The BlackLight Forensic Analysis Software Metadata File Filters
Handheld device geo-location metadata is extremely valuable to a forensic investigator attempting to prove a suspect’s whereabouts. Looking back at my days as an investigator, I realize how incredibly useful it would have been to be able to quickly identify picture or movie files, and then tie those files to both a time stamp and an exact longitudinal and latitudinal media creation location.
BlackLight 2012.R1 (and newer) does just this with two new enhancements to our popular and powerful File Filter feature. The ‘Metadata Field’ and ‘Metadata Value‘ file filters enable a forensic examiner to quickly isolate data by a metadata attribute or by a metadata value respectively. For example, to isolate files containing the ‘GPS’ metadata attribute, from the first file filter drop-down menu, select ‘Metadata Field,’ leave ‘contains’ (default) selected in second drop-down menu, and in the text field, type ‘gps.’ Select the Filter button and all the files containing GPS metadata are isolated.
A forensic examiner can also identify and isolate pictures taken with a specific camera make, i.e. Nikon, Canon, or Sony, using the BlackLight ‘Metadata Value’ file filter. For example, simply select the ‘Metadata Value’ filter and enter ‘Nikon’ in the file filter text field to display all files containing the keyword ‘Nikon’ in the files’ metadata. During an iPhone forensic examination, the ‘Metadata Value‘ file filter can be used to identify and isolate pictures and/or videos created with an Apple iPhone.
For more information about our BlackLight forensic analysis software, visit the BlackLight product page or view a product demo on BlackBag TV. Please feel free to contact support with any other questions or comments.