How to search compound files
Last week my friend told me that she made a terrible mistake. She conducted raw serch and found no search hits within M$ docx files. She did not know what's wrong in the first place until her clients told her that some words actually exist in those docx files...She exported those docx files and examine them very carefully. Yes she found those wors exactly the same with keywords.
She asked me what's going on with EnCase raw search. Why no search hits in docx files...I show her how to conduct raw search on compound files as below:
1. Run EnScript: File-Mounter so you could expand compound files

2. Choose file type: docx

3. Now you could see those docx files become volume with xml files

4. Conduct raw search and you could see search hits inside docx files now

I told her that Forensic is a strict science and she should double check the search results again to make sure she won't make any mistakes. In Court we swear that the evidence that we shall give, shall be the truth, the whole truth and nothing but the truth. I suggest her to re-examine at those evidence and forensic reports she signed in recent years, and see if any wrong with raw search in compound files.
How to search compound files的更多相关文章
- EnCase v7 search hits in compound files?
I used to conduct raw search in EnCase v6, and I'd like to see if EnCase v7 raw search could hit key ...
- Python开发环境Wing IDE之Search in Files工具详解
Search in Files工具是Wing IDE中最强大的搜索选项.它支持磁盘.项目,打开编辑器,或其它文件集的多文件批量搜索.它还可以使用通配符搜索,并可以做基于正则表达式的搜索/替换. 建议用 ...
- Everything search syntax
Operators: space AND | OR ! NOT < > Grouping " " Search for an exact phrase. Wildcar ...
- Inplace Search on document libraries and lists is not working
[http://sharepointfarmer.com/inplace-search-on-document-libraries-and-lists-is-not-working/] I ran i ...
- Javascript > Eclipse > problems encountered during text search
Reproduce: Ctrl + H, Select "File Search", will encounter eclipse kinds of bug/error alert ...
- 42 Bing Search Engine Hacks
42 Bing Search Engine Hacks November 13, 2010 By Ivan Remember Bing, the search engine Microsoft lau ...
- lucene原理及源码解析--核心类
马云说:大家还没搞清PC时代的时候,移动互联网来了,还没搞清移动互联网的时候,大数据时代来了. 然而,我看到的是:在PC时代搞PC的,移动互联网时代搞移动互联网的,大数据时代搞大数据的,都是同一伙儿人 ...
- 简单编写Makefile
相信很多朋友都有过这样的经历,看着开源项目中好几页的makefile文件,不知所云.在日常学习和工作中,也有意无意的去回避makefile,能改就不写,能用ide就用ide.其实makefile并没有 ...
- grep 命令过滤配置文件中的注释和空行
grep 用法 Usage: grep [OPTION]... PATTERN [FILE]... Search for PATTERN in each FILE or standard input. ...
随机推荐
- xhprof 安装使用
1.安装扩展 windows下把 xhprof.dll 放到extensions目录下 修改配置文件 [xhprof] extension=xhprof.so; ; directory used by ...
- UCOS-互斥信号量(学习笔记)
互斥信号量主要是为了解决信号量出现的优先级反转的情况:任务的运行取决于优先级和获得信号量2个条件,并且获得信号量又优先于设定的优先级.剥夺性内核对信号量进行独占访问,就有可能出现先获得信号量的低优先级 ...
- python中的生成器
什么是生成器? 生成器是一个包含了特殊关键字yield的函数.当被调用的时候,生成器函数返回一个生成器.可以使用send,throw,close方法让生成器和外界交互. 生成器也是迭代器,但是它不仅仅 ...
- RadASM中文乱码问题解决方法!!
RadASM版本:2.2.2.0 在这个版本的RadASM代码编辑器里面,如果输入中文,则会乱码,经过一些尝试后,终于解决了这个问题,通过修改RadASM的字体设置就可以了!! 修改字体说明:通过本人 ...
- Python进阶02 文本文件的输入输出
作者:Vamei 出处:http://www.cnblogs.com/vamei 欢迎转载,也请保留这段声明.谢谢! Python具有基本的文本文件读写功能.Python的标准库提供有更丰富的读写功能 ...
- by which, in which, from which 语法区别
(1)Here is Beijing,where I grow up.where其实也是指代北京,不过where是在北京的意思,也就是 in Beijing (2)Here is Beijing,in ...
- PHP 时区设置
有时候使用date("Y-m-d h:i:s")时发现时间相差8小时,修改“/etc/php5/apache2/php.ini”: date.timezone = "As ...
- [Flex] ButtonBar系列——最后一个项目的样式设置
<?xml version="1.0" encoding="utf-8"?> <s:Application xmlns:fx="ht ...
- [ActionScript 3.0] AS3 绘制12面体
package { import flash.display.Sprite; import flash.events.Event; import flash.events.MouseEvent; im ...
- MongoDB相关资料收集
MongoDB 入门教程http://www.runoob.com/mongodb/mongodb-tutorial.html .net 驱动程序下载:http://mongodb.github.io ...