U.S. flag

An official website of the United States government, Department of Justice.

Dot gov

The .gov means it’s official.
Federal government websites always use a .gov or .mil domain. Before sharing sensitive information online, make sure you’re on a .gov or .mil site by inspecting your browser’s address (or “location”) bar.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Digital Forensics Analysis Search String Support

Award Information

Award #
2008-CE-CX-K001
Location
Congressional District
Status
Closed
Funding First Awarded
2008
Total funding (to date)
$224,044

Description of original award (Fiscal Year 2008, $104,049)

Most computer forensics analysis tools, such as EnCase, FTK, and ILook, allow the use of
regular expressions (strings with special characters) to form powerful, effective search strings. Specifying regular expressions involves learning a language of meta characters that many law enforcement agents find difficult - particularly when trying to form effective strings that do not
cause an overwhelming number of false positives, or do not miss evidence. Furthermore, there are common search strings that are useful in general classes of investigations (e.g. common strings for drug, for money laundering, for child porn, etc. investigations). Allowing the law
enforcement community to share these strings so that they do not have to re-invent them each time would increase the efficiency and effectiveness of their investigations.

This project will develop two main capabilities. First, it will develop an automated regular expression generator for the primary computer forensics analysis tools (EnCase, FTK, ILook) that allows investigators to type in simple English keywords and choose options for common
variations (e.g. surrounded by white space, plurals, non-case sensitive). This project's software will generate the search strings for the investigator, allow them to test correctness and effectiveness of the string, and allow them to export the string for use in their analysis tool. Second, it will develop a common, shared repository where investigators can lookup, search, and
add regular expression search strings by category. Both the search string generation and repository capabilities will be embodied in a web site hosted at the University of Rhode Island's Digital Forensics Center, but constructed in a way so that it can be moved to a Department of Justice site when/if appropriate.

ca/ncf

This project is a continuation to award 2008-CE-CX-K001.
Most computer forensics analysis tools, such as EnCase, FTK, and X-Ways, allow the use of regular expressions (strings with special characters) to form powerful, effective search strings. Specifying regular expressions involves learning a language of meta characters that many law enforcement agents find difficult - particularly when trying to form effective strings that do not cause an overwhelming number of false positives or do not miss evidence. Furthermore, there are common search strings that are useful in general classes of investigations (e.g. common strings for drug, for money laundering, for child porn, etc. cases). Allowing the law enforcement community to share these strings so that they do not have to re-create them each time would increase the efficiency and effectiveness of their investigations. This project will continue to develop two main capabilities. First, it will continue to develop an automated regular expression generator for the primary computer forensics analysis tools that allows investigators to type in simple English keywords and choose options for common variations (e.g. surrounded by white space, plurals, non-case sensitive).

Second, it will continue to develop a common shared repository where investigators can lookup, search, and add regular expression search strings by
category. This continuation will allow completion of a robust, polished, tool for law enforcement.

ca/ncf

Date Created: September 15, 2008