Posted on

Using FileName Extreme with Camera Salvage Pro

Recovering erased files with Camera Salvage Pro can pull back those photos you accidentally wiped, but not the image names. File names are usually stored in a separate index from the files themselves, and so it’s impossible to recover names. But with FileName Extreme, you can use the meta data contained inside an image to get something close to the original file name, or what’s more, possibly even a better name.

Here’s how….

After Camera Salvage Pro (or FileSalvage) recovers the files, open up the recovered picture folder (it can be JPEGs, Canon CR2’s, Nikon NEF’s, Sony’s ARWs, and many other picture formats Camera Salvage Pro supports) and take a look at the names of the files. The files names are in list numbers, making identifying the files a daunting task.

Files After Recovered by Camera Salvage Pro

 

You can download FileName Extreme here.

Launch FileName Extreme. Launch FileName Extreme

Drag the folder of unnamed files to the right hand side of the FileNameExtreme window.

Drag Recovered JPEG Folder to FileName Extreme

 

Click Examine for FileName Extreme to read the file data.

Click Examine Button on FileName Extreme

 

Once FileName Extreme finished analyzing the files, it will move to the next window. On the upper right hand panel, select Type, then scroll down the Rename Type panel to select EXIF MetaData.

Select Type EXIF Meta Data from FileName Extreme

 

You can then select various fields you may want to include in your file names. We recommend selecting Make and Model (of the cameras), DateTimeDigitized, Pixel Height, and Pixel Width.

Select Make and Model

 

Select Date Time Digitized

 

Select Pixel Ht and Pixel Width

Once you have them checked, you can arrange the order on how they appear in the new names.

Arrange Naming Sequence

 

Next select Prefix, click Replace Name, and click Next.

Select Prefix to Replace Name

A list of files with the current names will be listed. The Preview name will be updated only when you click on the Preview button.

Preview Screen

 

Once you click on the Preview button, the preview Name will be updated to the ones you selected.

Previewed Items Updated to New Names

 

Noticed that some of the files may be duplicates (sometime data recovery products recover the same file more than once).

FileName Extreme Shows Duplicate Files

 

If you notices there are duplicates, click on Preview Name. It will sort and rearrange the names in ascending fashion. Scroll down and look for Duplicate Name under comments. If you notice any of them (in group of two or more), uncheck all except for one. (for example, 97.jpg, 98.jpg, 99.jpg are duplicates and two of them can be deselected from rename).

Unchecking Duplicate Files

 

Click Rename. You will be prompted one final time whether to rename the files or cancel.

Ignore Warning When Prompted To Rename

 

Open the folder and you will see some of the files still bear the original names (they are either duplicates that you deselected from renaming or files that don’t have embedded EXIF metadata.

Duplicates Not Renamed by FileName Extreme

 

Scroll down the window and you will see all the renamed files.

Renamed Folder

Posted on

Our New Site Redesign Benefits You

Thank you for your interest in SubRosaSoft.com. We have been committed to providing great software for forensics and consumer data security for over 15 years.

To continue our service to the law enforcement and Macintosh communities, we have redesigned our web site — bringing a whole new look, as well as support for mobile technologies, and a streamlined shopping experience. It is also much easier to share articles, tips, and product information.

How does this benefit you? In several ways. Product reviews now appear on the product page, rather than separately. Upgrades to products are linked to their parent program, so for example, you can find the FileSalvage upgrades just by going to the FileSalvage page. When you want to purchase a product, it is much easier to add the item to your cart and see everything you’re ordering.

If you previously had an account with us, you will need to create a new account on this site. Obviously, you won’t see prior orders — only current and future orders — but don’t worry. We have retained all previous order information. Simply email our Support staff if you need information on older orders.

We did have to trim a few things with the new site. You might have reached this page from an old link to a discontinued product or a freeware application we no longer offer. These items either didn’t fit with our current product focus, or have lost their usefulness with developments in technology.

Again, thanks for choosing SubRosaSoft.com!

 

Posted on

Revisit Unhiding the User Library folder

Back in 2011, when Apple released Mac OS X 10.7 Lion, it boasted over a hundred improvements to enhance the user experience, and one of them was the hiding of the User Library folder. To get around it, simply launch the Terminal (found in the Utilities folder inside your Applications folder) and paste in the following command and press the Enter key:

sudo chflags nohidden ~/Library/

Messing with the Terminal app isn’t an elegant method , but it allows you to access Library folder to remove a preference file, or delete an Application Support folder.

Beginning with Mac OS X 10.8 Mountain Lion forward, Apple has introduced a quick and  easy way to access the Library folder.

In the Finder window, hold down the Option key while accessing the Go menu on the top menu bar, and select Library, the Library folder will open, allowing you to access its contents.

Unhide Library Option

The technique will not change the Library folder to permanently visible. Once you close the Library folder, it will no longer show up in the Home folder. To access the Library folder again, you will have to perform the same procedure of selecting option-Go-Library.

If you need to access the Library folder frequently, You can still employed the Terminal method described above to unhide the Library, which will be turned visible until you tell Terminal to hide it with the command

sudo chflags hidden ~/Library/

Under macOS 10.12 Sierra, the Option-Go-Library method no longer works. Instead, you will need to do the following*:

From the Go menu, select the home folder.

Select Go to Home Folder

Your Home folder will open and with the visible folders displayed.

Home Directory with No Llibrary

To reveal the Library folder, Select Show View options and click on the check box for Show Library Folder.

Show View Option

Checking it will allow the Library to stay visible, even after a restart.

Home Folder with Library Displayed

*The procedure also works on Mac OS X 10.11.

Posted on

Knowing Where to Look for Evidence

If you’re learning to become as a computer forensic investigator or e-discovery analyst, knowing where to look for evidence is crucial. Aside from the obvious Documents folder, Pictures folder, Movies folder, Desktop folder, and Download folder, you will also need to gather information by extracting bits and pieces from other places for analysis.

SubRosaSoft’s distributor in China, CFLabs, has been one of the pioneers on Mac Forensics in China for many years, and has published numerous articles on computer forensics. Of the many entries in CFLabs’ training forum, the following table on where to search for evidence has helped us immensely when we were developing Cache Detective. And with the permission of the author, Sprite Guo, we will be translating many of the useful Mac OS X forensics articles.

Please note the information is relevant to Mac OS X 10.11; we have noticed some locations may have been changed in Mac OS X 10.12.

 

 

Location Related Records
private\var\log\system.log USB Disk usage record, System Log
\Users\UserName\Library\Calendars Calendar schedules, appointments, and etc…
\private\var\root\Library\Preferences\com.apple.dock.plist Dock display content
\Users\UserName\Library\Preferences\com.apple.dock.plist Dock display content
\private\var\root\Library\Preferences\com.apple.sidebarlists.plist Finder Sidebar
\Users\UserName\Library\Preferences\com.apple.sidebarlists.plist Finder Sidebar
\private\var\root\Library\Application Support\AddressBook\Metadata\ Contacts
\Users\UserName\Library\Application Support\AddressBook\Metadata\ Contacts
\Users\UserName\Library\Application Support\AddressBook\Sources\ Contacts
\Users\UserName\Library\Containers\com.apple.Notes\Data\Library\Notes\ Notes
\Users\UserName\Library\Containers\com.apple.Maps\Data\Library\Maps\ Maps
\private\var\root\Library\Logs\DiskUtility.log Disk Utility
\Users\UserName\Library\Logs\DiskUtility.log Disk Utility
\private\var\root\Library\Preferences\ Disk Utility Preferences
\Users\UserName\Library\Preferences\ Disk Utility Preferences
\.Trashes\ USB Disk usage record
\Users\UserName\.Trash\Recovered files USB Disk usage record
\Users\UserName\.Trash\ System Log
\Users\UserName\.bash_history Bash History
\Users\UserName\百度云同步盘\ Baidu Cloud
\Users\UserName\Dropbox\ DropBox
\Users\UserName\Library\Mobile Documents\com~apple~CloudDocs\ iCloud
\Users\UserName\Music\iTunes\iTunes Music Library.xml iTunes
\Users\UserName\VirtualBox VMs\ Virtual Box
\Applications\VMware Fusion.app\Contents\Resources\ Vmware
\Users\UserName\Documents\Virtual Machines.localized\ Vmware
\Users\UserName\Library\Application Support\VMware Fusion\Virtual Machines\ Contacts
\Users\UserName\Documents\Parallels\ Parallels
\Library\Printers\ Installed Printers
\Users\UserName\Library\Containers\com.feinno.macfetion\Data\Library\Application Support\Fetion\Cache\ Fetion
\Users\UserName\Library\Application Support\UC4Mac\ Sina Universal Communication
Users\UserName\Library\Containers\com.tencent.qq\Data\Library\Application Support\QQ\ QQ
\Users\UserName\Library\Application Support\Skype\ Skype
\Users\UserName\Library\Containers\com.taobao.aliwangwang\Data\Library\Application Support\AliWangwang\v3\profiles\ AliWangwang
\Users\UserName\Library\Containers\com.yy.macyy\Data\Library\Caches\com.yy.macyy\ YY Social Network
\Users\UserName\Library\Containers\jp.naver.line\Data\ Line
\Users\UserName\Library\Messages\ Messages
\Users\UserName\Library\Application Support\Firefox\Profiles\ Firefox
\System\Library\Tcl\8.4\tclx8.4\help\tcl\status\history Google
\Users\UserName\Library\Application Support\Chromium\Default\History Google
\Users\UserName\Library\Application Support\Google\Chrome\Default\History Google
\usr\share\zsh\5.0.5\help\history Google
\Users\UserName\Library\Application Support\Chromium\Default\Cookies Google
\Users\UserName\Library\Application Support\Google\Chrome\Default\Cookies Google
\usr\share\emacs\22.1\etc\COOKIES Google
\System\Library\Spotlight\Bookmarks.mdimporter\Contents\MacOS\Bookmarks Google
\System\Library\SyncServices\Schemas\Bookmarks.syncschema\Contents\MacOS\Bookmarks Google
\Users\UserName\Library\Application Support\Google\ Google
\Users\UserName\Library\Application Support\Google\Chrome\Default\Application Cache\Cache\data_1 Google
\Users\UserName\Library\Application Support\Google\Chrome\Default\GPUCache\data_1 Google
\Users\UserName\Library\Caches\Chromium\Default\Cache\data_1 Google
\Users\UserName\Library\Caches\Google\Chrome\Default\Cache\data_1 Google
\Users\UserName\Library\Safari\ Safari
\Users\UserName\Library\Application Support\com.operasoftware.Opera\ Opera
\Users\UserName\Library\Application Support\QQBrowser2\Default\History QQBrowser
\Users\UserName\Library\Application Support\QQBrowser2\Default\Bookmarks QQBrowser
\Users\UserName\Library\Application Support\Maxthon\Default\History Maxthon
\Users\UserName\Library\Group Containers\UBF8T346G9.Office\Outlook\Outlook 15 Profiles\Main Profile\Data\Message Sources OutLook
\Library\Preferences\SystemConfiguration\ Network Interface
\Library\Preferences\ Network Configuration, Bluetooth connectivity record, Wifi, Filezilla download
\Users\UserName\Library\Application Support\Thunder\ Thunder Download
\Users\UserName\Library\Preferences\FrostWire5\libtorrent\ Frostwire Download
\Users\UserName\Library\Application Support\uTorrent\ uTorrent Download
\Users\UserName\Library\Application Support\BitTorrent\ BitTorrent Download

A few of the applications listed above are extremely popular in China and Greater China Region. Products like Baidu Cloud, QQ, AliWangWang, and Thunder have huge installed bases and are supported by Cache Detective.

Posted on

View Web Cache Data on Mac OS X

Web caches store copies of documents the user has accessed on the internet in order to reduce server access time when visiting that site again. The information contained inside web caches can help an investigator prove a crime was committed, build a timeline of events, and prove intent.

Forensics investigators or eDiscovery experts often employ sophisticated utilites to search  the contents of these folders for cache information. This will show you websites that have been browsed who’s files have not been over-written as well as present cache files that have not been flushed.

There are other utilities that can be used to extract files, but they will need to be told on where to search. Here is a short list on where to look for cache data of various popular web browsers.

  • The default web browser in Mac OS X is Safari. The Safari web cache is located: ~/Users/”USERNAME”//Library/Caches/com.apple.Safari
  • The default storage location for Firefox‘s web cache is: ~/Users/”USERNAME”/Library/Caches/Firefox/
  • The default storage location for Chrome‘s web cache is: ~/Users/”USERNAME”/Library/Caches/Google
  • The default storage location for Opera‘s web cache is: ~/Users/”USERNAME”/Library/Caches/Opera Cache

There are a large number of other folders contained within the ~/Users/“USERNAME”/Library/Cache folder that may be of interest for investigators also.

If you are interested in extracting cache files easily, and don’t want to spend the money on an expensive forensics software, consider SubRosaSoft Cache Detective. Cache Detective is a very easy-to-use utility that read the cache of many browser and chat applications and extract the files currently stored in their cache folders. It comes with presets to extract pictures, text, movies, etc… from popular browsers such as Safari, Chrome, FireFox, Opera, Chromium, Chrome Canary, and more.

Cache Detective is optimized to work on the startup volume. For cache data on non-startup volume, Cache Detective allows users to manually locate and extract the cache data.

Posted on

Good Backup Is A Lifesaver

While it’s very important to be prepared for data loss with a powerful data recovery program like FileSalvage, it’s also important to keep current backups of your important files.  File recovery programs can recover many of the lost files in the event of accidental deletion and some other data loss situations but with some forms of data loss they can’t replace having a backup copy.

1 in 5 computers suffer fatal hard drive crashes that can leave your valuable files gone forever even for the best of data recovery software.  Using SubRosaSoft Disk Copy to make a backup of your data can insure that if a hard drive crash does happen, you’re prepared.  Paying a data recovery company to get your files back usually costs thousands of dollars and takes time plus there is no guarantee they will be able to get all your information back.  The fast read and write speeds of modern hard drives makes backing up even large amounts of data fairly quick and it really pays off when disaster happens.  Rather than wasting time trying to recover your lost files, simply restore them from your backup and you’re ready to go again.

While SubRosaSoft Disk Copy supports multiple backup modes such as cloning, synchronization, incremental backups, and scheduled backups, it’s limited to Mac drives and will not clone non-Mac partitions such as Windows or Linux. If you want to backup a multi-partition drive or a dual boot (Mac OS X and Windows) device, consider SubRosaSoft CopyCatX instead. CopyCatX is device and file system independent application, which means that the user can clone or create disk images from any normal Mac OS drive, Windows, Linux device, or even TiVO drive.

Posted on

SubRosaSoft.com Announces SubRosaSoft Disk Copy Version One

Feature-rich Mac OS X backup software simplifies daily backup routine to protect your data.

FREMONT, Calif.–(BUSINESS WIRE)–SubRosaSoft.com Inc., announces the immediate availability of SubRosaSoft Disk Copy, a well-rounded and very easy-to-use backup and cloning system. It can create bootable copies of a startup drive, manage synchronization of volumes, handle incremental bootable copies, and run backups using a schedule.

“SubRosaSoft Disk Copy is designed for Mac OS X 10.9 and above, and optimized for Yosemite and El Capitan. Disk Copy supports multiple backup modes such as Cloning and Synchronization of drives,” explains Ben Slaney, programmer of SubRosaSoft Disk Copy. “It can also make incremental snapshots that back up your most recent changes, and retain older versions of files you can retrieve, if needed. All these backup tasks can be scheduled and automated at times convenient for you.”

An exciting feature of Disk Copy is the use of hard links to reduce the amount of space required for incremental backup. “To keep disk usage down to absolute minimum, SubRosaSoft Disk Copy Incremental Backup uses hard links.” According to Slaney, “The backup will appear and behave as an exact clone, but only take up a small amount of space. You can store many time-stamped backups of your drive or folders, and you can go back and pull out copies of any particular files that you want.”

Written specifically for Mac OS X Mavericks and above, SubRosaSoft Disk Copy includes powerful features that give you greater control and flexibility over cloning, backup, and the duplication of data:

  • Easy-to-use interface — The application’s single-window design makes cloning and backing up a simple process.
  • Extremely fast incremental backups — Instead of cloning an entire drive, this feature adds only new or updated files to your destination.
  • Filtering capability — Allows you to exclude files from a backup.
  • Stop and Resume — Interrupt a backup and start it again later.
  • Save your backup settings — Use Disk Copy’s scheduling features to create automatic backups or to save settings for manual backups you can run when you need.

SubRosaSoft Disk Copy is designed to run on Macs with the following minimum specifications:

  • Apple Power Macintosh CPU (Intel based)
  • Mac OS X (10.9 Mavericks or higher)
  • At least 2 GB of RAM

MSRP for SubRosaSoft.com is $34.95 and it’s available as download only. For more information on SubRosaSoft Disk Copy and downloading a fully functional trial version of the software, please visit: SubRosaSoft.com

Note to editors: SubRosaSoft Disk Copy is a trademark of SubRosaSoft.com Inc. Mac OS X is a trademark or registered trademarks of Apple Inc. All trademarks and registered trademarks remain the property of their respective owners.

Contacts

SubRosaSoft.com

Mark Hurlow, 510-870-7883

mhurlow@subrosasoft.com

Posted on

SubRosaSoft.com Announces Drive Cleaner

Easy-to-use new Mac OS X utility software reclaims wasted disk space

October 5th 2015, Fremont, CA – SubRosaSoft.com, Inc., announces the immediate availability of SubRosaSoft Drive Cleaner. Optimized for Mac OS X Yosemite and Mac OS X El Capitan, this brand new utility helps users recovered gigabytes of disk space by removing redundant and unnecessary files quickly and easily.

SubRosaSoft Drive Cleaner helps you free up the valuable space of your drive by removing gigabytes of nonessential or temporary files,” explains Ben Slaney, programmer of Drive Cleaner. “Optimized for Mac OS X Yosemite, SubRosaSoft Drive Cleaner can reclaim wasted disk space with simply a few clicks. You can choose from over half a dozen of categories to clean, and regain an average of 10 GB of disk space and remove a few hundred thousand files quickly and easily.”

SubRosaSoft Drive Cleaner is designed for Mac OS X 10.9 and above. Upon launch, Drive Cleaner will scan the drive for redundant files of various categories. For example, files such as a Mac’s sleep image, installation logs, crash logs, and application support files for applications you have deleted are candidates for removal. A user can quickly reclaim the space lost to bloated and non-essential items with a couple of clicks.

The following categories are targets for removal.

  • Redundant Mail Downloads
  • Cache Files
  • Crash and Installation Logs
  • Download Logs/Guard Privacy
  • Sleep Image File
  • Application Support Files
  • Unneeded Foreign Language Files

SubRosaSoft Drive Cleaner is designed to run on Macs with the following minimum specifications:

  • Apple Power Macintosh CPU (Intel based)
  • Mac OS X 10.9 Mavericks or higher
  • At least 2 GB of RAM

MSRP for SubRosaSoft Drive Cleaner is $19.95 and it’s available as a download only. For more information on Drive Cleaner, and to download a demo version of the software, please visit: https://www.subrosasoft.com/product/drive-cleaner/

Contact:
Mark Hurlow
SubRosaSoft.com, Inc.

Posted on

SubRosaSoft.com Announces FileSalvage 9.0

New version of Mac OS X data recovery software features superior performance, an enhanced user interface, and support for latest Mac OS X

FREMONT, Calif.–(BUSINESS WIRE)–SubRosaSoft.com Inc, announces the immediate availability of FileSalvage 9. The latest version of FileSalvage features optimum performance, a new user interface, and support for the latest Apple operating system version 10.10.

“FileSalvage 9 is a powerful data recovery tool designed to recover accidentally deleted files or reformatted drives,” explains Ben Slaney, programmer and architect of the latest FileSalvage. “The new version sports a complete update of the underlying architecture and an improved user interface, making the recovery process much faster and easier.”

“We are extremely proud of the speed improvement achieved by the latest versions. As drives keep getting bigger, data recovery using our previous version may take days. With the newest version, we have seen improvement of up to 5 times! Instead of waiting for days to find the deleted files, the whole process can be done within hours,” according to Slaney.

FileSalvage 9 is designed for Mac OS X 10.10. The software has been updated completely. FileSalvage 9 also allows recovery while the scan is in progress. Improved integrated file previews will allow the user to quickly preview the files when the software is still scanning for files.

Written specifically for Mac OS X Yosemite and featuring a completely updated data scanning and recovery engine, FileSalvage 9 includes powerful features that give you excellent flexibility and total control in data recovery:

  • Vastly improved scan-and-recovery engine dramatically cuts down file recovery time.
  • Updated file preview: see what you are getting during the scan and before you recover your deleted file.
  • Easy-to-use interface simplifies your data recovery process to a number of clicks.
  • Risk-free trial version to see what you can recover.
  • Embedded file recovery to search for files embedded inside other files.
  • Device and file system independent: allows recovery from almost any media.
  • Works on faulty hardware: recovers data from mechanically unsound disks or corrupted devices.
  • Searches free space: scan only where known files are not, to speed up recovery and narrow search results.

SubRosaSoft FileSalvage 9 software requires Mac OS X 10.7 or above (Built for Mac OS X 10.10 Yosemite).

For more information on FileSalvage 9, please visit:
https://www.SubRosaSoft.com

MSRP $89.95. Owners of FileSalvage 8 or below can upgrade to FileSalvage 9 for $29.95.

Note to editors: FileSalvage is a trademark of SubRosaSoft.com Inc. Mac OS X is a trademark or registered trademarks of Apple Inc. All trademarks and registered trademarks remain the property of their respective owners.

Contacts

SubRosaSoft.com Inc
Mark Hurlow, 510-870-7883
mhurlow@subrosasoft.com

Posted on

SubRosaSoft.com Announces FileSalvage 8.0

New version of Mac OS X data recovery software features support for Mavericks and a simple user interface

FREMONT, Calif.–(EON: Enhanced Online News)–SubRosaSoft.com Inc., announces the immediate availability of FileSalvage 8. The latest version of FileSalvage features a new user interface and support for the latest Apple operating system version 10.9.
“FileSalvage 8 is a powerful data recovery tool designed to recover files that are deleted accidentally,” explains SubRosaSoft.com Inc.’s CEO, Marko Kostyrko. “It is device and file system independent, allowing the users to recover files from normal Mac OS hard drives, USB keys, Windows drives, memory cards, or any other media you have that can be recognized in Mac OS X.” The latest version sports an easy-to-use interface to make the recovery process even easier. “The main window now contains all the components necessary for a successful file recovery session, simple data recovery just flows effortlessly in FileSalvage 8.”

FileSalvage 8 also supports Mac OS X 10.9. “The software was written on 10.9, and tested with previous versions of Mac OS X. FileSalvage 8 has an improved integrated file preview. Whether you are searching for a PDF, or a Word document, or your most valuable family moments, FileSalvage will allow you to quickly inspect the initial scan result for the files you desperately need back,”  Kostyrko added.

Written specifically for Mac OS X and updated to full compatibility with Mac OS X 10.9, FileSalvage includes powerful features that give you excellent flexibility and total control in data recovery:

  • Easy-to-use interface to simplify your data recovery process to a number of clicks.
  • Risk free trial version to see what you can recover.
  • Custom file type support allows recovery of files that may not already exist in the current list of ‘Supported File Formats’.
  • Embedded file recovery to search for files that have been embedded inside other files.
  • Built-in file preview – see what you are going to get before you recover your deleted file.
  • Device and file system independent – allows recovery from almost any media. Works on faulty hardware – recovers data from mechanically unsound disks or corrupted devices.
  • Safety first – never writes to the disk or device being salvaged from.
  • Searches free space – scan only where known files are not, to speed recovery and narrow search results.

SubRosaSoft Salvage software requires Mac OS X 10.6 or above (10.9 Mavericks Compatible).

For more information on FileSalvage 8, please visit:
https://www.SubRosaSoft.com

MSRP $89.95. Owners of FileSalvage 7 or below can upgrade to FileSalvage 8 for $29.95.

Note to editors: FileSalvage is a trademark of SubRosaSoft.com Inc. Mac OS X is a trademark or registered trademarks of Apple Inc. All trademarks and registered trademarks remain the property of their respective owners.

Contacts

SubRosaSoft.com Inc.
Mark Hurlow, 510-870-7883
mhurlow@subrosasoft.com