Examples of categories include Registry, File system, internal file metadata, Internet, etc. The (event) Category is a higher level group than the Type column. A filter is also available for this column and allows for selecting only the types of events you are interested in seeing ( Registry: Key changed for example). The (event) Type column is related to the Category column in that it describes a more granular event inside the more general Category column. Do not confuse this column with the (file) Type filter that we have studied earlier. The (event) Type column describes where the data in the Timestamp column were found and, at the time of this writing, contains more than 40 different event types. As with other date-based columns, a filter is available for this column. The Timestamp column contains the date and time extracted from metadata. For a complete list of the types of files XWF extracts events from, see the most current XWF manual.Д«efore we populate events, letвЂ™s take a look at the additional columns available in the Directory Browser when in Events view: Timestamp, (event) Type, (event) Category, and Description. If we try, our list will be outdated by the time you read this. Because XWF is enhanced so frequently, we cannot provide a complete list of all the objects from which events are extracted.

Recall from Chapter 4 that this option is responsible for extracting things like internal file timestamps, browser history, e-mail, file system journals, shortcut (.lnk) file data, etc. Specifically, the Extract internal metadata, browser history, and events option must be enabled in the RVS for events to be generated. To populate the Events list, you must run a RVS. An initial volume snapshot will contain no events, and as such, switching to Events view prior to performing a RVS will result in an empty list.

How to restore firefox history