Encase Forensic 6.xx Boolean "AND" Keyword Search
Posted on 2011-09-23
I am using EnCase Forensic 6.18 to keyword search data from a desktop computer. My keyword list has 4 basic terms and are all similar to:
(Term1 OR Term2) AND (Term3 OR Term4 OR Term5 OR Term6)
I have broken down these terms to the point where I first search for Term1 and Term2, and then in a second and third round of searches, apply Terms3-6 to the results of either Term1 or Term2.
However, I would like to not spend my day babysitting the machine. Is there a way to get the same results in a single search or action using EnCase 6.xx? Complex Grep statement or nested keyword list? Anything?