File Listing Recommendation

eDiscovery
1

Hello,

I need to create a file list from a hard drive for a group of attorneys and they need to be able to browse the list and look around as if the files were on their computer. I thought about giving them an excel file with some metadata, but that won’t have that explorer type browse effect. Does anyone know of a software that can do this?

2

FTK Imager can export the files and provide a directory listing…will that work? No cost, just register @ AccessData.com

2 Likes
3

Thank you, Carter. We have X-Ways and I have exported file lists from there before, but they found that unusable :roll_eyes: Sounds like they want to browse the folders as if in win explorer, but without actually having the files!

4

XWays can do mostly what you want – create a “Skeleton image” using XW but do not include the files – only the disk file system metadata (MFT and such) – this can be saved out as an E01. Not open that E01 in FTK – you will have the entire file name metadata and directory structure – but if you click individual files they will not have any content. You MAY be able to mount that skeleton E01 into a drive letter??? Never tried that so I dont know what Windows would say about it.


Mark

5 Likes
5

Take a look at Size Explorer.
You can “explore” any drive letter/folder and save your “exploration” as a *.sef (Size Explorer File).
Provide the *.sef file to the attorneys. They would also need Size Explorer to view the *.sef file. They can drill down into folders to see the file lists of the folder contents.
Go to sizeexplorer.com
It’s very cheap. They also have a free version.

2 Likes
6

Nice! I like that this has a command-line report generator. Reminds me of TreeSize.

1 Like
7

Great suggestions so far! Here is one from me: Snap2HTML

This allows you to scan a folder quickly and output an HTML report—including folder tree view—that is browsable, sortable, and somewhat searchable. Here is an example:

snap2html
snap2html1377×846 97.9 KB

Pros

  • The recipient doesn’t need to download any software. The HTML report can be opened in a web browser.
  • If you were to provide the files as well, it is possible to link the file entries to the underlying files with relative paths so the recipient can click on a link to open a file.
  • You can modify the template of the HTML output to suit your firm’s branding.
  • The recipient can export a subset of the data (a view) in multiple formats such as JSON and CSV.
  • Almost foolproof :smile:
  • It is free!

Cons

  • The amount of metadata you can include is very limited. Nothing like what you can do with an X-Ways file listing or the earlier suggestions above.
  • There is no ability for the recipient to tag documents of interest to export a subset file list.
  • Since everything is in the HTML, a file listing of millions of files would likely bring the web browser to its knees.
  • When linking files, one has to take into consideration how the target browser handles links to local files. Browsers by default often prompt to download such files rather than directly open them. It might be necessary to use something along the lines of Undisposition to remove the Content-Disposition header.
1 Like
8

That’s a great use case for a skeleton image, Mark! If the attorneys are comfortable with using something like FTK imager, they can browse through the file system in great detail.

For anyone who hasn’t tried this yet, the E01 part Mark mentioned is important in a scenario like this. X-Ways writes out the raw skeleton image as an NTFS sparse file by default. If sent as is, subsequent copy operations would result in the raw skeleton image file going back to the size of the full disk unless special care is taken to copy the file as a sparse file. The E01 conversion takes some extra time, but you go from an NTFS sparse file to a compressed regular file which is much easier to handle.

9

You can use a robocopy script to recreate the file structure with 0-bytes files in a new directory.

robocopy [SOURCE] [TARGET] /create /e

5 Likes
10

Great tip, Scott! You are not conveying the file size information in the output, but the timestamps, file names, paths are all there and can be browsed super easily. Fair compromise I would say.

One suggestion I’d like to make is to add the dcopy:T switch to include the directory timestamps in the output.

robocopy [SOURCE] [TARGET] /create /e /dcopy:T
11

Thanks, everyone! I went with Scott’s marvelous suggestion because it doesn’t require any software downloads for me or the attorneys. I will explore Mark’s xways skeleton image idea to be prepared for the next time this happens.

12

I see this was a while back, but if this is the case you could export the data to a fresh/zero’d HDD and then run the basic UNIX Shred with default options across the files. It would delete the content of the files and let them browse it in explorer.

1 Like
13

This kind of reminds me of the skeleton image suggestion, but might be easier to implement–getting Windows to display the skeleton image without mounting it in a forensic tool requires some care.