Old School Search Hit Viewer
The Old School Search Hit Viewer will display search hits in a table; the hits are highlighted with a user-specified amount of context visible around the search hit. Multiple items and multiple search terms may be displayed in the same table.
The script will read keywords from existing searches and result sets, however the items must be searched again (the existing hits are not accessible to EnScript). Once the Old School results are found, they are saved for quick future access.
The script adds a toolbar menu to the Search and Result tabs.
When the script is started from the Search tab, the current active search will be loaded for viewing. When the script is started from the Results tab, you will select the Result Set to view.
Keywords are read from the result set, and presented to the user. The script will search for the selected keywords; by default all keywords are selected. In this dialog, you also specify the number of adjacent bytes to display.
A progress bar is displayed as the items are searched.
When the search completes, the Old School result view is displayed with keywords in the left pane, and hits in the right pane. Hits from multiple keywords may be viewed together by use of the green-plate icons in the left pane.
Hits found in a non-Unicode codepage will be displayed in the “Codepage Preview” column. Unicode hits will be displayed in both the “Codepage Preview” and “Unicode Preview” columns. You can bookmark single or multiple hits from the Old School viewer by clicking the “Bookmark Hit” button.
If you place the EnPack in the C:\Program Files\<EnCase install>\EnScript\Main directory, the “View Old School” toolbar button will be available each time EnCase starts.