3.3.6. Logical Files

3.3.6.1. What is it

Allows you to import a folder of files. If registry hives and event logs are at the correct relative offset, then they will be parsed. For example:

  • The SAM registry hive could be locally stored at c:\cases\case1\host1\windows\system32\config\SAM.

  • You should import the c:\cases\case1\host1 folder so that the SAM file is at its usual relative offset.

All files in the imported folder will be added to the Incident.

Watch the Cyber Triage Basics Course Logical File video on this technique.

3.3.6.2. How to Get The Data

Use any file copying or collection tool. Some will preserve time stamps better than others, but all time stamps will be ignored when they are added.

We really recommend you use a collection method that records timestamps.

3.3.6.3. Where To Put Your Data

The following locations are supported based on your access method:

Application

Supported Locations

Standard

Locally accessible

Team, Web Client

Not supported

Team, Local Client

Locally Accessible

If you are using the Team with a local client and the data is locally stored, then the client will do the parsing and send the results to the server. The client must continue to run until the parsing is complete.

3.3.6.4. How to Import

To add Logical Files data, choose Add New Host from the Incident Overview and choose the Logical Files box.

../../_images/import_add_logical.jpg

  1. Browse to the logical file directory, press Select.

  2. Update the display name and reference date as needed.

  3. Press Continue to then configure what data types to collect (see Specifying Data Collection Types) and malware settings (see Ingest-Time Settings).

The software will warn you if it cannot find a Windows subfolder within the selected folder, which may indicate that the incorrect folder was specified.