My friend she told me last week this ftk could not the "see" keywords in a plain the text files when doing index search. That ' s very interesting. I used to trust the search results of FTK, and I think there must is something wrong.
I have the to does a test to see what's going on. A Plain text file named "Password.txt" is as below, and its code page is traditional Chinese Big5.
It makes sense this both FTK and EnCase could hit keyword "password" in that plain text file.
Now the test result isn't the the same as what she told me, could I just say that she's wrong??? No, of course not, the test environment was on the NTFS Volume and I had to do another test on a FAT32 Volume. Guess what??? EnCase could hits the keyword in that plain text file, but FTK failed.
What if the same keyword with a doc/docx file on the FAT32 Volume? Now FTK could hits the keyword in the doc/docx file.
I try to figure out what's going on here. Correct me if any:
1. FTK supports lots of code page including "Big5".
2. FTK could index and search lots kind of file types including "plain text file".
3. FTK supports so many kind of file systems including "FAT32".
Now my question is:
Why FTK could not hits the keyword in the plain text file whose code page was Big5 lying on FAT32 Volume?
So, the hell is going on??? FTK must "see" the keywords in a plain text file or forensic guys would miss some very important clues like accounts and PA Sswords. It ' s a very serious problem!
Something wrong with FTK ' s index search results