I rarely index an image in X-Ways Forensics because the simultaneous search option is usually fast enough. On this occasion I'm trying it though, and I'd like to ask about code pages; I can select up to four code pages of the dozens available. Which ones should I pick for Mac OS? The OS version is 10.6.8, and the language is British English. The default code pages selected are ANSI - Latin I (1252) and Unicode UTF-16 Little Endian (1200).
Are there any forensic references as to searching/indexing and code pages? Conducted a brief Google search but didn't see much.
Thanks.
I got this very helpful reply from Stefan Fleischmann on the X-Ways forum for those who're interested
"You can easily view and compare code pages using View | Tables | Code Page and educate yourself. You will notice that maybe 95% of all code pages (including all Windows and Mac code pages, but not UTF-16 and EBDCIC and more exotic stuff) contain 7-bit ASCII as a common subset (in the range from 0x00 to 0x7F), and original Latin characters (=English characters) are all contained in 7-bit ASCII, because ASCII was invented by English speaking people who did not see a need to support any other language at that time. The "A" in ASCII stands for "American". So if you are only looking for search terms that consist of English letters and characters contained in 7-bit ASCII, then you can just as well stick with ANSI Latin I instead of a Mac code page, because they are identical for your purposes. Even UTF-8 is identical for your purposes and does not need to be indexed separately. Whether Mac OS X stores any relevant text in big endian or little endian UTF-16 I don't know, I would guess maybe not."