Speed up computer forensic analysis by prioritizing images and videos for review
The volume of images and videos uncovered on a suspect computer during a forensic investigation can take hours to review. The traditional step of running hash sets of known images against a computer is only effective for exact matches. Using LTU finder, you are able to identify duplicate images (as you would with hash matching), but also modified matches of those images.
Using finder during a forensic investigation allows you to first eliminate all known duplicate and modified versions of images. These are known values, so there is no need for manual review. Then, finder can provide suggested groupings for some of the remaining images - for example to highlight scanned documents or likely pornography. These suggested groupings allow you to review thos images first, where you are most likely to find interesting evidence.
For videos, finder creates keyframe summaries of video files, greatly saving the investigator time over the traditional video process (carving the video files, finding the right codec, and watching the video.)