I used to conduct raw search in EnCase v6, and I'd like to see if EnCase v7 raw search could hit keywords inside compound files or not. You won't believe it~search results is 0 but those keywords do exist inside compound files...Let my show you my test as below:

Scenario:

Two compound files, one is a docx and the other is a xlsx. Two keywords, one is "password",and the other is "密碼".

1. Evidence Processing( expand compound files option is checked) completed.

2. word.docx

3. excel.xlsx

4. Conduct raw search

5.Search result = 0

As you could see that those keywords do exist in those two compound files, but no any hits...

EnCase v7 search hits in compound files?的更多相关文章

  1. How to search compound files

    Last week my friend told me that she made a terrible mistake. She conducted raw serch and found no s ...

  2. [DFNews] EnCase v7.08发布

    EnCase v7.08 近日正式发布,7.08增加了Evidence Processor Manager以及Evidence Processor,不仅可以在本地实现证据处理队列,也支持了通过网络进行 ...

  3. Something wrong with EnCase index search in Unallocated area

    hi, My EnCase version is v7 and I found a terrible issue about index search in Unallocated area. Wit ...

  4. [Linux] Search the contents of files using grep

    Learn the basic syntax for using grep to search the contents of a single file or files. It's like CM ...

  5. EnCase v7 could not recognize Chinese character folder names / file names on Linux Platform

    Last week my friend brought me an evidence file duplicated from a Linux server, which distribution i ...

  6. [IR课程笔记]Hyperlink-Induced Topic Search(HITS)

    两个假设 1. 好的hub pages: 好的对某个主题的hub pages 链接许多好的这个主题的authoritative pages. 2. 好的authoritative pages: 好的对 ...

  7. EnCase v.s. FTK - find out Chinese characters writing in different direction

    A friend of mine said to me that she could fool those forensic tools easily by changing writing dire ...

  8. Lucene add、updateDocument添加、更新与search查询(转)

    package com.lucene;   import java.io.IOException;   import org.apache.lucene.analysis.standard.Stand ...

  9. 关于Eclipse Debug断点调试出现 Search not found 页面的解决办法

    1. 在代码中鼠标右键 Debug AS ---> Debug Configurations... ----> 找到Source选项  ---> 点击add ---> 选择 j ...

随机推荐

  1. ssh 连接ubuntu的虚拟机问题

    我在winxp的虚拟机上装了一个ubuntu9.04的系统,winxp的ip为10.118.62.157,ubuntu的ip为192.168.116.1 两个ip互相ping都是正常的,但是,我在wi ...

  2. 解决Xshell和vim中文乱码（转载）

    From:http://blog.csdn.net/lovey599/article/details/7275403 一般而言,乱码多是由于编码问题引起 的,在windows系统中,大多数情况下中文编 ...

  3. （Delphi） Windows 32 API程序设计目录

    这里所有程序均使用Delphi调用Windows 32 API方式实现,并不是使用VCL已经封装好的类实现的! (一)第一个窗口程序 01 创建第一个窗口.

  4. HTML5的动画学习历程

    一.三角学原理. function getRadio(d){//根据角度获得弧度,                return d*Math.PI/180;                }, fun ...

  5. inno setup脚本,涵盖了自定义安装界面,调用dll等等应用

    ; Script generated by the Inno Setup 脚本向导. ; SEE THE DOCUMENTATION FOR DETAILS ON CREATING INNO SETU ...

  6. task中的一些属性

    1.android:allowTaskReparenting 这个属性用来标记一个Activity实例在当前应用退居后台后,是否能从启动它的那个task移动到有共同affinity的task,“tru ...

  7. relatedTarget、fromElement、toElement之间的关系

    在发生mouseover和mouseout事件时会把鼠标指针从一个元素的边界之内移到另一个元素边界之内.对 mouseover事件而言,事件的target是获得光标的元素,而relatedTarget ...

  8. C与Lua互相调用的时候，栈变化分析

    1  C调用Lua函数的堆栈变化 例子 Lua文件中的函数 function testNewCounter2() return "第四个结果" end C中的例子 void t_n ...

  9. eclipse 调试时出现 Error: [Errno 10013]

    法1: 端口占用错误.换个端口即可. 新端口 在 8001到15536之间的任意值. 法2: windows下查看哪个程序占用端口 netstat -ano | findstr “8080”  找到p ...

  10. Appium+Maven+TestNG(ReportNG)环境搭建（详细过程）

    最近群里经常有人会问到关于maven构建Appium测试项目以及使用testNG生成测试报告的问题,试着搭建了一下,下面是过程: jdk安装过程我这里就不说了 一.下载eclipse,推荐下载Ecli ...