Introduction

This manual provides a step-by-step guide on how to use the Drive/USB/Physical Disk scan feature in CaseScan. This feature enables users to scan storage devices for potential CSAM content, extract relevant metadata, and perform advanced analysis using AI-based detection.

1. Creating a New Case

1. Click on Add New Case (Drive/USB/Physical Disk).
2. Enter a Case Name.
3. Enter an Evidence Name.
4. Under Select Input, browse to the folder containing the storage device data.
5. Under Select Output, specify the location where extracted case data should be saved.
6. (Optional) Enable Face Recognition to detect human faces in the images.
7. (Optional) Enable Enhanced Accuracy Mode for improved CSAM detection.
8. (Optional) Enable Physical Recovery of Deleted Files to attempt retrieval of deleted media files.
9. Click Create Case to initiate the process.

2. Case Creation and Scanning Process

Once a case is created, the scanning process will begin, divided into different phases:

1. Phase 1 - Common Media File Extensions: Identifies standard image and video formats.
2. Phase 2 - Uncommon Media File Extensions: Detects less common file formats.
3. Phase 3 - ZIP, RAR & MS Office Files: Extracts data from compressed and document files.
4. Phase 4 - EXIF Data Extraction: Retrieves metadata from images.
5. Phase 5 - Recover Deleted Files: If enabled, attempts recovery of erased content.
6. Phase 6 - Duplicates and Visually Similar Media: Identifies duplicate or visually similar files depends on setted sensitivity.

Users can monitor the scanning progress and stop the scan at any point using the Stop Scan button.