Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I'm looking for a GREP REGEX for EnCase

03/03/02 @ 10:00:00

The point is looking for files that were created on that date.

share|improve this question
2  
Give us some lines from the log to work with. – Iain♦ Apr 27 '11 at 19:18
There is no log, or lines... The key points is using the given question in the dates mentioned in the master post. That's all that I can give. Convert 03/03/02 @ 10:00:00 to GREP REGEX.... EnCase is a forensic tool that is used to search for Particular date created... However, it's different from FTK. – ITSecurity Apr 27 '11 at 20:21
If there is no log, or lines, then what are you feeding grep to search through? – jscott Apr 27 '11 at 20:30
@jscott - It's being feeded into EnCase Forensics software tool. I'm still learning the basics of GREP REGEX for EnCase. – ITSecurity Apr 27 '11 at 20:38

2 Answers

up vote 0 down vote

So your looking for something like:

03\/03\/02.@.10:00:00

Grep date with regex

share|improve this answer
Thanks for the reply... I just went to check it... Nothing turned up... Emmm.... I wonder if a # needs to be added at the beginning? – ITSecurity Apr 27 '11 at 22:05
Confirm the date string "03/03/02" is exactly right since I have never seen a file with a format that left off the century. – wrmine Apr 29 '11 at 0:59
Thank you, unfortunately, nothing showed up. I have tried several others. EnCase has a build in GREP and I used 03/03/02 10, with nothing. Very strange, and I will note your data string. – ITSecurity Apr 29 '11 at 11:23
up vote 0 down vote

Late comer to the the question, but here is an answer. EnCase uses a modified form of RegEx. It has the basics, but doesn't support many of the advanced features.

That said, I am not really sure what exactly you are trying to search. If you are looking for files created on this date, you would use a condition instead. Searching for the text of the date that you gave will only find textual references to this date. The records from the $MFT file hold the date value in hex of the windows FILETIME format. A GREP keyword search would need to search for the hex form instead of the text form.

Alternatively, you could just double click the Created Date column header to have EnCase sort on that column. You could then scroll down to the appropriate range of dates.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.