Search and Bookmark Specific Data Types
This script searches for specific keywords and bookmarks the hits for each one using a specified data-type.
The script supports searching both records and entries; it also allows the examiner to create a result-set for responsive items.
The option to bookmark only those hits at sector-offset zero is useful for excluding extraneous file-signature search-hits.
This option is only applicable to records. It should be used with care as it might exclude relevant data embedded in other files, e.g. MFT-resident files, embedded thumbnail images, JPEG pictures in Word documents, etc.
This script was developed for use in EnCase training. For more details, please click the following link:Download Now