Creating a New Case

Prior to importing any data, you need to create a new case workspace; this can be done by selecting New Workspace from the File menu.

 

 

This allows you to set the case reference and agency/company information. You can also set the location for the export folder and temporary folders. During import, NetAnalysis® will export a number of artefacts such as web page previews, thumbnails and extracted text from search indices. The Auto-Generate option allows NetAnalysis® to create case and evidence references for you. This information should be replaced by your own reference values.

Import Options

The second tab shows the various Import Options which can be set. The time zone and encoding can be set, prior to importing any data. It is important to establish the time zone of the target system prior to importing any data as this has a direct effect on the calculation of local time stamps. The code page default will be the set to the code page value for your system. The Known Passwords box is for adding any known Master Passwords to allow NetAnalysis® to automatically decrypt username and password information.

 

 

Time Zone

Clicking on the button next to the time zone shows the following window. This allows the user to select the appropriate time zone and see the time zone settings and dynamic daylight saving options.

 

Code Page

Clicking the button next to the code page shows the following window. This allows the user to select the appropriate code page (if required).

 

Importing Data

Once a new case has been created, data can be imported from an individual file, a collection of files, or recursively through a folder structure where supported file types are identified and imported. To import data, select either of the following:

  • File » Import » Data from File(s)
  • File » Import » Data from Folder

 

 

NetAnalysis® will then search the source looking for supported file types. Once this has completed, any identified files will be imported.

 

 

During the import process, NetAnalysis® displays a progress windows (as shown above). This window shows the progress of the import and flags to the user if any issues are encountered.

Reviewing the Imported Data

When the data has finished importing, NetAnalysis® will load the data into the main grid for review.

 

Docking Panel Layout

NetAnalysis® v2 has a new docking panel layout. To view all of the available panels, select Window » Show All Windows. This will activate all of the docking panels as shown below.

 

 

The panels can be moved and docked to any desired location. They can even be pulled free from the main application and placed in a second monitor if required. Once you find a layout that you like, you can save it for later re-use. To save a layout, select Window » Save Window Layout.

URL Examination and Analysis

To activate the URL Examination and Analysis window, right click on a record and select Examine URL. This will open the window shown below.

 

Saving Your Workspace

At this point, you may wish to save your workspace database. This can be done by clicking on the save button or select File » Save Workspace.

Export Cache and Rebuild Web Pages

After all live data has been imported, the next phase of the investigation is to extract all cached items and rebuild all available web pages. This allows you to review the pages in the NetAnalysis® viewer. This can be done by selecting Tools » Export and Rebuild Cache (Ctrl+Shift+E). The viewer panel can be activated by selecting View » Viewer (Ctrl+Shift+V). Remember to activate the filter for the Live Cached Web Pages if you want to review them in the viewer. The easiest way to do this is to execute the following steps.

  1. Activate a layout for the examination of rebuild web pages. Select Window » Load Window Layout and select the Web Page Viewing layout file.
  2. Click on the Filter Manager tab and select the Live Cached Web Pages filter. Right-click and select Apply Filter. This will filter the live cached web pages.
  3. Click on the Index Text tab and view the text data associated with the entry. With cached web-pages, this will be the extracted text from the page without the associated code.
  4. Your layout should look similar the the image below.

 

Create a Search Index

During the import process, and during the cache extraction process, we identify and extract text from a number of different sources which is associated with each entry. This text can be indexed using our powerful Search Engine and then searched. This is a very powerful feature of NetAnalysis®. To create the Search Index, select Index » Create Index from the menu. Once the Search Index has been created, you can search by selecting Index » Search Index from the menu. Enter the text to search in the box and press Enter or the Search button.

 

 

Right-clicking on an entry allows you to identify the original source entry in the main grid, as well as performing a number of other functions.

Download NetAnalysis® User Guide

The NetAnalysis® User Guide can be downloaded by clicking this link: