GREP search for an IP address

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Infern0 17 years ago

3 Posts

3 Users

0 Reactions

2,073 Views

RSS

csusama008

(@csusama008)

Eminent Member

Joined: 18 years ago

Posts: 22

Topic starter 19/02/2009 1:39 am [#3515]

Can anyone help me in regards to writing a GREP expression for IP addresses? I am trying to find all IP addresses located on a suspect's system. Thanks in advance.

Quote

CdtDelta

(@cdtdelta)

Estimable Member

Joined: 17 years ago

Posts: 134

19/02/2009 2:13 am

For EnCase GREP? Sure

##?#?\.##?#?\.##?#?\.##?#?[^#\.]

(I have enough copies of that in all of my EnCase training manuals. )

Tom

ReplyQuote

Infern0

(@infern0)

Trusted Member

Joined: 18 years ago

Posts: 54

19/02/2009 8:46 am

Here you go…a little more strict

[^#\.]
(2(5[0-5])|([0-4][0-9]))|([01]?[0-9]?[0-9])\.
(2(5[0-5])|([0-4][0-9]))|([01]?[0-9]?[0-9])\.
(2(5[0-5])|([0-4][0-9]))|([01]?[0-9]?[0-9])\.
(2(5[0-5])|([0-4][0-9]))|([01]?[0-9]?[0-9])
[^#\.]

ReplyQuote