how to use regular ...
 
Notifications
Clear all

how to use regular expression on autopsy

2 Posts
2 Users
0 Reactions
1,452 Views
(@binarry)
New Member
Joined: 2 years ago
Posts: 1
Topic starter  

hello

i want to use a regular expression on autopsy to find all entries of (private bank or privates-banks, or *private*bank*) i have used this syntax 

(index.dat | *private*bank*) so is it the correct syntax

thank you


   
Quote
Topic Tags
(@Anonymous 6593)
Guest
Joined: 16 years ago
Posts: 1158
 

My reply seems to have been blocked by Wordfence. That's kind of good, as a lack of an answer just may make you avoid using grep.  It unpracticed hands it is like a scalpel of an eye-surgeon: you won't notice that you just cut yourself.

The Autopsy user guide has good advice: "There is some validation on the regex but it's best to test on a sample image to make sure your regexes are correct and working as expected. One simple way to test is by creating a sample text file that your expression should match, ingesting it as a Logical File Set and then running the regex query."


   
ReplyQuote
Share: