Using a filter to hide duplicate files is an optional method of managing the amount of files surveyed.
Select Additional Analysis from the Evidence menu.
Select Flag Duplicate Files from the File Hashes group and click OK.
- This will start a comparison of the checksums of all files in the collection.
- When complete close the Data Processing window.
- Click the column settings button from the File List window.
- Click the import button and navigate to Storage(F:)\FTKsettings\ColumnDefs\Duplicates.xml
Click OK and close the column settings window.
- Select Duplicates from the column dropdown.
- Note the Duplicate File field in the File List.
- Note the number in the Duplicate File field.
If the Duplicate File field is blank the file has not been analyzed for duplication.
- 1 indicates the file is duplicated but it is the first instance of that file hashed in the case.
- 2 indicates the file is a duplicated and not the first instance of that file hashed in the case.
- 3 indicates the file is unique and does not have a duplicate in the collection.
- Click the import filter button from the Filter Manager
- Navigate to Storage(F:)\FTKsettings\FilterDefs\DuplicateSecondary.xml
- Click open and OK to import it into the case.
- Use the filter to either include or exclude secondary duplicates from the File List.
Example: File list excluding secondary duplicates.
Example: File list including only secondary data sets.