I am wondering if other users of Internet Evidence Finder would be able to assist and verify something for me?
Say for example, we want to view Internet Explorer Cache Records Carved, the current view shows multiple hits that cannot be shown in a single window, so it only displays the first page, the first 10,000 results.
If you sort a column by date/time, it then orders those results either ascending or descending.
The problem is it only sorts those 10,000 hits by date/time and not ALL the results.
For example, if you had 230,000 results and you need to sort them all by date as one might expect…how do you do this?
It appears that IEF is not checking the entire data set before sorting by date and is ONLY sorting what it can see in the current window.
Obviously this is going to present issues when it comes to reviewing this data?
Any thoughts?
All comments welcome
Yeah that is a pain…. I tend to export to Excel and sort by date in there
Hi Novunix,
One thing that may help (aside from the other workaround mentioned) is increasing the number of records displayed per page. You can change this under the Edit menu with the "change max records" option.
We realize this is a pain however and needs improvement and that's one of the big focuses in v6.5, reporting (exports) and user interface improvements. We'll also be drastically improving how pictures are viewed in v6.5.
Feel free to reach out to me offline if you need anything else jad(at)magnetforensics(dot)com.
Regards,
Jad