Notifications
Clear all
Topic starter
19/02/2009 1:39 am
Can anyone help me in regards to writing a GREP expression for IP addresses? I am trying to find all IP addresses located on a suspect's system. Thanks in advance.
19/02/2009 2:13 am
For EnCase GREP? Sure
##?#?\.##?#?\.##?#?\.##?#?[^#\.]
(I have enough copies of that in all of my EnCase training manuals. )
Tom
19/02/2009 8:46 am
Here you go…a little more strict
[^#\.]
(2(5[0-5])|([0-4][0-9]))|([01]?[0-9]?[0-9])\.
(2(5[0-5])|([0-4][0-9]))|([01]?[0-9]?[0-9])\.
(2(5[0-5])|([0-4][0-9]))|([01]?[0-9]?[0-9])\.
(2(5[0-5])|([0-4][0-9]))|([01]?[0-9]?[0-9])
[^#\.]