Autopsy User Documentation  4.5.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Ad Hoc Keyword Search

Overview

The ad hoc keyword search features allows you to run single keyword terms or lists of keywords against all images in a case. Both options are located in the top right of the main Autopsy window.

keyword-search-ad-hoc.PNG

The Keyword Search Module must be selected during ingest before doing an ad hoc keyword search. If you don't want to search for any of the existing keyword lists, you can deselect everything to just index the files for later searching.

Creating Keywords

The following sections will give a description of each keyword type, then will show some sample text and how various search terms would work against it.

Exact match

Exact match should be used in cases where the search term is expected to always be surrounded by non-word characters (typically whitespace or punctuation). Spaces/punctuation are allowed in the search term, and capitalization is ignored.

The quick reddish-brown fox jumps over the lazy dog.

Substring match

Substring match should be used where the search term is just part of a word, or to allow for different word endings. Capitalization is ignored but spaces and other punctuation can not appear in the search term.

The quick reddish-brown fox jumps over the lazy dog.

Regex match

Regex match can be used to search for a specific pattern. Regular expressions are supported using Lucene Regex Syntax which is documented here: https://www.elastic.co/guide/en/elasticsearch/reference/1.6/query-dsl-regexp-query.html#regexp-syntax. Wildcards are automatically added to the beginning and end of the regular expressions to ensure all matches are found. Additionally, the resulting hits are split on common token separator boundaries (e.g. space, newline, colon, exclamation point etc.) to make the resulting keyword hit more amenable to highlighting.

There is some validation on the regex but it's best to test on a sample image to make sure your regexes are correct and working as expected. One simple way to test is by creating a sample text file that your expression should match, ingesting it as a Logical File Set and then running the regex query.

In the year 1885 in an article titled Current Notes, the quick brown fox first jumped over the lazy dog.

Other notes

Built-in keywords

The Keyword Search Module has several built-in searches that can not be edited. The ones that are most prone to false hits (IP Address and Phone Number) require that the matching text is surrounded by boundary characters, such as spaces or certain punctuation. For example:

If you want to override this default behavior:

Non-Latin text

In general all three types of keyword searches will work as expected but the feature has not been thoroughly tested with all character sets. As with regex above, we suggest testing on a sample file. Some notes:

Keyword Search

Individual keyword or regular expressions can quickly be searched using the search text box widget. You can select "Exact Match", "Substring Match" and "Regular Expression" match. See the earlier Creating Keywords section for information on each keyword type.

keyword-search-bar.PNG

Results will be opened in a separate Results Viewer for every search executed and they will also be saved in the Directory Tree as shown in the screenshot below.

keyword-search-hits.PNG

Keyword Lists

In addition to being selected during ingest, keyword lists can also be run through the Keyword Lists button. For information on setting up these keyword lists, see the Lists tab section of the ingest module documentation.

Lists created using the Keyword Search Configuration Dialog can be manually searched by the user by pressing on the 'Keyword Lists' button, selecting the check boxes corresponding to the lists to be searched, and pressing the 'Search' button.

keyword-search-list.PNG

The results of the keyword list search are shown in the tree, as shown below.

keyword-search-list-results.PNG

Doing ad hoc searches during ingest

Ad hoc searches are intended to be used after ingest completes, but can be used in a limited capacity while ingest is ongoing.

Manual Keyword Search for individual keywords or regular expressions can be executed while ingest is ongoing, using the current index. Note however, that you may miss some results if the entire index has not yet been populated. Autopsy enables you to perform the search on an incomplete index in order to retrieve some preliminary results in real-time.

During the ingest, the normal manual search using Keyword Lists behaves differently than after ingest is complete. A selected list can instead be added to the ingest process and it will be searched in the background instead.

Most keyword management features are disabled during ingest. You can not edit keyword lists but can create new lists (but not add to them) and copy and export existing lists.


Copyright © 2012-2016 Basis Technology. Generated on Wed Dec 13 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.