Problems with regex and searches for email bodies of OS Forensics

[alvinbaker]

We are evaluating OS Forensics and have tried the following on both versions 8 and 9. We have a pst with 4 emails: one contains a SSN and the other 3 contain sample CC numbers in different formats. I've spent a few hours attempting different search combinations, but I cannot get searches to work on the bodies of emails. It doesn't matter if I search for a string I know is in an email or if a regex expression is used.

The PST is 256KB. Searches work fine with ID, From, To/Cc/Bcc, and Subject, but nothing matches within the Body. I have created a case within OS Forensics and added the PST to the case, and when I click on the PST, it asks me if I want to open in File System Browser, which I do. When I click on the PST, it asks if I want to open in the E-mail viewer, which I also do. This may be a limitation with an evaluation license, but if not, can anyone help me out with this? Thank you.

[David (PassMark)]

There are a few options for this case. Option 1 is probably what you want however. If this doesn't work can you EMail us the PST file and the search terms you are using.
It isn't a limitation of the trial.

Option 1: - Search in the EMail viewer

Open the PST file in the EMail viewer and then use the search bar. In your case make sure you check the "Body" check box and the "Use RegEx" check box.
These aren't turned on by default as they tend to slow down searching. See below.

Also be aware that there are many different "standards" for RegEx. Sometimes the syntax varies. OSF is using PCRE (Perl Compatible Regular Expressions).
See this hugely long page for details.




Option 2 - Use the indexer
This makes more sense when you have lots of searching to do on the same data. And you have a lot of data. So this is not the case in your example.
This option builds an index of the Email content (which is slow) but then allow extremely quick searching once the index if built.
You use use RegEx searching as part of the indexing process.



Option 3 - Extract strings in the internal viewer
This is good for files where the structure can't normally be decoded. So this is not the case for your example.
It isn't any good for encrypted or compressed files.