This EnScript searches user-nominated items for specified keywords.
If an item is an entry, file-slack will be searched by default. Coupled with this, the user can opt to ignore an entry's logical-data if the entry's hash-value matches that of a hash-item listed in the current hash-library.
Keywords can be entered manually and will be stored by the script for later use. They can also be imported from a *.Keywords file or a file exported by the raw search dialog.
The script will bookmark a specified number of bytes either side of each hit. The user can specify that this data should only be bookmarked if unique, but this will increase processing time.
It's important to note that bookmarks are grouped by keyword-name, or if no name has been given, by keyword-expression. Taking this into account, it's advisable to name GREP keyword-expressions to prevent bookmark-folder naming issues causes by certain GREP operators.
Bookmarked data may be written into a logical evidence file such that:Records will be stored using the item-path property.Entries will be stored using the true-path property minus the name of the current case.
To prevent the inadvertent merging of paths due to duplicate evidence-file or compound-file names, each path can be prefixed with the source file's primary and secondary-device GUIDs.
In addition to bookmarks, the script will also create a result-set containing responsive items. The comment of each result will list the keyword(s) found.
The script has the ability to search the transcript data of items rather than their file data. This can prove very useful for searching file-types containing compressed data (docx, xlsx, pdf, etc.) and does not require indexing. It does not, however, search file slack unless the item in question is a known file, in which case it's logical data will be ignored and a physical keyword-search used to search slack instead
To use the transcript option, the user must be sure to specify Unicode search-terms.
In addition, the examiner must use the script's internal condition to specify the items whose transcript data is to be searched.
It's important to note that an empty transcript condition will return true by default. This would cause the transcript data of every target item to be searched, which might lead to undesirable consequences. Accordingly, the Use Transcript option should be used to control transcript searching.
The script creates text bookmarks for search-hits found in files; the source data can be viewed in the Text or Hex tabs. The source data for transcript bookmarks should be viewed in the Transcript tab.
Furthermore, when viewing transcript data, the examiner should bear in mind that the Transcript tab shows the data as Unicode characters, not bytes, so the range spanning each hit will appear to be half the size, i.e., if a range of 100-bytes either side of each hit has been specified and a hit is 10-characters in length, the range shown will be 50 + 10 + 50 = 110-characters. The fact that transcript data is encoded in Unicode will be evident when viewing the content of the logical evidence file produced by the script.
When it comes to specifying a maximum length of data to search, the following points are worthy of note:
Please note that a known bug causes the Keyword Hits tab to be activated once the script has finished processing.
Feedback is provided via the console window.
Last updated using EnCase 22.3.
This script was developed for use in EnCase training. For more details, please click the following link:
This release allows the user to search a specified number of bytes/characters from the start of each file.
Please upgrade to one of the following broswers: Internet Explorer 11 (or greater) or the latest version of Chrome or Firefox
