Announcement

Collapse
No announcement yet.

Problems with regex and searches for email bodies of OS Forensics

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Problems with regex and searches for email bodies of OS Forensics

    We are evaluating OS Forensics and have tried the following on both versions 8 and 9. We have a pst with 4 emails: one contains a SSN and the other 3 contain sample CC numbers in different formats. I've spent a few hours attempting different search combinations, but I cannot get searches to work on the bodies of emails. It doesn't matter if I search for a string I know is in an email or if a regex expression is used.

    The PST is 256KB. Searches work fine with ID, From, To/Cc/Bcc, and Subject, but nothing matches within the Body. I have created a case within OS Forensics and added the PST to the case, and when I click on the PST, it asks me if I want to open in File System Browser, which I do. When I click on the PST, it asks if I want to open in the E-mail viewer, which I also do. This may be a limitation with an evaluation license, but if not, can anyone help me out with this? Thank you.

  • #2

    There are a few options for this case. Option 1 is probably what you want however. If this doesn't work can you EMail us the PST file and the search terms you are using.
    It isn't a limitation of the trial.

    Option 1: - Search in the EMail viewer

    Open the PST file in the EMail viewer and then use the search bar. In your case make sure you check the "Body" check box and the "Use RegEx" check box.
    These aren't turned on by default as they tend to slow down searching. See below.

    Also be aware that there are many different "standards" for RegEx. Sometimes the syntax varies. OSF is using PCRE (Perl Compatible Regular Expressions).
    See this hugely long page for details.


    Click image for larger version

Name:	EMail-Search.png
Views:	42
Size:	70.1 KB
ID:	51679

    Option 2 - Use the indexer
    This makes more sense when you have lots of searching to do on the same data. And you have a lot of data. So this is not the case in your example.
    This option builds an index of the Email content (which is slow) but then allow extremely quick searching once the index if built.
    You use use RegEx searching as part of the indexing process.

    Click image for larger version

Name:	EMail-Search-index.png
Views:	18
Size:	28.3 KB
ID:	51680

    Option 3 - Extract strings in the internal viewer
    This is good for files where the structure can't normally be decoded. So this is not the case for your example.
    It isn't any good for encrypted or compressed files.

    Click image for larger version

Name:	EMail-Search-internal-viewer.png
Views:	17
Size:	96.0 KB
ID:	51681







    Comment

    Working...
    X