Since I'm still figuring out the workings of Autopsy and Sleuthkit, I'll go
slowly, so I don't get lost.

I opened the browser with this command:

[code]
links -g http://g5n:9999/31564462051203138502/autopsy &
[/code]

Tabbed to "Open Case", which led me to Case Gallery in which the case "g5nCmn"
is already preselected since the only one in that host (Host Gallery is grayed
out).

The "details" link gives:

[code]
Description: lost two videos
Created: Tue May 5 11:38:20 2015
Investigators: miroR
[/code]

The "OK" leads me back, and in the previously seen "Case Gallery", I now
follow the link "OK".

Much more options now open, too much to describe.

I choose "Analyze" button link to follow.

This is not a new case. I have already worked on it, and sure I did went the
wrong way. It can be seen at:

Gentoo Forum, topic ...
LINK HERE

So this is the same case, but I'm determined to not go wrong this time.

"File Analysis" I will skip, as I did it in that Gentoo forum topic. The
directory, in which the files that I need to recover, I was wreckless enough
to delete, and surely "File Analysis" now can not help (if it does, someone do
tell me how!).

The "Keyword Search" or the "File Type" search, which do I choose?

I don't think "File Type" can work yet, because those files to undelete in the
deleted directory I think can not be find by sorter (if they can, someone do
tell me!).

The failed attempt of mine was due to going for a search in the "File
Analysis" section, and the search that went on (and it also went duplicating
itself, as I somewhat documented:

LINK HERE

LINK HERE

) didn't save anything in the output folder, so all the effort was lost.

So opening the "Keyword Search" section:

[code]
Keyword Search of Allocated and Unallocated Space

Enter the keyword string or expression to search for:
_________________________________

[ ] ASCII [ ] Case Insensitive

[ ] Unicode [ ] grep Regular Expression
[/code]
But what attracts my attention this time, is these two buttons, esp. the
second:

"Extract Strings" and "Extract Unallocated".

The third button is "Search" and I'm not using it yet.

I think I will not make a mistake if I go for the "Extract Unallocated" first
and foremost, because I hope to find those files in there.

Just on the duplicating of jobs apparently by Autopsy, I see this in bottom of
the "Keyword Search" page:

[code]
Previous Searches [ Z1_F0331_Zoom_Lovrić_Škariči�... (0) ] [
Z1_F0331_Zoom_Lovrić_Škariči�... (0) ] [ Z1_F0331_Zoom_Lovrić_Škariči�... (0)
] [ Z1_F0331_Zoom_Lovrić_Škariči�... (0) ] [ Z1_F0331_Zoom_Lovrić_Škariči�...
(0) ] [ Z1_F0331_Zoom_Lovrić_Škariči�... (0) ] [
Z1_F0331_Zoom_Lovrić_Škariči�... (0) ] [ Z1_F0331_Zoom_Lovrić_Škariči�... (0)
]
[/code]
So much for completeness and to be in the clear that we are talking the same
case as explained in the Gentoo Forums (previously to me finally succeeding to
register onto Sleuthkit Forum).

So I tab to an follow the link to "Extract Unallocated".

But, thinking of the duplicating of jobs if it is by Autopsy, I was thinking,
maybe I should shut the browser and see if the job wouldn't be duplicated?...

No, I don't think so. I have seen, I have just seen, and it's more work to
descibe it... but maybe this will be helpful for others... Wait...

But I'll make a separate post about it, because of clarity, and because in
that way readers will more easily follow.

END OF POST
duplicating of work in the next post.