How to search compound files

Last week my friend told me that she made a terrible mistake. She conducted raw serch and found no search hits within M$ docx files. She did not know what‘s wrong in the first place until her clients told her that some words actually exist in those docx files...She exported those docx files and examine them very carefully. Yes she found those wors exactly the same with keywords.

She asked me what‘s going on with EnCase raw search. Why no search hits in docx files...I show her how to conduct raw search on compound files as below:

1. Run EnScript: File-Mounter so you could expand compound files

2. Choose file type: docx

3. Now you could see those docx files become volume with xml files

4. Conduct raw search and you could see search hits inside docx files now

I told her that Forensic is a strict science and she should double check the search results again to make sure she won‘t make any mistakes. In Court we swear that the evidence that we shall give, shall be the truth, the whole truth and nothing but the truth. I suggest her to re-examine at those evidence and forensic reports she signed in recent years, and see if any wrong with raw search in compound files.

时间： 2024-08-02 09:20:43

How to search compound files的相关文章

EnCase v7 search hits in compound files?

I used to conduct raw search in EnCase v6, and I'd like to see if EnCase v7 raw search could hit keywords inside compound files or not. You won't believe it~search results is 0 but those keywords do exist inside compound files...Let my show you my te

42 Bing Search Engine Hacks

42 Bing Search Engine Hacks November 13, 2010 By Ivan Remember Bing, the search engine Microsoft launched to topple Google? Ok, it didn't work that way but it still has lots of great features and deserves a second look. 42 Bing Search Engine Tips and

Javascript > Eclipse > problems encountered during text search

Reproduce: Ctrl + H, Select "File Search", will encounter eclipse kinds of bug/error alert: problems encountered during text search Reason: It's because Ctrl + H by default will search disk files, and when the disk files get un-sync with eclipse

Everything search syntax

Operators: space AND | OR ! NOT < > Grouping " " Search for an exact phrase. Wildcards: * Matches zero or more characters. ? Matches one character. *.* Same as * Macros: quot: Literal double quote (") apos: Literal apostrophe (') amp:

Unix必备知识精华版

一.注意事项 命令和参数之间必需用空格隔开,参数和参数之间也必需用空格隔开. 一行不能超过256个字符:大小写有区分. 二.特殊字符含义 文件名以“.”开头的都是隐藏文件/目录,只需在文件/目录名前加“.”就可隐藏它. ~/       表示主目录. ./       当前目录(一个点). ../      上一级目录(两个点). ;        多个命令一起用. >  >>    输出重定向  .将一个命令的输出内容写入到一个文件里面.如果该文件存在, 就将该文件的内容覆盖: 如果不

linux 正则表达式基础篇

========  尖括号^ :例:^work:表示以work开头的内容========  $:            work$: 表示以work结尾的内容 ========  ^$:表示空行,不是空格 ========  . 代表且只能代表任意一个字符========  \ 代表转意字符(让代表特殊意义的字符返回原形)例子: \.:只表示小数点========  * 重复0个或者多个前面的字符,不代表所有了========  .* 匹配所有的字符.========  ^.* 任意多个字符开头

sublime搜索和替换--正则

Search and Replace Sublime Text features two main types of search: Search - Single File Search - Multiple Files We'll examine them in turn, but first let's talk about a powerful tool for searchingtext: regular expressions. Regular Expressions Regular

makefile实例（2）-多个文件实例

1,源文件依赖关系 defs.h command.h buffer.h main.cpp * util.cpp * kde.cpp * * command.cpp * * display.cpp * * insert.cpp * * search.cpp * * files.cpp * * * 2, 源文件 因为这里只是想做一下简单测试,所以很多源文件的内容都是空的. [[email protected] 1-makefile]#head *.h ==> buffer.h <== #pragm

移动安全初探：窃取微信聊天记录、Hacking Android with Metasploit

在这篇文章中我们将讨论如何获取安卓.苹果设备中的微信聊天记录,并演示如何利用后门通过Metasploit对安卓设备进行控制.文章比较基础.可动手性强,有设备的童鞋不妨边阅读文章边操作,希望能激发大家对移动终端的安全兴趣. (文章内容存在一定攻击性,目的在于普及终端安全知识.提高安全意识,如有非法使用,后果自负) “如何获取Android.iPhone手机上的微信聊天记录? ” 0×00 条件: 安卓设备已获取root权限,安装SSHDroid(通过ssh.ftp连接手机) Apple设备越狱,安