Searching and sorting images

Using the File Name Search function in OSForensics, it is possible to search for images across an entire hard drive, a disk image, or just a folder. More precise filtering by date and file size is also available from the configuration window.

Once all the image files have been found, you can sort them by foreground or background color (using the Sorting drop down list).

The images found in the initial search will then be analysed and sorted in the following order: reds, pinks, oranges, skin tones, browns, greens, blues & purples. While the result isn't always perfect, as many images are a fix of colours, it can still significantly improve the speed of examining a large number of images by grouping the images together. So it can be useful in image triage & finding the folders on the disk holding illicit images that warrant deeper investigation.

The example below shows what the output can look like.