InSight™ Features
InSight™ has many features that are helpful to investigators. InSight™ allows investigators to “catalog” a subject’s data, which involves the creation of a system file that describes the files and folders on a drive or drives. Cataloguing is typically the first step in any investigation.
Having catalogued a drive (or drives), many different things are possible. Two search tools allow very fine-grained searches of the data to be made. Five different scripts facilitate the copying and dumping of data. Several scripts deal with “selections”, which are saved subsets of catalog files. There are tools to compare and analyze data, and various utilities. In all there are 29 scripts in the distribution (as of version 2.92).
InSight™ is written in the perl language and is thus open-source. However, it is not free software; its use is controlled by license. InSight™ is implemented as a set of graphical user interface applications for convenience, flexibility and power.
InSight™ features include:
- Robust search technology:
- Choice of regular expressions or standard search terms
- Use of multiple terms or expressions per search (up to 10 of either)
- Fine-grained control of what is searched
- Unzips zipped folders and documents up to three levels deep (so as to search the contents in the clear)
- Searches are conducted in both ANSI and Unicode (when using standard search terms)
- Eliminates duplicate files prior to searching (saves time)
- Fine-grained dumping and copying of data:
- Select or deselect files by name, extension, path or drive letter
- Select or deselect files by detected type
- Specify minimum and maximum file size
- Specify earliest and latest dates for files
- Identifies file types by contents
- Identifies text versus binary files two different ways
- Eliminates duplicate files from dumps by default, saving you time
- “Synthetic Extensions” improve file thumbnailing in dump folders