Notifications
Clear all
Topic starter
10/06/2013 9:43 am
Anyone know what's the different between search hits and added search hits? See example of my bookmark.
Searching
Status Completed
Start xxxxxxxxx
Stop xxxxxxxxx
Time 22100
Files 239,997
Records 2
Files scanned 229,408
Signature mismatches 27,725
Hash values 230,227
Search Hits 1,292,184
Added Search Hits 1,167,771
10/06/2013 4:38 pm
Its to do with files that 'double-hit'.
If you have a search hit come from a file that is resident in the MFT, you get the hits from both the MFT and where it appears in the directory structure. Rather than give you both hits, EnCase will only give you the hit from the directory structure.