AXIOM 1.2.6.8944Copyright 2009-2018 Magnet Forensics® Inc.
Build 1.2.6.8944
Case Number: 0001-LoneWolf-2018
Examiner: 
Description: 
Case Information Generated At: Apr 13, 2018 23:04:11
Operating System: Microsoft Windows NT 6.2.9200.0
Runtime Version: 4.0.30319.42000

Settings:
=========
Remove duplicates enabled: True
Acquire image segmentation enabled: False
Acquire image segmentation size: -1
Acquire image hashing enabled: True
Acquire image compression type: Fast
Acquire device cleanup enabled: False
Search Alerts entered: 0
Keywords entered: 0
Keyword regex count: 0
Dynamic app finder enabled: False
Picture and video categorization enabled: False
Files skipping by hash enabled: False
Case logo configured: False
Output Folder: E:\CFRS 780 Lone Wolf Scenario\AXIOM - Apr 13 2018 225451\
Image Folder: 

Selected source:
================
LoneWolf.E01 - Partition 1 (Microsoft NTFS, 499 MB) Recovery

Searches selected:
------------------
pagefile.sys
swapfile.sys
$MFT
$LogFile
hiberfil.sys
Volume Shadow Copies
Unallocated Clusters
File Slack Space
All Files and Folder
Uninitialized File Area

Selected source:
================
LoneWolf.E01 - Partition 2 (Microsoft FAT32, 99 MB) NO NAME

Searches selected:
------------------
Unallocated Clusters
File Slack Space
All Files and Folder

Selected source:
================
LoneWolf.E01 - Partition 3 (16 MB)

Searches selected:
------------------
Sector Level

Selected source:
================
LoneWolf.E01 - Partition 4 (Microsoft NTFS, 476.34 GB)

Searches selected:
------------------
pagefile.sys
swapfile.sys
$MFT
$LogFile
hiberfil.sys
Volume Shadow Copies
Unallocated Clusters
File Slack Space
All Files and Folder
Uninitialized File Area

Selected source:
================
LoneWolf.E01 - Unpartitioned Space

Searches selected:
------------------
Unpartitioned Space

Search items selected:
======================

Platform: Computer
------------------
Adobe Flash Cookies / Local Shared Objects
Bing Toolbar
Chrome
Cortana
Dropbox
Edge
EML(X) Files
Encrypted Files
Encryption / Anti-forensics Tools
Excel
Facebook
File System Information
Firefox
Gmail Webmail
Google Analytics
Google Docs
Google Drive
Google Maps
Google Talk
Google Toolbar
Google+
Installed Programs
Internet Explorer
IP Addresses - Audio/Video Calls
Jump Lists
Keyword Searches
LinkedIn
LNK Files
Lync / Office Communicator
Malware/Phishing URLs
MBOX E-mails
Network Interfaces
Network Profiles
Network Share Information
Notification Center
OneDrive
Operating System Information
Outlook Web App
Outlook Webmail
PDF
Pictures
Pornography URLs
Potential Browser Activity (Incl. Private/ Incognito URLs)
PowerPoint
Rebuild Webpages
Recycle Bin
RTF Documents
SharePoint
Shellbags
Shim Cache
Skype
Startup Items
Text Documents
Timezone Information
Twitter
USB Devices
User Accounts
UserAssist
Videos
Virtual Machines
Web Video Fragments
Webpage Recovery
WeChat
Windows Event Logs
Windows Logon Banner
Windows Mail
Windows Prefetch Files
Word

Summary:
========
Start Time: Apr 13, 2018 23:04:10
End Time: Apr 14, 2018 03:00:23
Search Duration: 03:56:10
Indexing Duration: 00:00:41
Search Outcome: Success

Verified Images:
================
LoneWolf.E01
------------
Verification Started: Apr 14, 2018 06:38:35
Verification Finished: Apr 14, 2018 07:00:23
MD5 Image Hash: 7af48fa65519e84246b1729e5b68f140
MD5 Verification Hash: 7af48fa65519e84246b1729e5b68f140
Outcome: MATCH

Final results of search:
========================
Carved Video: 382 items
Chrome Autofill: 401 items
Chrome Cache Records: 17502 items
Chrome Cookies: 2945 items
Chrome Current Session: 31 items
Chrome Current Tabs: 266 items
Chrome FavIcons: 1399 items
Chrome Last Session: 7 items
Chrome Last Tabs: 1 items
Chrome Logins: 6 items
Chrome Shortcuts: 103 items
Chrome Sync Data: 253 items
Chrome Top Sites: 16 items
Chrome/360 Safe Browser Carved Session/Tabs: 2 items
Classifieds URLs: 234 items
Cloud Services URLs: 495 items
EML(X) Files: 7 items
Encrypted Files: 5760 items
Excel Documents: 44 items
Facebook URLs: 107 items
File System Information: 3 items
Firefox SessionStore Artifacts: 14 items
Google Analytics First Visit Cookies: 11 items
Google Analytics Referral Cookies: 11 items
Google Maps: 70 items
Google Maps Queries: 178 items
Google Maps Tiles: 182 items
Google Searches: 663 items
Identifiers: 60 items
Installed Microsoft Programs: 6 items
Installed Programs: 19 items
Internet Explorer 10-11 Content: 765 items
Internet Explorer 10-11 Daily/Weekly History: 106 items
Internet Explorer 10-11 Dependency Entries: 30 items
Internet Explorer 10-11 Downloads: 1 items
Internet Explorer 10-11 Main History: 130 items
Internet Explorer Cache Records: 5 items
Internet Explorer Favorites: 7 items
Internet Explorer Typed URLs: 4 items
Jump Lists: 58 items
LNK Files: 537 items
Network Interfaces (Registry): 5 items
Network Profiles: 1 items
Operating System Information: 1 items
Parsed Search Queries: 57 items
PDF Documents: 22 items
Pictures: 48581 items
Potential Browser Activity: 32568 items
PowerPoint Documents: 20 items
Rebuilt Webpages: 487 items
Recycle Bin: 248 items
RTF Documents: 95 items
Shellbags: 29 items
Shim Cache: 406 items
Skype Accounts: 1 items
Social Media URLs: 108 items
Startup Items: 11 items
Tax Site URLs: 3 items
Text Documents: 240 items
Timezone Information: 1 items
USB Devices: 11 items
User Accounts: 8 items
UserAssist: 71 items
Videos: 74 items
Windows 8/10 Prefetch Files: 815 items
Windows Event Logs: 56092 items
Word Documents: 69 items