Keyword Search
Posted by Jack H. Ward, Last modified by Jack H. Ward on 07 February 2018 09:08 AM

Electronic Evidence Examiner allows you to perform searches in mailstorage evidence much faster if you use the keyword search option. Keyword searches are available for textual data in the evidence that has been previously indexed.

During indexing, the keywords in the evidence are placed in a keywords database for the case. The keyword search filters out already found keywords from the database according to your search request, thus making the search process faster.

Database with indexing results (placed next to the Electronic Evidence Examiner case named <case name> _keyword_indexing) must not be renamed, moved, or deleted. Otherwise keyword searches will not be performed or their results will be incomplete. 

To perform keyword searches using Electronic Evidence Examiner:

1. Index the keywords in the evidence to be investigated.

2. Select the case node, evidence, folder, message, file, etc. in which the data will be searched.
3. Right-click and select Keyword Search or click Keyword Search on the Analysis tab, in the Search group.
4. The Keyword Search pane opens. It is a tab named Keyword Search-<search path name>

5. Click Browse to specify the subfolders of the selected folder in which the search will be performed.

6. Enter the Search parameters. The following parameters are available:

  • Subject: Select this option to search in the message.
  • Body: Select this option to search in the message.
  • Contacts: Select this option to search in mailbox contacts.
  • Calendars: Select this option to search in mailbox calendars.
  • Attachment file names: Select this option to search in file names of message attachments.
  • Attachments: Select this option to search in attachment bodies.
  • Sender: Select this option to search in email sender fields.
  • Recipient: Select this option to search in Recipient, CC, BCC fields of an email.
  • Other locations: Other locations in the mailstorage database, including Calendar, Tasks, Drafts, etc.
7. Click Start or press Enter.
8. The search starts. Its status is displayed in the Tasks pane, where it can be stopped, paused, or started.

The results of finished searches will be saved and stored until the task is removed from the Task Pool.

9.The search results are displayed in the Results area of the Search pane. 

 Keyword search.png (9.45 KB)
(0 vote(s))
Not helpful

Comments (0)