BlackLight Quick Start Guide
-
Open BlackLight and click on New
-
Name and Save case file to desired location (local host drive is recommended)
-
Click on the green Add button to ingest Evidence
-
Select either an Attached Device OR click on the green Add button to ingest a Disk Image, File, or Folder
-
Select desired processes to run under Ingestion Options and click Start
Note - Clicking on the ellipsis button [...] opens another window for further options
-
Processing options can also be clicked on to Run from the Evidence Status view
Once the Parsing column shows complete with green checkmark, artifacts can be examined
-
Click on the Evidence item and the desired category to view data