1: The Introduction
What is Cache Detective?
SubRosaSoft Cache Detective is a very easy-to-use utility that reads the cache of many browsers and chat applications and extracts the files currently stored in their cache folders. Web caches store copies of documents the user has accessed on the internet in order to reduce server access time. The information contained can frequently be used by an forensic investigator or network administrator to detemine illegal activities have been commited. Cache Detective can extract any cache files that have not yet been flushed. Typical data you can extract with Cache Detective includes pictures, movies, htmls, pdfs, and more.
OS X Sierra supported!
Built for your OS X 10.12 Sierra, OS X 10.11 El Capitan, 10.10 Yosemite, OS X 10.9 Mavericks, or 10.8 Mountain Lion Apple Macintosh computer.
Cache Detective Features
Written specifically for Mac OS X, Cache Detective includes powerful features that give the user greater control and flexibility in analyzing and extracting cache data:
- Simple interface – Cache Detective has a clean and simple user interface that makes it accessible and very easy to use.
- Preview – Allows the user to preview the image files of available cache data before choosing to recover them. Using the underlying architecture of Mac OS X, Cache Detective can read and display many types of images.
- Custom application support – For non-startup volume or mounted disk images, Cache Detective allows the user to select cache or browser data manually and extract the cache data.
2: Getting Started — The Basics of SubRosaSoft Cache Detective
SubRosaSoft Cache Detective is designed to run on Macs with the following minimum specifications:
- Apple Power Macintosh CPU (64-bit Intel based)
- Mac OS X (10.8 Mountain Lion or higher)
- At least 2 GB of RAM
Each user is required to have a registration number to complete installation of the software.
When purchasing the software online at: https://www.subrosasoft.com/, the registration number is automatically emailed as part of the purchase confirmation. If a confirmation email does not appear in your email inbox, please check that it is not in the junk mail folder before requesting technical support. Please print your confirmation email, and store it in a safe and secure place for future reference.
No Registration Number – Trial Mode
Without a registration number, Cache Detective runs with limited functionality. In Trial Mode, the user will be able to scan for the cache files, but will be unable to extract them. For data extraction, the user must register his or her version of Cache Detective. To do this, purchase the software online from www.subrosasoft.com or via a retail channel, then simply select “Enter License Key” from the Cache Detective drop menu, and enter a valid registration number. An alternative way to register the product is to click on the serial number link on your serial number email.
Lost Registration Numbers
Please ensure that you keep your registration number in a safe and secure place. Print out confirmation emails, or back them up. SubRosaSoft cannot guarantee the re-issue of serial numbers for our software.
Obtaining the Latest Version
Downloading from the Web Site
It is important to have the latest version of the SubRosaSoft Cache Detective software. The latest version is always available for download on our web site at: https://www.subrosasoft.com/
A download link, alongside version information, appears on the product page of the site. Simply click the link; a compressed archive file will automatically begin to download to the desktop, or another location you choose.
SubRosaSoft Cache Detective versions are distributed in DMG format, and can be mounted on the Desktop in the Mac OS Finder by simply double-clicking the file icon. In the Cache Detective window, you will find the SubRosaSoft Cache Detective application, the latest Read Me document, and a quick start guide.
Installing or Updating via Download
Once the software has been downloaded from the site and decompressed, simply drag SubRosaSoft Cache Detective from the disk image window into the Applications folder. If prompted to replace an existing version of the file, click Replace.
Removing the software
To remove the software, drag the SubRosaSoft Cache Detective from the Applications folder into the Trash can.
Finding Help & Technical Support
Should you need assistance while working with SubRosaSoft Cache Detective, there are a number of sources for help:
Help within SubRosaSoft Cache Detective
To get help with any questions you may have about the operation of SubRosaSoft Cache Detective, select ‘ Help’ from the drop-down Help menu.
Our technical support is free via email and can be accessed at the following address: firstname.lastname@example.org. Support hours are 10am to 6pm Pacific Standard Time Monday through Friday (GMT -8).
In addition to any support question(s), you must include ALL of the following pieces of information:
- Valid registration number.
- System configuration(s) — hard drive make, model, memory configuration, and the model of the Mac you are running the software on.
- System OS version.
3: Using SubRosaSoft Cache Detective
When you first launch Cache Detective, you will be asked to input the registration number. If you don’t have a registration number, Cache Detective will run with limited functionality. In Trial Mode, the user will be able to scan for the cache files, but will be unable to extract them.
The first time you run Cache Detective, it will ask for your administrator password; authentication is necessary to perform operations on the startup drive. Once authenticated, Cache Detective will be ready for you to explore and extract cache data.
The Main Window – An Overview
Immediately after start-up, you will see the ‘Main Window’. This is the starting point for any task you wish to perform. For more on the using the Main Window, please scroll down to the section on Main Window.
There are a few items on the menu bar specific to SubRosaSoft Cache Detective:
Enter License Key…
Selecting Enter License Key… displays a window for entering the Registration number (if the software is running in Trial mode).
The menu is disabled if a serial number has already been entered.
Selecting Help opens SubRosaSoft Cache Detective’s html-based help file in your default web browser. You must be connected to the Internet to use our online help.
The Main Window’s Layout
The layout of the window is effectively divided into 4 sections:
- The Source pane.
- The Scan Options panel.
- The Found pane.
- The Preview pane.
This part of the window contains Cache Detective’s supported applications found the machine.
From this panel, a user can select an application to scan and recover files from.
Scan Options + Buttons panel
This part of the window that contains the scan options.
Search for Embedded Files
Sometimes there are files that are contained within files, such as in web caches or mbox format email folders. Checking this option causes Cache Detective to find such files, though a side effect of this is that the scanning will slow down.
Scan results will appear once the user has completed the initial scan. The results are displayed in the pane, grouped by file types, making it easier to extract specific kinds of files.
To select a file or multiple files to extract, simply scroll up or down the list, and highlight the file with a Mouse Click, or Command + Mouse Click Item to select multiple files. To include all files found, simply select all of them by entering Command + ‘a’.
Once you have selected the file(s) for recovery, you can proceed to extract the file(s) by clicking Recover.
This part of the window allows the user to preview a range of different file types simply by selecting files in the Found pane.
To select a file to preview, simply scroll and locate the item of interest from the list, and click on the file. Seconds later, a preview of the file will be displayed.
The Extraction Process
The data extraction process is a simple 2-step procedure:
- Gather a list of available files
- Extract the files to a location of your choice
Step one of the process is easy enough to understand, with Cache Detective simply gathering a list of available data.
When completed the user will be presented with a dialog box confirming the completion of the scanning process with the final statistics of the number of files located and the number of bad blocks. He or she should close this by clicking on OK, at which point the user can review the results of the scan in the ‘Found’ pane of the window. To the right of each file type in the result set is a disclosure triangle, when clicked this will display an expanded list of files available for preview and extract.
Previewing Scan Results
Having generated a set of results. The user can preview a range of different file types simply by selecting the respective file in the results pane and then viewing matches in the preview window.
Having scanned, reviewed, and previewed the available data, the user can finally select and extract the desired files, one by one. To do so, he or she must select each individual line item in the results pane.
Rather than scan and recover files on an individual basis, it is possible for the user to select multiple files, either using the Command + A to “Select All” items or using Command + Mouse Click Item to select items randomly and selectively.
Once selected, the user has just to click the Recover button at the bottom of the results pane. This will return a “Save” dialog box in which you can select an external location to save the data. When you are done, click Save.
Once the files are extracted, a dialog will pop up to announce the process is complete. Click OK to continue, or click Show in Finder to display the extracted files.
If you selected Show in Finder, a folder with the extracted files will open.
Adding Custom Support
To extract files that may not already exist in the current list of “Supported Applications,” the user can add them via the Add Custom… item in the General panel, doing so will open a selection window.
Navigate to the folder that contains the cache items you would like to extract and click open.
Once created, you can select the folder from the General panel again and proceed to Scan and extract the cache items.
Recovery Cache Types List
The following is a list of applications with cached items that can be extracted using SubRosaSoft Cache Detective:
- QQ (Chat)
- QQ Browser
- Chrome Canary
- Disk Utility
Copyright, EULA and Trademarks
SubRosaSoft.com Inc copyrights this software, the product design, and design concepts with all rights reserved. Your rights with regard to the software and manual are subject to the restrictions and limitations imposed by the copyright laws of the United States of America.
Under the copyright laws, neither the programs nor the manual may be copied, reproduced, translated, transmitted or reduced to any printed or electronic medium or to any machine-readable form, in whole or in part, without the written consent of SubRosaSoft.com Inc.
© Copyright 2016 SubRosaSoft.com Inc. All Rights Reserved.
End User License Agreement for Cache Detective – Click Here
“SubRosaSoft Cache Detective” is a trademark of SubRosaSoft.com Inc.
All other brand and product names are trademarks or registered trademarks of their respective holders.