Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Keyword Search with Range Bookmarking

This EnScript searches specified items for specified keywords.

If an item is an entry, file-slack will be searched by default. The user can opt to ignore an entry's logical-data if the entry's hash-value matches that of a hash-item listed in the current hash-library.

Keywords can be entered manually and will be stored by the script for later use. They can also be imported from a *.Keywords file or a file exported by the raw search dialog.

The script will bookmark a specified number of bytes either side of each hit. The user can specify that this data should be bookmarked only if unique but this will increase processing time.

It's important to note that bookmarks are grouped per keyword-name, or if no name has been given, by keyword-expression. Taking this into account, it's advisable to name GREP keyword-expressions to prevent bookmark-folder naming issues causes by certain GREP operators.

Bookmarked data may be written into a logical evidence file such that records will be stored using the item-path property; entries will be stored using the true-path property minus the name of the current case. Each path can be prefixed with the primary and secondary-device GUIDs of the source file to prevent the inadvertent merging of paths, which can happen due to duplicate evidence-file or compound-file names.

In addition to bookmarks, the script will also create a result-set containing responsive items. Each result's comment will list the keyword(s) found.

A recent addition to the script is the ability to search the transcript data of items rather than their file data. This can prove very useful for searching file-types containing compressed data (docx, xlsx, pdf, etc.) and does *not* require indexing.

To use this option, the user must specify a condition that identifies the items whose transcript data is to be searched. It's important to note that an empty condition will return true by default - this would cause the transcript data of every processed item to be searched, which might in turn lead to undesirable consequences. To disable transcript searching it's therefore necessary to uncheck the 'Use Transcript' option.

The script creates text bookmarks for search-hits found in files; the source data can be viewed in the text or hex tabs. The source data for transcript bookmarks needs to be viewed in the Transcript tab.

Please note that a known bug causes the Keyword Hits tab to be activated once the script has finished processing.

Search-terms must specify Unicode in order to work with transcript data.

Feedback is provided via the console window.

This script was developed for use in EnCase training. For more details, please click the following link:

Download Now

Download Now


Version: 5.4
Tested with:
EnCase Forensic
Developer: Simon Key
Category: Utility

26 Downloads in last 6 months