Searching in Chat Databases
Posted by Jack H. Ward, Last modified by Jack H. Ward on 08 February 2018 03:10 AM

Electronic Evidence Examiner allows you to perform searches in chat databases.

To search for text data, it is recommended that you use the keyword search. Keyword searches are performed much faster than regular searches. Please note that keywords in your evidence should be indexed before you perform a keyword search.

To perform searching, do the following:

1. Add the chat database to a new or existing case.

2. The chat database structure is displayed in the Case Content pane (to the left), contents of the selected node are displayed in the Data View pane (to the right).
3. Select the node in the Case Content pane or message in the Data View pane where you want to search for data. The selected node or message must be sorted and indexed first.
4. Right-click and select Advanced Search, or click Advanced Search on the Analysis tab, in the Search group.
5. The Search pane opens (to the right).

6. Enter the Search Parameters.The following groups of parameters are available:

  • Common parameters: These parameters include general information about what is to be searched.
  • Special Chat databases parameters: These parameters include sender and date filters.
7. Click Start.
8. The search starts. Its status is displayed in the Tasks pane and it can be stopped, paused, and started from there (through the right-click menu or using Stop, Pause, or Start/Resume buttons).

9. The search results are displayed at the bottom part of the Search pane.
10. Double-click the search result to open it in the RTF viewer. The search result is highlighted.

 Chat database search.png (14.07 KB)
(0 vote(s))
Not helpful

Comments (0)