Finding Data in the Windows Search Index

Windows Search Index Analyzer provides a user interface for viewing the content of the Windows Search index database. Being used primarily by forensic examiners to find evidence for criminal cases means that the software needs to facilitate the efficient and thorough identification of relevant data. To help with this process the software includes a Wordlist Find functionality.

Wordlist Find

Wordlist Find quite simply involves the creation of one or more text file word lists that contain general or case specific search terms that are desired to be found when examining the index for data. Each term in the wordlist can be a term or phrase and should on a separate line within the word list.

To search for the terms included within a word list the WSia user only has to load the wordlist using the Tables->Wordlist Find menu item and then click on the Find button. The Find process will continue sequentially through the file until one of the sought terms or phrases is found and it will then stop on that record highlighting the field containing the data.

Once the entry has been reviewed it can be added to a report if required. To continue with the Find process from that point the users clicks F3.