Keyword searching is the process of  of searching electronically stored evidence using any specified word, or combination of words with the intent of locating and identifying potential evidence.  The process involves careful planning and review of keywords so that only the relevant documents are produced.

Keyword Search Strategy – Computers are literal so there are techniques to find word derivations and misspellings that may be important to the examination.  Keep in mind, however, that these strategies will increase the amount of evidence to be reviewed by the examiner.

The Center for Computer Forensics will assist the client with this process.  Through years of experience we know that certain words will not make good keywords.  An example of this would be "resume".  In the computer code, "resume" is used to mean restart the process, which occurs thousands of times on any hard drive.  We would used Boolean logic and would search "resume" using a second word, such as "resume and employment".  Boolean is explained in great detail below. 

Boolean - Finds a group of words or phrases linked by and, or, and not, w/# (within a range) and not w/#.
            Examples:
            tart apple pie – the entire phrase must be present
            apple pie and pear tart – both phrases must be present
            apple pie or pear tart – either phrase must be present
            apple pie and not pear tart - only apple pie must be present
            apple w/5 pear – apple must occur within 5 words of pear
            apple not w/27 pear - apple must not occur within 27 words of pear
            subject contains apple pie – finds apple pie in a subject field

Use ( ) when a search includes two or more connectors:  apple and pear or orange juice could mean (apple and pear) or orange, or it could mean apple and (pear or orange)

Exact phrase - Finds a single phrase (quotation marks are optional)

Fuzzy searching - Finds words even if they are misspelled.  A search for alphabet with a fuzziness of 1 would also find alphaqet.  With a fuzziness of 3, the same search would find both alphaqet and alpkaqet

Phonic searching - Finds words that sound alike, like Smythe in a search for Smith

Synonym expansion - Finds word synonyms using a comprehensive English language thesaurus

Stemming - Finds grammatical variations on endings, like applies, applied, applying in a search for apply

- Return to FAQ -