Sorting by date in ...
 
Notifications
Clear all

Sorting by date in IEF

3 Posts
3 Users
0 Likes
254 Views
Novunix
(@novunix)
Posts: 35
Eminent Member
Topic starter
 

I am wondering if other users of Internet Evidence Finder would be able to assist and verify something for me?

Say for example, we want to view Internet Explorer Cache Records Carved, the current view shows multiple hits that cannot be shown in a single window, so it only displays the first page, the first 10,000 results.

If you sort a column by date/time, it then orders those results either ascending or descending.

The problem is it only sorts those 10,000 hits by date/time and not ALL the results.

For example, if you had 230,000 results and you need to sort them all by date as one might expect…how do you do this?

It appears that IEF is not checking the entire data set before sorting by date and is ONLY sorting what it can see in the current window.
Obviously this is going to present issues when it comes to reviewing this data?

Any thoughts?
All comments welcome

 
Posted : 20/06/2014 3:07 pm
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

Yeah that is a pain…. I tend to export to Excel and sort by date in there

 
Posted : 20/06/2014 5:32 pm
MagnetForensics
(@magnetforensics)
Posts: 40
Eminent Member
 

Hi Novunix,

One thing that may help (aside from the other workaround mentioned) is increasing the number of records displayed per page. You can change this under the Edit menu with the "change max records" option.

We realize this is a pain however and needs improvement and that's one of the big focuses in v6.5, reporting (exports) and user interface improvements. We'll also be drastically improving how pictures are viewed in v6.5.

Feel free to reach out to me offline if you need anything else jad(at)magnetforensics(dot)com.

Regards,
Jad

 
Posted : 20/06/2014 6:23 pm
Share: