166 | Page
Ch a p t e r 1 3 - I n d e x S e a r c h M o d u l e
Copyright GetData Forensics Pty Ltd 2010 - 2015, All rights reserved.
The Index Search module is accessed via the ͞Index Search͟ tab.
Figure 134 - Index Search module tab
An Index Search creates then uses a database that stores the location of words in the
evidence. Forensic Explorer uses inbuilt dtSearch® technology for this purpose (for
more information see http://dtsearch.com/). Once an index is built for a group of files
very fast keyword searches can be performed on those files.
INDEXED FILE TYPES
For a list of the file formats supported by dtSearch® see "What file formats does
dtSearch support" at http://support.dtsearch.com.
A keyword index is stored as part of a Forensic Explorer case. The default path is:
C:\Program Files\Forensic Explorer vX\Cases\case name\DTSearchIndexes\index
A keyword index is usually about one fourth the size of the original documents,
although this may vary considerably depending on the number and kinds of
documents in the index. The forensic investigator should make sure there is ample disk
space available when creating an index.
A noise word is a word such as
that is so common that it is not useful in
searches. To save time, noise words are not indexed and are ignored in index
To modify the list of words defined as noise words, edit the file:
C:\Program Files\GetData\Forensic Explorer v1\noise.dat
The noise word list does not have a particular order, and can include wildcard
characters such as * and ?. However, noise words may not begin with wildcard
When an index is created, the index will store its own copy of the noise word
list. Changes made to the noise word list will be reflected in future indexes, but will
not affect existing indexes.