EnCase v.s. Ftk-find out Chinese characters writing in different direction

A friend of mine said to me, she could fool those forensic tools easily by changing writing direction in text. I said to her: "Really?" is Sure...don ' t jump to conclusions too soon ... ". She showed me screenshots as below:

1.She used Intella to does full index search:

2. She searched "Sun" and "Taipei Hostel", and those characters definitely exist in above file, guess what? No any hits found ...

Ok Intella failed to find those Chinese characters that actually exist. Let ' s try EnCase and FTK. First we use EnCase to search "bomb". Unfortunately EnCase only got 1 hits ... Acutally there is more than 1 "bomb" in it.

Next We search "scorching sun", and EnCase find 1 hit. So EnCase are clever enough to find out those Chinese characters in vertical direction.

How about FTK? Let's search "C4", and FTK could find it out without fail.

Then we search "scorching sun". FTK sucessfully hits "scorching Sun" exactly as EnCase does.

Suspect such tricks to try to fool forensic tools. Fortunately EnCase and FTK could search and hit those Chinese characters in vertical direction. Now she realizes why those forensic tools cost lots of money.

EnCase v.s. Ftk-find out Chinese characters writing in different direction