Workspaces in ArtiFast
26/05/2023 Friday
Digital forensics analysis can be a complex and time-consuming process. Investigators need to efficiently analyze large amounts of data from a variety of sources. ArtiFast is a powerful digital forensics tool that simplifies the process by allowing users to customize their workspaces for their specific needs. In this blog post, we'll explore how workspaces in ArtiFast can be tailored to suit different digital forensics scenarios, and how investigators can create their own custom workspaces. ArtiFast provides workspace as a main view for showing results, by default the main workspace is a called (Home). A digital forensics investigator can leverage multiple workspaces to be able to perform more in-depth investigations
Why workspaces?
One of the key benefits of customizing your workspace in ArtiFast is
that it allows you to tailor your digital forensics analysis to your
specific needs. For example, if you're investigating a case that
involves a lot of email correspondence, you may want to create a
workspace that focuses on email artifacts which allows you to analyze,
view and filter email messages. Another advantage of using multiple
workspaces is that it can help you stay organized and focused. By
creating a separate workspace in each stage of your investigation, you
can quickly switch between different views and avoid getting overwhelmed
by too much data.
Forensafe team wanted ArtiFast users to be able to investigate more in
depth and as fast as possible. The whole Workspace approach came as a
result of trying to find a solution for this. The idea was to give an
analyst maximum ability to have as many complex views as possible, and
also to be able to merge or intersect them in any way they want. Each
view could be as simple as only Evtx Artifact Analysis, or it might be
an analysis based on multiple artifacts. The baseline was the main
view(Home). Any artifact parser selection, or any search on the main
view is actually a filter applied on the main view. Each workspace is a
combination of main view and a filter. Workspace technology provides an
investigator to combine or select any filters they have created and
would like to apply as many as they want on main view (parsed data) and
see the results within a blink of an eye no matter how big the parsed
data is. By using Workspace technology filters that results in millions
of lines can be combined in under one second. An investigator can create
multiple filters for both broader results and also for specific findings
in her investigation. A report based on multiple parts of an
investigation is only combining all the relevant workspaces and creating
a report based on that result. This also allows an investigator great
flexibility.
Overall, using workspaces in ArtiFast can greatly improve the efficiency
and effectiveness of your digital forensics analysis. By customizing
your workspace to suit your specific needs, you can easily access the
tools and features you need to analyze your digital evidence and uncover
important insights.
Workspace Features
The structure of ArtiFast allows users to show millions of lines
(artifact parsing results) swiftly and in one single view. An
investigator can export her findings to new workspaces, and later
combine them with “Merge” or “Intersect” them to create
subsets.
Different digital forensics scenarios require different tools and
features. By utilizing various workspaces, users can conveniently access
different views and features with diverse outcomes to help organize
data. Each workspace includes:
• Displayed results such as Artifacts, Files, and File
Categories.
• Timeline view.
• Artifact view.
• Reporting.
• Timeline filtering.
• Quick search.
Users can take advantage of these features in each separate workspace without impacting the results in other workspaces. Additionally, the Timeline View and Artifact View offer features such as Notes and Bookmarking to help users highlight the most significant results in each workspace.
How to Create a New Workspace
An investigator can create a workspace in different ways. They can select an artifact or category of their choice and then right-click and select "To New Workspace”.
Another way to create a workspace is by right-click on an existing workspace and select "New," followed by either "Blank" or "Using Keyword".A user can also create another workspace by using "Duplicate" feature so that they can continue their investigation, while securing the original workspace.
For more information or suggestions please contact: ibrahim@forensafe.com
×
