Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Keyword Search with Range Bookmarking

This EnScript performs a keyword search of user-specified items.

If an item is an entry then file-slack will be searched by default. The user can opt to ignore an entry's logical-data if the entry's hash-value matches that of a hash-item listed in the current hash-library.

Keywords can be entered manually and will be stored by the script for later use. They can also be imported from a *.Keywords file or a file exported by the raw search dialog.

The script will bookmark a specified number of bytes either side of each hit. The user can specify that this data should be bookmarked only if unique but this will increase processing time.

It's important to note that bookmarks are grouped per keyword-name or, if no name has been given, by keyword-expression. Taking this into account, it's advisable to name GREP keyword-expressions to prevent bookmark-folder naming issues causes by certain GREP operators.

Bookmarked data may be written into a logical evidence file such that records will be stored using the item-path property; entries will be stored using the true-path property minus the name of the current case. Each path can be prefixed with the primary and secondary-device GUIDs of the source file to prevent the inadvertent merging of paths, which can happen due to duplicate evidence-file or compound-file names.

In addition to bookmarks, the script will also create a result-set containing responsive items. The user can opt show these items in the Report view of the Results tab such that any keyword-hit will be highlighted. Note that taking this option will cause all search-hits to be highlighted even if the user chose the option to only bookmark unique hits.

A recent addition to the script is the ability to search the transcript data of items rather than their file data. This can prove very useful for searching file-types containing compressed data (docx, xlsx, pdf, etc.) and does not require indexing.

To use this option, the user must specify a condition that identifies the items whose transcript data is to be searched. It's important to note that an empty condition will return true by default - this would cause the transcript data of every processed item to be searched, which might in turn lead to undesirable consequences. To disable transcript searching it's therefore necessary to uncheck the Use Transcript option.

The script creates text bookmarks for search-hits found in files; the source data can be viewed in the text or hex tabs. The source data for transcript bookmarks needs to be viewed in the Transcript tab.

Please note that a known bug causes the Keyword Hits tab to be activated once the script has finished processing.

Search-terms must specify Unicode in order to work with transcript data.

Feedback is provided via the console window.

Download Now



Version: 5.1.0
Tested with:
EnCase Forensic 8.05
Developer: Simon Key
Category: Utility

3735 DOWNLOADS

YOU MAY ALSO LIKE

Utility

SQLite Blob Extractor

This script is designed to extract BLOB-data from SQLite database files.
By Simon Key
348 Downloads
App
Utility

Volatility Plugin

This EnScript is designed to facilitate easier use of Volatility in EnCase. It can be configured for any number of Volatility plugins and supports multithreading.
By Simon Key
177 Downloads
App
Utility

Registry Viewer Plugin

This script allows the examiner to to use a right-click context-menu-option or keyboard shortcut to view Registry hive files (SYSTEM, SOFTWARE, SECURITY, SAM, NTUSER,DAT, etc.).
By Simon Key
154 Downloads
App
Utility

Run Condition As Filter

This download consists two filters designed to make it easier to locate, edit, and launch conditions from multiple locations. They also make it easier to create modified copies of the conditions that ship with EnCase.
By Simon Key
88 Downloads
App