During your practitioner role, you may often be asked to “hone in” on directories that are named a certain thing or that contain a certain word. This is quite expected given the nature of fiscal investigations especially where data is often ordered in quite a well structured way. That said, it is equally true for other cases if you have information to suggest that directory names are or may be in use.
Using X-Ways Forensics, it is possible to exclude all files and directories from view except those that are in a directory of a certain name or that contains a certain word. This is an enormously powerful feature that is, I think, unique to XWF. It enables you, for example, to preview live evidence (by running XWF off of your USB drive or whatever connected to the target machine) or disks that you've taken out of a machine and conduct a quick assessment as to whether directories of a suspects name or company name or a type of fraud exist. In some cases, relying on this won't be that reliable, but in many kinds of cases it is – you might have information already telling you that directories like that do exist and you are asked to find them and extract the data from them amidst thousands or millions of others, and only them, perhaps as part of an evidence container.
Best of all, using this feature is easy!
Add your evidence object, be it a disk or an image or whatever.
Before enabling your path filters which I am about to explain, you need to ensure your XWF options are set such that filters are actually applied to directories! Such is the flexibility of XWF, it allows this to be the case or not but if you didn't know of the option, you'd try to use the feature it and it wouldn't appear to work! All you do is bring up the Directory Browser Options and ensure 'Apply filters to directories, too' and 'List dir.s when exploring recursively' are both ticked and click OK.This will ensure that when you apply your filter and then right click the root of your evidence for a recursive list, you are actually shown those that are directories.
Then, you can either left click the little filter funnel to the left of 'Path' (if the 'Path' column is not visible, right click any of the columns and enter a pixel number for the width of the column next to the entry for 'Path' and move it left or right in your view by clicking up or down with it's radio button – I tend to use 100 pixels by default) to set your Path based filter settings or you can go back to Directory Browser Optionsand do it there, as seen in the trwo screenshots below:
or
In addition, you can really go to town with this – you're not restricted to one name at a time. As you can see from the screenshot, you might have a sheet of dozens of company names – no problem. Add them all into the dialog box and X-Ways Forensics will display all the folders containing any of the search strings you've entered which you can then selectively add to your evidence container.
The screenshots below show my intial top level view of my two evidence objects. Now, I know there is a folder called '0001' in there somewhere, but rather than going through each folder, I will apply a path filter of '0001':
The screenshots below show my intial top level view of my two evidence objects. Now, I know there is a folder called '0001' in there somewhere, but rather than going through each folder, I will apply a path filter of '0001':
 |
| My initial Case Data top level view |
 |
| Adding a Directory Search String of '0001' |
 |
| Right click at the Case Root for a Recursive Explore |
 |
| Voila. All files in a directory called '0001' are listed |
You might also be picking up from the work of someone else and need to quickly list all the folders that they had seen or used. A fellow worker may have listed 40 or 50 files that he pasted the details of into a spreadsheet but didn't bookmark that. Or you may have a stash of data that another tool was incapable of dealing with so you want to repeat the work in XWF. You now want to quickly just list the folders in question...No problem – paste the 'Path' field from your spreadhseet into the 'Path' filter of X-Ways Forensics and voila (though you may need to apply a file filter too, depending...more on that below)!
It stands to reason that the same technique can be applied to file names! Either in full or in part. Again, you might want to list all files that have 'HSBC' somewhere in their title. So, just left click the funnel to left of the 'Name' column (and ensure it is visible too in the same way as you did for 'Path') and enter one or more substrings to search for.
WARNING! Be careful now! You now have two filters set!! So it will only show you files containing 'HSBC' in their name if they are in folders that also have 'HSBC' in their parent folder name. If you want to look for files anywhere in your case that contain 'HSBC' in their file name but you're not concerned what folder they are in, deactivate your 'Path' filter first and then apply your name filter. This kind of warning is for everything you do with X-Ways Forensics.
Once you're done, don't forget to deactivate all filters to avoid it excluding data for your next case as filters are set per installation, not per case.
NOTE: I have used HSBC as an example only. This post has nothing to do with the actual affairs of HSBC in anyway and neither do I professionally.
A video is to follow once I find my new microphone!
