When using a version of BlackLight that is 2017R1 or newer, it is necessary to archive the case file first before moving the case file to a different analysis machine. This is especially important when copying the case file from a Mac to Windows or from Windows OS to macOS so that the PostgreSQL permissions are preserved. Please follow the instructions below:
1- Open BlackLight and highlight the case file to be archived within the 'Case Manager' window.
NOTE: The case file cannot be open when archiving it.
2- Click on the [File] menu and select [Create Case Archive...]
3- A 'Save' window appears, allowing the examiner to choose where to save the case archive. Navigate to the destination and click on the Save button.
NOTE: We recommend saving the archive to a drive formatted as NTFS, HFS+, or APFS. There is third party software that can be installed to support these file systems on Windows and on Mac. Please be aware that we do NOT recommend using ExFAT, especially if the drive was formatted using macOS.
4- The archive will complete with a folder containing a bl-casedata text file and a partitions.zip archive. When moving the archive between computers, the folder and its contents must be copied.
5- After copying the archive folder, an examiner can import this archive into a new case file on the new computer.
NOTE: we recommend copying the archive folder from the external drive to the internal disk of the new computer before restoring the archived case. This is especially important if the examiner insists on using an ExFAT formatted drive to transfer the archive folder.
6- Open the 'BlackLight Case Manager' window on the new computer.
7- Click on the [File] menu and select [Restore Case Archive...]
8- An 'Open' window appears. Within this window, navigate to the archive folder containing the bl-casedata text file and partitions.zip file and then select the Open button.