I used to conduct raw search in EnCase v6, and I‘d like to see if EnCase v7 raw search could hit keywords inside compound files or not. You won‘t believe it~search results is 0 but those keywords do exist inside compound files...Let my show you my test as below:
Scenario:
Two compound files, one is a docx and the other is a xlsx. Two keywords, one is "password",and the other is "密碼".
1. Evidence Processing( expand compound files option is checked) completed.
2. word.docx
3. excel.xlsx
4. Conduct raw search
5.Search result = 0
As you could see that those keywords do exist in those two compound files, but no any hits...
EnCase v7 search hits in compound files?
原文：http://www.cnblogs.com/pieces0310/p/4628600.html