I know by the title it doesn't sound forensic related, but many times we all find ourselves carving out something and then pasting it to a word document or a .txt document.
I've come across a multi-page carve and it looks like this.
397"feed//news.google
>?Ahttp//espn.go.com
[\^http//www
So, the question at hand would be is there a way through replace where I can have Word® remove anything 3 or 4 characters or spaces before anything that says http ?
The characters aren't all the same, in fact no 2 lines have the same items so a blanket replace of certain characters would not be possible.
Any advice?
Thanks.
In Word's Search and Replace function there is a wildcard check box.
Once checked, you can,
Find ???http//
Replace with http//
The '?' matches any single character.
Really? That's pretty neat, I'll give it a go.
I know there are others who have had the exact same problem, but as we all say while were at conferences hanging out, a lot of times people don't want to ask because something seems too basic.
In Word's Search and Replace function there is a wildcard check box.
Once checked, you can,
Find ???http//
Replace with http//
The '?' matches any single character.
Needless to say a global search and replace is risky.
Image this text on a single line.
qwdfhttp//
The output will behttp//
and you have lost some potentially interesting information.
cntrl+h is the shortcut for that.
Ideal if you are only doing a small amount of changes, you can simply select next for each new instance and decide on a case by case basis to apply the edit so you can avoid the pitfall Passmark has pointed out above )
I use this search and replace tool a lot.
So, the question at hand would be is there a way through replace where I can have Word® remove anything 3 or 4 characters or spaces before anything that says http ?
Why don't you do it like this?
Replacehttpwith^phttp^p is the "special character" in Word for "paragraph", it equates to CR+LF.
This way all your lines will begin with "http".
Of course you can do the same with gsar or similar command line tools.
jaclaz