码迷,mamicode.com
首页 > 其他好文 > 详细

Something wrong with FTK's index search results

时间:2016-07-09 10:41:29      阅读:124      评论:0      收藏:0      [点我收藏+]

标签:

My friend she told me last week that FTK could not "see" keywords in a plain text files when doing index search. That‘s very interesting. I used to trust the search results of FTK, and I think there must be something wrong .

 

I have to do a test to see what‘s going on. A plain text file named "password.txt" is as below, and its code page is Traditional Chinese Big5.

 技术分享

 

It makes sense that both FTK and EnCase could hit keyword "密碼" in that plain text file.

技术分享

 

技术分享

 

Now the test result is not the same as what she told me, could I just say that she is wrong??? No, of course not, the test environment is on the NTFS Volume and I have to do another test on a FAT32 Volume. Guess what??? EnCase could hit the keyword in that plain text file, but FTK failed.

技术分享

 

 

技术分享

 

What if the same keyword in a Doc/Docx file on the FAT32 Volume? Now FTK could hit the keyword in the Doc/Docx file.

技术分享

 

I try to figure out what‘s going on here. Correct me if any:

1. FTK supports lots of code page including "Big5".

2. FTK could index and search lots kind of file types including "plain text file".

3. FTK supports so many kind of file systems including "FAT32".

 

Now my question is:

Why FTK could not hit the keyword in the plain text file whose code page is Big5 lying on FAT32 Volume?

 

So what the hell is going on??? FTK must "see" the keywords in a plain text file or forensic guys will miss some very important clues like accounts and passwords. It‘s a very serious problem!

Something wrong with FTK's index search results

标签:

原文地址:http://www.cnblogs.com/pieces0310/p/5655266.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!