Picture and Video Analysis Improvements in IEF v6.5
This is the seventh and final blog post in a series about the new features included in IEF v6.5
http://www.youtube.com/watch?v=BYB1Fdzq3BY&feature=youtu.be
Visual evidence often tells the most compelling story, which is why we have made some improvements to our picture and video analysis capabilities with the release of IEF v6.5. New features will help you review media data more efficiently, and allow for more control when creating reports with photo and video evidence. Please read on for more details.
Pictures
By default, IEF will save recovered pictures in their original size. With IEF v6.5, users can now resize recovered pictures to a defined width/height, preserving aspect ratios. To make this adjustment, select the ‘+’ icon next to the ‘Pictures’ media option on the artifacts page of IEF. In reducing the size of recovered photos, investigators can review their findings faster, and can also easily store results on small storage devices, like a USB drive.
We have also redesigned the picture viewing pane to make it easier for examiners to view and analyze the pictures in their case file. Rather than having to navigate through numerous pages to view all recovered pictures, you can now review results on a single page with our new continuous scroll feature. Additionally, examiners can also increase or decrease the size of the thumbnails within IEF Report Viewer.
In IEF v6.5 we have also added various sorting functionalities. You still have the ability to sort pictures by skin tone and hash category, but can now sort pictures in your case by size, skin tone percentage, source, date and more (see below screenshot). This allows you to quickly get to the pictures that are most relevant to your investigation.
In addition, picture files can now be exported to a location of your choice. Users should note that you will not be able to export pictures in their original size if you have used the resize option prior to running your search. You can, however, decrease the size of your pictures when creating and exporting your report.
Videos
We often get questions about the difference between ‘videos’ and ‘carved videos’. Videos are live files that are saved on a device, whereas carved videos are found in a device’s unallocated space or file slack, and have typically been deleted by the user. IEF is capable of finding both live and deleted videos.
By default, IEF won’t save recovered live videos in their entirety. Instead, it will create a short preview (5 screenshots of these video at 20% increments), that can be viewed in IEF Report Viewer. Any carved videos, on the other hand, will be recovered and saved. If you have a case where you have a small destination folder (for example, if you are using our Triage module in the field), you may want to keep these default options:
New with IEF v6.5, you now have the option to save both live and carved videos in their entirety, if you wish. Prior to running a search, you can define the maximum file size of videos you would like to recover, as well as the maximum length of carved videos. For videos that exceed the parameters you’ve set, IEF will still recover file data, but won’t pull the actual video itself. If video files aren’t highly relevant to your investigation, you may want to consider maintaining the default options, as recovering and saving video files will increase the amount of time it takes to run an IEF search, and will also increase the size of your case file. However, if video files tend to be critical to your investigations, this is a great new feature.
We have also made some improvement to our video analysis capabilities in IEF v6.5. As mentioned above, 5 screenshots are created for each video file (regardless if you decided to save videos or not). By hovering your mouse over the Video thumbnails within IEF Report Viewer, you can easily scroll through and view these screenshots. You can also increase the size of video thumbnails and sort by skin tone directly in IEF Report Viewer. Additional sorting and exporting options can be accessed by right-clicking on individual thumbnails.
To open videos, right-click on the file, click “Open File” and select the video player you would like to use. You are able to open the video file using the Windows Default video viewer program, or you can set an IEF Default viewer.
To set your IEF Default video player, select the “Open With…” option, and choose your preferred video viewing program. Check off the box that says “Automatically use this program for video files” and all your videos will launch with the defined player. In the below screenshot, I have selected VLC as the IEF Default player.
We understand that many investigations involve a large amount of video and picture files and we hope the additional media analysis functionalities in IEF v6.5 will allow you to quickly and efficiently analyze the evidence in your case.