Indexing Keywords in Data
Posted by Jack H. Ward, Last modified by Jack H. Ward on 07 February 2018 09:43 AM

To perform keyword indexing:

1. Select the evidence (case node, evidence node, disk, folder, etc.) you wish to index keywords in.

If the evidence has changed (because data has been added to it), you should clear the content analysis results and then index keywords in the evidence again in order to get up-to-date results.

2. Right-click the evidence and select Index Keywords from the Content Analysis sub-menu, or click Content Analysis on the Analysis tab in the Content Analysis group, and then click Index Keywords in the drop-down menu.

3. The Content Analysis wizard opens. Select Index Keywords on the General options page and define other keyword indexing options. Click Finish.

Only one content analysis task can be running at a time. If you want to perform other types of content analysis along with keyword indexing, you will need to select them in the wizard as well.

4. The keyword indexing process starts. Its status is displayed in the Tasks pane, where it can be stopped, paused, or started.

5. Indexed files/folders are marked in blue after refreshing.

If any other type of content analysis was performed for a file/folder, it will be marked blue as well.

6. For evidence that has been indexed, a Keyword search can be performed.

Keywords indexing may take a lot of time for evidence with a lot of data.

Keyword Indexing Results

Indexed files and folders are marked in blue and have the Yes value in the Keywords Indexed field on the Content Analysis tab of the Properties pane.

After keywords are indexed, a keyword search can be performed in this evidence. As the keywords in the evidence have already been found, a keyword search is performed much faster than a regular search.

A database with indexed keywords is placed next to the Electronic Evidence Examiner case it belongs to. The database name is <case name>_keyword_indexing.

When you save a case as an archive, the keyword indexing database is added to the archive.

(0 vote(s))
Not helpful

Comments (0)