Last week my friend told me that she made a terrible mistake. She conducted raw serch and found no search hits within M$ docx files. She did not know what's wrong in the first place until her clients told her that some words actually exist in those docx files...She exported those docx files and examine them very carefully. Yes she found those wors exactly the same with keywords.

She asked me what's going on with EnCase raw search. Why no search hits in docx files...I show her how to conduct raw search on compound files as below:

1. Run EnScript: File-Mounter so you could expand compound files

2. Choose file type: docx

3. Now you could see those docx files become volume with xml files

4. Conduct raw search and you could see search hits inside docx files now

I told her that Forensic is a strict science and she should double check the search results again to make sure she won't make any mistakes. In Court we swear that the evidence that we shall give, shall be the truth, the whole truth and nothing but the truth. I suggest her to re-examine at those evidence and forensic reports she signed in recent years, and see if any wrong with raw search in compound files.

How to search compound files的更多相关文章

  1. EnCase v7 search hits in compound files?

    I used to conduct raw search in EnCase v6, and I'd like to see if EnCase v7 raw search could hit key ...

  2. Python开发环境Wing IDE之Search in Files工具详解

    Search in Files工具是Wing IDE中最强大的搜索选项.它支持磁盘.项目,打开编辑器,或其它文件集的多文件批量搜索.它还可以使用通配符搜索,并可以做基于正则表达式的搜索/替换. 建议用 ...

  3. Everything search syntax

    Operators: space AND | OR ! NOT < > Grouping " " Search for an exact phrase. Wildcar ...

  4. Inplace Search on document libraries and lists is not working

    [http://sharepointfarmer.com/inplace-search-on-document-libraries-and-lists-is-not-working/] I ran i ...

  5. Javascript > Eclipse > problems encountered during text search

    Reproduce: Ctrl + H, Select "File Search", will encounter eclipse kinds of bug/error alert ...

  6. 42 Bing Search Engine Hacks

    42 Bing Search Engine Hacks November 13, 2010 By Ivan Remember Bing, the search engine Microsoft lau ...

  7. lucene原理及源码解析--核心类

    马云说:大家还没搞清PC时代的时候,移动互联网来了,还没搞清移动互联网的时候,大数据时代来了. 然而,我看到的是:在PC时代搞PC的,移动互联网时代搞移动互联网的,大数据时代搞大数据的,都是同一伙儿人 ...

  8. 简单编写Makefile

    相信很多朋友都有过这样的经历,看着开源项目中好几页的makefile文件,不知所云.在日常学习和工作中,也有意无意的去回避makefile,能改就不写,能用ide就用ide.其实makefile并没有 ...

  9. grep 命令过滤配置文件中的注释和空行

    grep 用法 Usage: grep [OPTION]... PATTERN [FILE]... Search for PATTERN in each FILE or standard input. ...

随机推荐

  1. java学习日志(1):命令行and小程序

    1.dos命令行,常见的命令 dir:列出当前目录下的文件以及文件夹md:创建目录rd:删除目录(必须空)cd:进入指定目录cd.. :退回到上一级目录cd/:退回到根目录del:删除文件exit:退 ...

  2. Laravel5.0 CSRFチェックを無効化(修改后可以像5.1以上那样从CSRF保护中排除指定URL)

    Laravel5では全てのPOSTに勝手にCSRFチェックが付いてきます.便利と言えば便利ですが.Laravel外からのPOSTを受け取りたいときなど大迷惑です. CSRFチェックを排除する方法が何故 ...

  3. Redis各种数据结构内存占用测试

    启动时:(redis为空) 插入数据量都为100W(100W个key或者list中100W个值,或者1000个key,每个key中1000个值) String Key value # Memory u ...

  4. sql工作问题总结

    1. sql排序:1. order by ……2. row_number() over(partition by …… order by ……) 使用说明:此函数适合做分组.排序,而不能在使用它分组的 ...

  5. mysql 按年度、季度、月度、周、日SQL统计查询

    创建Table CREATE TABLE `test` ( `cdate` datetime DEFAULT NULL, `id` ) DEFAULT NULL, `name` ) DEFAULT N ...

  6. linux内核设计与实现--进程调度 系统调用

    进程可以分为I/O消耗型和处理器消耗型. I/O消耗型指,进程的大部分时间用来提交I/O请求或者等待I/O请求. 处理器耗费型进程把时间大多用在执行代码上. linux采用了两种不同的优先级范围: 第 ...

  7. C++学习22 多态的概念及前提条件

    在<C++基类和派生类的赋值>一节中讲到,基类的指针也可以指向派生类对象.请看下面的例子: #include <iostream> using namespace std; c ...

  8. 为什么wait(),notify()和notifyAll()必须在同步块或同步方法中调

    我们常用wait(),notify()和notifyAll()方法来进行线程间通信.线程检查一个条件后就行进入等待状态,例如,在"生产者-消费者"模型中,生产者线程发现缓冲区满了就 ...

  9. cctype函数 (字符类型判断)

    这些函数都在cctype头文件定义 isalnum(c)  如果C是字母或数字,则为TRUE isalpha(c)  如果C是字母,返回TRUE iscntrl(c) 如果C是控制字符,返回TRUE ...

  10. 高可用HA,高性能

    天天开发,免不了听一些技术论坛,都是专业的词汇,没听过就很陌生,记录一下. ======================================================== 高可用: ...