Keyword Search

Overview

This mode searches an image for a given string. This is most useful when searching for deleted content. To decrease the time required for a search, a "strings" file can serve as an index. This file will contain only the ASCII strings in the image.

Autopsy will also prompt you to create a file of unallocated data if one does not exist. This obviously is useful for recovering deleted data. If a string is found in this file, Autopsy will also report the location in the original image.

Entering the String

Enter the string or regular expression into the text box. Autopsy allows you to search for a either a specific string or using 'grep' style regular expressions. A case insensitive search will occur if the appropriate box is checked, otherwise it is case sensitive.

If you have not generated a strings file or unallocated data file yet, that option will exist.

The Load Unallocated Image or Load Allocated Image button exists to switch between the two file types if they have both been generated.

Autopsy also has the ability to perform pre-configured searches. They are shown in the "Automatic Searches" section.

Viewing the Results

After the image has been searched, a list of "hits" will appear on the left-hand side. Each data unit that contains the string is listed with the offset of each occurrence. If a regular expression is used, then the exact location is not given.

If the search was done on an unallocated data file, then an option will exist next to each address to also view the original. Doing so could reveal the inode that allocated it.

Regular Expressions

You can use grep regular expressions in the search (refer to the 'grep' man page for more details). To search for a couple of different words you would use: (foo) | (bar).
Brian Carrier