Skip to end of metadata
Go to start of metadata

HstEx

To get the most from the software it is important to understand the user interface and know what each feature does.  In this chapter, we will look at the various components of the user interface and understand how they work.

Main User Interface

This is the main HstEx interface with the main elements and buttons numbered for ease.

 

Figure 1

Table 1 explains each numbered item from Figure 1 above.

 

Number

Description

This button launches the Physical / Logical Device window and allows the forensic examiner to select any supported devices connected to the system (including removable devices).

This button launches the file selection window and allows the forensic examiner to select a file from which to recover data.  This may be any file based container such as a forensic image or binary dump.

This button launches the export folder window and allows the forensic examiner to select the folder which will store the recovered browser data.

This drop down list allows the forensic examiner to select which type of browser related data they wish to recover.

This drop down list allows the forensic examiner to set the block size that HstEx will use to read and search for data.  The default block size is 512 sectors (262,144 bytes).

This area contains a log of the recovery status and display information during the recovery.

This is the start button which will launch the recovery process.

Table 1

Figure 2 shows the ‘Physical / Logical Devices’ window.  Items 0 to 4 are physical devices, whereas items C to G are logical devices.  Volume F is a removable device.

 

Figure 2