_static
but parsing a .csv?

I would say (cannot say if you use or can use Delphi) the best choice would be to put together a small app making use of this:
www.soft-gems.net/inde...l-treeview

or similar.

jaclaz


I learned several languages through the years but never Delphi (I settled with C++, C# and Java) so unfortunately I can't use that. I'm pretty happy with ObjectListView (.NET), the one in the screenshot (it implements a virtual mode as well). It's not very fast (though extremely customizable) but unless the entries in a single directory surpass the dozens of thousands hopefully there shouldn't be any noticeable delay. Using WPF would be the easiest way due to all the automatic data binding but unfortunately I still haven't got enough experience with it.  

francesco
Member
 
 
  

A software to show in a tree the FTK Imager filelists?

Post Posted: Fri Jan 10, 2014 11:59 am

Here are two great applications that make Windows Explorer type spreadsheet reports:

1) SizeExplorer: www.sizeexplorer.com/

2) Drive Inventory: www.elegantpie.com/dri...ntory.html  

UnallocatedClusters
Member
 
 
  

Re: A software to show in a tree the FTK Imager filelists?

Post Posted: Fri Jan 10, 2014 12:48 pm

- UnallocatedClusters
Here are two great applications that make Windows Explorer type spreadsheet reports:

1) SizeExplorer: www.sizeexplorer.com/

2) Drive Inventory: www.elegantpie.com/dri...ntory.html


I don't understand how that would work, I only have the CSV files, not the disk images.  

francesco
Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 4
Go to page 1, 2, 3, 4  Next