Question
Does EnCase EDiscovery's criteria have a wildcard option to force include all files? Or is it restricted to only collect known file extensions and/or custom extensions?
It doesn't use a wild card. You would need to just leave the option to limit file ext blank.
Essentially a "blank" encase criteria will collect everything in the object/target you're searching against. IF you want to collect all file types then all you'd want to do is to include/exclude the information you want such as
Date Range (Create, Last Accessed); True Path; file size; etc…
Exclusion of 0-size files, Common System (OS) folders, and an inclusive date range would be a good start.
If you're using the criteria wizard, it will walk you thru. Just don't select file types and move on. It'll collect every file by default.
