Pieces0310

取证须让证物说话,莫妄以自我心证来给案情下定论.切忌画靶射箭,为找而找. 取证的根基仰赖经验与判断,在IT各领域的经验愈丰富,愈能看出端倪. 取证须善用工具,但不过度依赖工具.工具只能帮你缩小可能范围,但无法告诉你答案,仍需靠人进行分析判断.

首页 新随笔 联系 订阅 管理

A case about business secret the suspect took lots of photos and screenshots from BOM, RD papers... We have to conduct a keyword search to find out what he/she had stolen. We're not going to spend time to "take a look" at all documents and pictures so we need to use OCR function to figure it out. As you could see that FTK OCR options support file type like pdf,jpg,tiff..etc.

 

1.First we have to check OCR function when processing evidence.

 

2. Sorry I can't show you guys contents in the evidence. So I use other files instead of files in the evidence. The search critereia is "apple" or "fbi". As we could see that the search result is 20hits on a file - order.pdf. No any other htis on other files in the evidence.

 

 

 

 

3.But what about other files??? Actually some pictures also have  "apple" or "fbi", but FTK could not recognize them. You guys could take a look at those two pics as below;

 

 

4.Let's use other OCR tool like JOCR to figure it out. Fortunately JOCR could recognize texts in those two pictures and extract them successfully.

 

 

5. To my surprise FTK could not extract texts on those pics. I used to trust its OCR function, but now my confidence on FTK's OCR function is eroded. 

 

posted on 2016-03-20 14:11  Pieces0310  阅读(557)  评论(0)    收藏  举报