more on disk searching

Regarding my previous posts, I have now found out that the police used
a program called ENCASE; I've checked this out but I'm afraid it's a
bit beyond me. Sorry for the repetition but can someone clarify. Let us
suppose they use this program to search for the phrase "Dear Mr Smith",
will they be able to find it without turning on the computer and if it
is written in WORD, WordStar, WordPERFECT, Excel, encoded in
QuickBASIC, DBASE, or any of the above encoded and/'or deleted?

How long would it take to find such a phrase?

Thanks

Re: more on disk searching

"thedarkman" wrote in message
news:1145669285.695829.50090@v46g2000cwv.googlegroups.com...
> Regarding my previous posts, I have now found out that the police used
> a program called ENCASE; I've checked this out but I'm afraid it's a
> bit beyond me. Sorry for the repetition but can someone clarify. Let us
> suppose they use this program to search for the phrase "Dear Mr Smith",
> will they be able to find it without turning on the computer and if it
> is written in WORD, WordStar, WordPERFECT, Excel, encoded in
> QuickBASIC, DBASE, or any of the above encoded and/'or deleted?
>
> How long would it take to find such a phrase?
>
> Thanks
>


I think I mentioned EnCase to you in one of my earlier posts, but regardless
of whether I did or didn't. Yes. EnCase can search the hard drive for
phrases without turning on the computer. Yes. EnCase can search the entire
hard drive, including files that have been deleted, slack space, etc. In
summary if the phrase has ever been written, it's very probable EnCase will
find it on the hard drive.

FWIW I am trained in using EnCase and we (my company) own a licensed
version.

--
Best regards, from Don Kelloway of Commodon Communications
Visit http://www.commodon.com to learn about the "Threats to Your Security
on the Internet".

Re: more on disk searching

thedarkman wrote:
> Let us
> suppose they use this program to search for the phrase "Dear Mr Smith",
> will they be able to find it without turning on the computer and if it
> is written in WORD, WordStar, WordPERFECT, Excel, encoded in
> QuickBASIC, DBASE, or any of the above encoded and/'or deleted?

Yes. And a simple grep -rli $TERM / will do.

> How long would it take to find such a phrase?

From seconds to minutes.

Yours,
VB.
--
At first there was the word. And the word was Content-type: text/plain