Hello, and welcome back to digital forensic concepts.
In this course, course 9,
we're going to talk about keyword in grep searches.
In this course, we're going to cover how
to formulate case-specific keyword lists,
a review of grep and extended grep,
what they are and how they work.
We're also going to look at using
practical graph expressions
and extended grep expressions.
We're also going to take a look at
keyword searching in
the free and open-source tool autopsy.
In module 1, we're going to cover
keyword in grep searches.
When you're looking at a case and you're
choosing a keyword list,
you want to think about the type of
incident or a fence you're investigating.
If you're not the case, agent,
you definitely want to speak to them.
If you're not investigating,
you want to talk to that person to find out
information regarding the case that you're investigating.
We want to formulate our keyword searches
around the elements of the investigation.
What happened in this instance?
We want to include any existing leads
or names of suspects or people who may be involved.
We want to take a look at our suspects and
find out stuff about them personally.
This can help us locate
possible information to break passwords.
We definitely want to look at case-specific keywords,
keywords that will be useful in this one particular case.
They're specific to that one case.
Now a keyword searching, we
generally have two categories.
We have generic keywords.
Keywords that are generic to a specific type of case,
like maybe a drug case or
maybe a theft of intellectual property case.
Then we have case-specific keywords,
and a case-specific keyword is a keyword that is specific
to that one particular case you're investigating.
That may be something like
suspect names or people who involve names.
You can get generic case keyword lists
from the URL I have up here on the screen.
DIF or training, DIF or resources.
If you belong to any groups,
you can check your list servers.
If you are in law enforcement, ICAC,
Internet crimes against children
has keyword lists that you can
download and you can get
keyword lists from other forensic examiners.
There are some limitations to
text-based keyword searching and
some of these are a bit shifting.
Bit shifting is when you
alter the data at the binary level,
somebody goes in with a hex editor and
alternates the data at that binary level.
It will also cause you to not be able to
search your file using
a text-based search scheme if the file is encrypted.
Because remember encryption,
we're not looking at plain tasks.
That text is scrambled using an algorithm,
so the file is encrypted.
Compressed files will also not be
able to be searched with text-based keyword searching,
you would have to decompress
the file before you could search it.
That's anything like a zip file or an archive file.
Also, non-keyboard characters or non-word characters
can be used to hide files from keyword searching.
What I mean by using non-word characters,
if we take a look at the slide,
if I'm looking for the keywords, resume or bio,
maybe I'm doing an intellectual
property theft case where somebody was
applying to a competitor and
going to take some of the information with them.
If I put it into words, resume,
or bio, all I'm going to find are those words.
It's not going to hit on things like,
you see the re5um3.
It would not find that and it would not find the b!0.
If I was searching for an IP address but I
didn't know what IP addresses
are important to my case yet,
I would have to do a lot of keyword searches,
just searching for individual IP addresses.
This is where our pattern matching comes in.
Our patents searches, grep searches,
which we're going to talk about in our next module.