Indexing and Searching

While browsing around in locations known to hold artifactsArtifact is a common forensic practice, it is not always enough. An equally common practice is to actually search for what you want and let the computer do the heavy lifting. It is not uncommon for a case to hold information about interesting names, e-mail addresses, or other keywords that are related to the case. In such a scenario, a search over all case data is usually the preferable starting point for an examinationExamination. The intent of this chapter is to provide the reader with a discussion on different search techniques as well as to demonstrate how to set up a case for fast searchingSearching using a text index. Further, the chapter will introduce the reader to the art of regular expressionsRegular expression and demonstrate how they can be leveraged in computer forensics.