DFIR Training Blog



Keyword Lists.  Lazy way or good technique?

It is not lazy to use keyword lists . In fact, keyword lists can be an effective means to find evidence if and when they are used appropriately.  When used haphazardly (ie: without a plan or goal), you most likely will be wasting time by creating more work than you would have otherwise and not accomplish what you wanted in the first place.  With keyword searches, not having a plan or goal, and throwing keyword searches at data is a lazy method that results in doing  more labor  to review the results. Don't do that.  We want to make it easier, not harder, to find evidence.  By the way, not every case needs keyword searches.  It depends on the type of case.

Most digital forensics suites have keyword search capabilities built in.  Simply type a list of keywords or import a text file, click Search , and away you go!

Read more