Computer Forensics and Digital Investigation with EnCase Forensic v7

CHAPTER

10

Conditions and Filters

Now that you are comfortable building your own keywords and performing searches in EnCase, we can look at more complex options for narrowing down our results. By combining the various options available for searching with the ability to include specific criteria and programming logic, we can get quite granular in our results while maintaining confidence in their quality.

In addition to keyword searching, EnCase provides two powerful methods to design your own criteria for finding and reporting results—conditions and filters. Conditions and filters are similar, differing primarily in the way you build (new) or modify ...