This script searches for specific keywords and bookmarks the hits for each one using a specified data-type.

The script supports searching both records and entries; it also allows the examiner to create a result-set for responsive items.

The option to bookmark only those hits at sector-offset zero is useful for excluding extraneous file-signature search-hits.

This option is only applicable to records. It should be used with care as it might exclude relevant data embedded in other files, e.g. MFT-resident files, embedded thumbnail images, JPEG pictures in Word documents, etc.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training