String search
A search method you might use during your digital forensic investigation is a string or byte search. This search technique is utilized when you have a keyword list of specific terms that you wish to search for. Most commercial and open-source forensic tools allow for string searches and will search the allocated, unallocated, and file slack spaces. You can use specific words, symbols, or strings of letters as the search criteria. Generally, you will want to have some predefined keyword lists before you start your digital forensic investigation.
Your keyword lists will fall into one of the following categories:
- Generic keyword list: This is a keyword list that you will use in every case. This list can also be further categorized by the subject of the investigation. For example, you may have one keyword list for digital forensic investigations into fraudulent activity and a different keyword list for digital forensic investigations into illicit images. ...
