Notifications
Clear all

FTK Search??

7 Posts
3 Users
0 Reactions
2,429 Views
(@strobak)
Eminent Member
Joined: 18 years ago
Posts: 35
Topic starter  

Hi, i have a problem and its only recently happened, when i am key word searching (indexed search) in FTK, a lot of the hits i get are nothing to do with the search term i entered.
I have noticed that the "hits" that do not match my search term seem to always be in "DriveFreeSpace".

What is the explanation for this and how can i stop this from happening?
Is this a feature of "indexed" search? I'm obviously missing something… (

Thanks guys


   
Quote
(@strobak)
Eminent Member
Joined: 18 years ago
Posts: 35
Topic starter  

no no??


   
ReplyQuote
(@jlindmar)
Eminent Member
Joined: 20 years ago
Posts: 30
 

Do you mean the result being highlighted as responsive is incorrect?


   
ReplyQuote
(@strobak)
Eminent Member
Joined: 18 years ago
Posts: 35
Topic starter  

Correct.

Although i wouldn't call it "incorrect", its more that i don't understand what FTK is doing here, it seems its maybe relating hits to previous search terms in some way? something to do with "indexing" i think…

must be a simple answer, can anyone inform me and put me out of my ignorance?


   
ReplyQuote
(@bithead)
Noble Member
Joined: 20 years ago
Posts: 1206
 

Can you provide an example? I have not had this issue in either FTK or dtSearch but would certainly be interested in trying to recreate your issue.


   
ReplyQuote
(@jlindmar)
Eminent Member
Joined: 20 years ago
Posts: 30
 

In my experience, on those occasions where the incorrect word is highlighted the correct word is usually still found within its proximity. FTK is locating the keyword in the text of the identified file but, it is not correctly highlighting it. If you do a find for the keyword in the identified file you should see it.


   
ReplyQuote
(@strobak)
Eminent Member
Joined: 18 years ago
Posts: 35
Topic starter  

Nikonix,

I realise this and doing the find was my solution to the problem. Just thought it was a little weird…its not too much of a problem at all

Thanks anyway


   
ReplyQuote
Share: