| Author | Message | ||
     Rene Kodicek (Kodicek) |
Hi, if I add a bookmark to an MFT entry, the bookmark will no longer appear in the bookmarks after switching to another MFT entry. Is this a bug or a feature? Thank's in advance, Rene | ||
| Stefan Fleischmann (Admin) |
Bookmarks are based on offsets. A different MFT entry on the same NTFS volume has a different offset and therefore won't be covered by the same bookmark. | ||
| Rene Kodicek (Kodicek) |
OK, that's clear. But I think it should be possible to store any position (also one of a MFT entry) permanently to the "Position Manager (,Bookmarks)" list. In my case I can store the bookmark, but it will not appear in the bookmark list. | ||
| Stefan Fleischmann (Admin) |
Bookmarks that are specific to an evidence object are listed in that evidence object's bookmark list only, not in the general Position Manager, and vice-versa. Does that explain what you observe? If you wish to create a bookmark generally, not just for a particular evidence object, then please make sure the volume in the active data window is not associated to the active case (if one is active) as an evidence object. That way it will be recorded in the general Position Manager. | ||
| Rene Kodicek (Kodicek) |
If the cursor is in an MFT entry for which you want to add a bookmark, you get only the "edit bookmark" menu if you make a right click. The solution for me is to place the cursor in another MFT entry than this for which I want to make a bookmark for. Then I get the "add bookmark" menu. | ||
| Stefan Fleischmann (Admin) |
WinHex and X-Ways Forensics do not directly offer to create bookmarks within existing bookmarks, yes. |