みつびし 9 9 0 9 9 0 3 0 3 0 FT-SS-07-Cyrillic 9 9 0 9 9 0 3 3 0 Сибирь 9 9 0 9 9 0 3 0 3 0 FT-SS-07-Latin 18 18 0 18 18 0 6 6 0 garçon 9 9 0 9 9 0 3 0 3 0 Schönheit 9 9 0 9 9 0 3 0 3 0 FT-SS-07-NoBOM 39 39 0 39 39 0 13 13 0 Россия 9 9 0 9 9 0 3 0 3 0 فلافل 9 9 0 9 9 0 3 0 3 0 中國 9 9 0 9 9 0 3 0 3 0 QuarterHorse 12 12 0 12 12 0 4 0 4 0 FT-SS-07-Norm 75 75 0 75 75 0 25 25 0 mañana (NFD) 9 9 0 9 9 0 3 0 3 0 infinity (No Ligature) 12 12 0 12 12 0 4 0 4 0 Mäuse (NFD) 9 9 0 9 9 0 3 0 3 0 infinity (Ligature) 9 9 0 9 9 0 3 0 3 0 Mäuse (NFC) 9 9 0 9 9 0 3 0 3 0 libertà (NFC) 9 9 0 9 9 0 3 0 3 0 libertà (NFD) 9 9 0 9 9 0 3 0 3 0 mañana (NFC) 9 9 0 9 9 0 3 0 3 0 FT-SS-07-RTL 9 9 0 9 9 0 3 3 0 الكسكس 9 9 0 9 9 0 3 0 3 0 FT-SS-09-Doc 16 13 3 0 0 0 16 13 3 longbow
.html 2 2 0 0 0 0 2 0 2 0 shotgun
Formatted .doc UTF-16 2 2 0 0 0 0 2 0 2 0 revolver
.doc UTF-16 2 2 0 0 0 0 2 0 2 0 peroxide
.docx 2 1 1 0 0 0 2 0 1 1 nitroglycerin
Formatted .docx 2 1 1 0 0 0 2 0 1 1 rifle
.doc UTF-8 2 2 0 0 0 0 2 0 2 0 crossbow
Formatted .html 2 1 1 0 0 0 2 0 1 1 flintlock
Formatted .doc UTF-8 2 2 0 0 0 0 2 0 2 0 FT-SS-09-Frag 2 1 1 0 0 0 0 0 0 Washington101000000 California 1 1 0 0 0 0 0 0 0 0 FT-SS-09-Lost 0 0 0 0 0 0 4 4 0 SecretKey 0 0 0 0 0 0 2 0 2 0 disconnected 0 0 0 0 0 0 2 0 2 0 FT-SS-09-MFT 4 4 0 4 4 0 0 0 0 bear 4 4 0 4 4 0 0 0 0 0 FT-SS-09-Meta 6 6 0 6 6 0 2 2 0 cañón 3 3 0 3 3 0 1 0 1 0 thunderbird 3 3 0 3 3 0 1 0 1 0 FT-SS-10-Hex 3 3 0 3 3 0 1 1 0 panda 3 3 0 3 3 0 1 0 1 0 FT-SS-10-Regex 6 6 0 6 6 0 2 2 0 DireWolf 3 3 0 3 3 0 1 0 1 0 WereWolf 3 3 0 3 3 0 1 0 1 0

Meta-Data results for Other_Physical Search of Windows Data Set


The following table presents search results for strings located in file system meta-data. The Case column identifies the test case, the String column identifies the search string, the Partition column identifies the partition (file system) where the string is located and the Seen column records if the search tool reported at least one instance of the string (yes or no) in meta-data.

CaseStringPartitionSeen
FT-SS-09-Meta
thunderbirdntfsYes
cañónfat32Yes
cañónexfatYes
cañónntfsYes

Comments on Other_Physical Search of Windows Data Set

The following table presents any comments recorded during testing for a test case.

CaseComments
FT-SS-06 Page Fault
FT-SS-07-Latin UTF-16 encoded strings are reported twice.
FT-SS-07-NoBOM Hits on the string "QuarterHorse" encoded as UTF-16 are reported twice.
FT-SS-07-Norm Searches do not use Unicode normalization on the search string.
Strings normalized as NFC are reported twice.
FT-SS-09-Frag Not finding the string "Washington" is the real expected result because the string is split across two file fragments and should be missed in a sector by sector physical search.

Results for Indexed Search of Windows Data Set

The table columns contain the following information:

Notes: If the row identifies a test case, then the results are a summary for all the strings that should be found.

In the Expected String column for test case FT-SS-09-DOC each string is labeled to indicate features of the expected string. The labels include the file type (.doc, .docx or .html), the encoding of the string in the .doc file and if the string has embedded formatting, labeled as Formatted, e.g., the string crossbow has the substring cross formatted as bold and underlined, i.e., crossbow.

CaseExpected StringActive FilesDeleted FilesUnalloc Space
ExpectedHitsMissesExpectedHitsMissesExpectedHitsMisses
FT-SS-01 3 3 0 3 3 0 1 1 0
DireWolf 3 3 0 3 3 0 1 0 1 0
FT-SS-02 15 15 0 15 15 0 5 5 0
WOLF 3 3 0 3 3 0 1 0 1 0
wolf 3 3 0 3 3 0 1 0 1 0
Wolf 3 3 0 3 3 0 1 0 1 0
DireWolf 3 3 0 3 3 0 1 0 1 0
WereWolf 3 3 0 3 3 0 1 0 1 0
FT-SS-03 9 9 0 9 9 0 3 3 0
WOLF 3 3 0 3 3 0 1 0 1 0
wolf 3 3 0 3 3 0 1 0 1 0
Wolf 3 3 0 3 3 0 1 0 1 0
FT-SS-04 3 3 0 3 3 0 0 0 0
panda and fox 3 3 0 3 3 0 0 0 0 0
FT-SS-05 6 6 0 6 6 0 2 2 0
DireWolf 3 3 0 3 3 0 1 0 1 0
WereWolf 3 3 0 3 3 0 1 0 1 0
FT-SS-06 12 12 0 12 12 0 0 0 0
fox and not tiger 12 12 0 12 12 0 0 0 0 0
FT-SS-07-CJK-char 18 18 0 18 18 0 6 6 0
中国 9 9 0 9 9 0 3 0 3 0
東京 9 9 0 9 9 0 3 0 3 0
FT-SS-07-CJK-hangul 9 9 0 9 9 0 3 3 0
서울 9 9 0 9 9 0 3 0 3 0
FT-SS-07-CJK-kana 18 9 9 18 9 9 6 3 3
スバル909909303
みつびし 9 9 0 9 9 0 3 0 3 0
FT-SS-07-Cyrillic 9 6 3 9 6 3 3 2 1
Сибирь 9 6 3 9 6 3 3 0 2 1
FT-SS-07-Latin 18 15 3 18 15 3 6 5 1
garçon 9 6 3 9 6 3 3 0 2 1
Schönheit 9 9 0 9 9 0 3 0 3 0
FT-SS-07-NoBOM 39 27 12 39 27 12 13 9 4
Россия 9 6 3 9 6 3 3 0 2 1
فلافل 9 6 3 9 6 3 3 0 2 1
中國 9 3 6 9 3 6 3 0 1 2
QuarterHorse 12 12 0 12 12 0 4 0 4 0
FT-SS-07-Norm 75 39 36 75 39 36 25 13 12
mañana (NFD)909909303
libertà (NFD)909909303
Mäuse (NFD)909909303
infinity (Ligature)909909303
Mäuse (NFC) 9 9 0 9 9 0 3 0 3 0
infinity (No Ligature) 12 12 0 12 12 0 4 0 4 0
mañana (NFC) 9 9 0 9 9 0 3 0 3 0
libertà (NFC) 9 9 0 9 9 0 3 0 3 0
FT-SS-07-RTL 9 6 3 9 6 3 3 2 1
الكسكس 9 6 3 9 6 3 3 0 2 1
FT-SS-09-Doc 16 15 1 0 0 0 16 13 3
longbow
.html
2 2 0 0 0 0 2 0 2 0
shotgun
Formatted .doc UTF-16
2 2 0 0 0 0 2 0 2 0
revolver
.doc UTF-16
2 2 0 0 0 0 2 0 2 0
peroxide
.docx
2 2 0 0 0 0 2 0 1 1
nitroglycerin
Formatted .docx
2 2 0 0 0 0 2 0 1 1
rifle
.doc UTF-8
2 2 0 0 0 0 2 0 2 0
crossbow
Formatted .html
2 1 1 0 0 0 2 0 1 1
flintlock
Formatted .doc UTF-8
2 2 0 0 0 0 2 0 2 0
FT-SS-09-Frag 2 2 0 0 0 0 0 0 0
Washington 1 1 0 0 0 0 0 0 0 0
California 1 1 0 0 0 0 0 0 0 0
FT-SS-09-Lost 0 0 0 0 0 0 4 4 0
SecretKey 0 0 0 0 0 0 2 0 2 0
disconnected 0 0 0 0 0 0 2 0 2 0
FT-SS-09-MFT 4 4 0 4 4 0 0 0 0
bear 4 4 0 4 4 0 0 0 0 0
FT-SS-09-Meta 6 5 1 6 5 1 2 2 0
cañón 3 2 1 3 2 1 1 0 1 0
thunderbird 3 3 0 3 3 0 1 0 1 0
FT-SS-10-Hex 3 3 0 3 3 0 1 1 0
panda 3 3 0 3 3 0 1 0 1 0

Meta-Data results for Indexed Search of Windows Data Set


The following table presents search results for strings located in file system meta-data. The Case column identifies the test case, the String column identifies the search string, the Partition column identifies the partition (file system) where the string is located and the Seen column records if the search tool reported at least one instance of the string (yes or no) in meta-data.

CaseStringPartitionSeen
FT-SS-09-Meta
thunderbirdntfsYes
cañónfat32No
cañónexfatNo
cañónntfsYes

Comments on Indexed Search of Windows Data Set

The following table presents any comments recorded during testing for a test case.

CaseComments
FT-SS-02 Hits on strings "WOLF", "Wolf" and "wolf" were reported twice.
FT-SS-07-CJK-char The search was run more than once after re indexing and the results were inconsistent. Sometimes all strings were found, other times no strings were found and sometimes only the UTF-8 strings were found.
FT-SS-07-CJK-kana Building an index was a problem. There were two possible options that could be selected: Japanese or Unicode Multi-lingual Plane. Selecting "Japanese" failed to produce an index and returned a "non-hex char" error. The other option worked once for "みつびし", but then would not yield any hits after re indexing later. No hits were returned for "スバル".
FT-SS-07-Latin UTF-16 hits were reported twice.
FT-SS-07-RTL No UTF-16-BE hits were reported.
FT-SS-09-MFT Also listed in $MFT.
FT-SS-09-Meta String IDs 2641 & 2645 in NTFS were probably matched, but the "Search Hits" did not show any context around the string hit. (Therefore the string ID of the hit was not visible.)

Results for Live Search of Windows Data Set

The table columns contain the following information:

Notes: If the row identifies a test case, then the results are a summary for all the strings that should be found.

In the Expected String column for test case FT-SS-09-DOC each string is labeled to indicate features of the expected string. The labels include the file type (.doc, .docx or .html), the encoding of the string in the .doc file and if the string has embedded formatting, labeled as Formatted, e.g., the string crossbow has the substring cross formatted as bold and underlined, i.e., crossbow.

CaseExpected StringActive FilesDeleted FilesUnalloc Space
ExpectedHitsMissesExpectedHitsMissesExpectedHitsMisses
FT-SS-01 3 3 0 3 3 0 1 1 0
DireWolf 3 3 0 3 3 0 1 0 1 0
FT-SS-02 15 15 0 15 15 0 5 5 0
WOLF 3 3 0 3 3 0 1 0 1 0
wolf 3 3 0 3 3 0 1 0 1 0
Wolf 3 3 0 3 3 0 1 0 1 0
DireWolf 3 3 0 3 3 0 1 0 1 0
WereWolf 3 3 0 3 3 0 1 0 1 0
FT-SS-03 9 9 0 9 9 0 3 3 0
WOLF 3 3 0 3 3 0 1 0 1 0
wolf 3 3 0 3 3 0 1 0 1 0
Wolf 3 3 0 3 3 0 1 0 1 0
FT-SS-04 3 3 0 3 3 0 0 0 0
panda and fox 3 3 0 3 3 0 0 0 0 0
FT-SS-05 6 6 0 6 6 0 2 2 0
DireWolf 3 3 0 3 3 0 1 0 1 0
WereWolf 3 3 0 3 3 0 1 0 1 0
FT-SS-06 12 12 0 12 12 0 0 0 0
fox and not tiger 12 12 0 12 12 0 0 0 0 0
FT-SS-07-CJK-char 18 18 0 18 18 0 6 6 0
中国 9 9 0 9 9 0 3 0 3 0
東京 9 9 0 9 9 0 3 0 3 0
FT-SS-07-CJK-hangul 9 9 0 9 9 0 3 3 0
서울 9 9 0 9 9 0 3 0 3 0
FT-SS-07-CJK-kana 18 18 0 18 18 0 6 6 0
スバル 9 9 0 9 9 0 3 0 3 0
みつびし 9 9 0 9 9 0 3 0 3 0
FT-SS-07-Cyrillic 9 9 0 9 9 0 3 3 0
Сибирь 9 9 0 9 9 0 3 0 3 0
FT-SS-07-Latin 18 18 0 18 18 0 6 6 0
garçon 9 9 0 9 9 0 3 0 3 0
Schönheit 9 9 0 9 9 0 3 0 3 0
FT-SS-07-NoBOM 39 39 0 39 39 0 13 13 0
Россия 9 9 0 9 9 0 3 0 3 0
فلافل 9 9 0 9 9 0 3 0 3 0
中國 9 9 0 9 9 0 3 0 3 0
QuarterHorse 12 12 0 12 12 0 4 0 4 0
FT-SS-07-Norm 75 75 0 75 75 0 25 25 0
mañana (NFD) 9 9 0 9 9 0 3 0 3 0
infinity (No Ligature) 12 12 0 12 12 0 4 0 4 0
Mäuse (NFD) 9 9 0 9 9 0 3 0 3 0
infinity (Ligature) 9 9 0 9 9 0 3 0 3 0
Mäuse (NFC) 9 9 0 9 9 0 3 0 3 0
libertà (NFC) 9 9 0 9 9 0 3 0 3 0
libertà (NFD) 9 9 0 9 9 0 3 0 3 0
mañana (NFC) 9 9 0 9 9 0 3 0 3 0
FT-SS-07-RTL 9 9 0 9 9 0 3 3 0
الكسكس 9 9 0 9 9 0 3 0 3 0
FT-SS-09-Doc 16 15 1 0 0 0 16 13 3
longbow
.html
2 2 0 0 0 0 2 0 2 0
shotgun
Formatted .doc UTF-16
2 2 0 0 0 0 2 0 2 0
revolver
.doc UTF-16
2 2 0 0 0 0 2 0 2 0
peroxide
.docx
2 2 0 0 0 0 2 0 1 1
nitroglycerin
Formatted .docx
2 2 0 0 0 0 2 0 1 1
rifle
.doc UTF-8
2 2 0 0 0 0 2 0 2 0
crossbow
Formatted .html
2 1 1 0 0 0 2 0 1 1
flintlock
Formatted .doc UTF-8
2 2 0 0 0 0 2 0 2 0
FT-SS-09-Frag 2 2 0 0 0 0 0 0 0
Washington 1 1 0 0 0 0 0 0 0 0
California 1 1 0 0 0 0 0 0 0 0
FT-SS-09-Lost 0 0 0 0 0 0 4 4 0
SecretKey 0 0 0 0 0 0 2 0 2 0
disconnected 0 0 0 0 0 0 2 0 2 0
FT-SS-09-MFT 4 4 0 4 4 0 0 0 0
bear 4 4 0 4 4 0 0 0 0 0
FT-SS-09-Meta 6 6 0 6 6 0 2 2 0
cañón 3 3 0 3 3 0 1 0 1 0
thunderbird 3 3 0 3 3 0 1 0 1 0
FT-SS-10-Hex 3 3 0 3 3 0 1 1 0
panda 3 3 0 3 3 0 1 0 1 0
FT-SS-10-Regex 6 6 0 6 6 0 2 2 0
DireWolf 3 3 0 3 3 0 1 0 1 0
WereWolf 3 3 0 3 3 0 1 0 1 0

Meta-Data results for Live Search of Windows Data Set


The following table presents search results for strings located in file system meta-data. The Case column identifies the test case, the String column identifies the search string, the Partition column identifies the partition (file system) where the string is located and the Seen column records if the search tool reported at least one instance of the string (yes or no) in meta-data.

CaseStringPartitionSeen
FT-SS-09-Meta
thunderbirdntfsYes
cañónfat32Yes
cañónexfatYes
cañónntfsYes

Comments on Live Search of Windows Data Set

The following table presents any comments recorded during testing for a test case.

CaseComments
FT-SS-06 UTF-16 strings are reported twice.
FT-SS-07-Latin UTF-16 strings are reported twice.
FT-SS-07-NoBOM UTF-16 strings for "QuarterHorse" are reported twice.
FT-SS-07-Norm UTF-16 strings normalized as NFC are reported twice.
FT-SS-09-Doc UTF-16 strings are reported twice.
FT-SS-09-Lost UTF-16 strings are reported twice.

Results for Data Set: UNIX

This section provides results for the UNIX data set.

Results for Other_Physical Search of UNIX Data Set

The table columns contain the following information:

Notes: If the row identifies a test case, then the results are a summary for all the strings that should be found.

In the Expected String column for test case FT-SS-09-DOC each string is labeled to indicate features of the expected string. The labels include the file type (.doc, .docx or .html), the encoding of the string in the .doc file and if the string has embedded formatting, labeled as Formatted, e.g., the string crossbow has the substring cross formatted as bold and underlined, i.e., crossbow.

CaseExpected StringActive FilesDeleted FilesUnalloc Space
ExpectedHitsMissesExpectedHitsMissesExpectedHitsMisses
FT-SS-01 4 4 0 4 4 0 0 0 0
DireWolf 4 4 0 4 4 0 0 0 0 0
FT-SS-02 20 20 0 20 20 0 0 0 0
WOLF 4 4 0 4 4 0 0 0 0 0
wolf 4 4 0 4 4 0 0 0 0 0
Wolf 4 4 0 4 4 0 0 0 0 0
DireWolf 4 4 0 4 4 0 0 0 0 0
WereWolf 4 4 0 4 4 0 0 0 0 0
FT-SS-03 12 12 0 12 12 0 0 0 0
WOLF 4 4 0 4 4 0 0 0 0 0
wolf 4 4 0 4 4 0 0 0 0 0
Wolf 4 4 0 4 4 0 0 0 0 0
FT-SS-04 4 4 0 4 4 0 0 0 0
panda and fox 4 4 0 4 4 0 0 0 0 0
FT-SS-05 8 8 0 8 8 0 0 0 0
DireWolf 4 4 0 4 4 0 0 0 0 0
WereWolf 4 4 0 4 4 0 0 0 0 0
FT-SS-06 16 0 16 16 0 16 0 0 0
fox and not tiger1601616016000
FT-SS-07-CJK-char 24 24 0 24 24 0 0 0 0
中国 12 12 0 12 12 0 0 0 0 0
東京 12 12 0 12 12 0 0 0 0 0
FT-SS-07-CJK-hangul 12 12 0 12 12 0 0 0 0
서울 12 12 0 12 12 0 0 0 0 0
FT-SS-07-CJK-kana 24 24 0 24 24 0 0 0 0
スバル 12 12 0 12 12 0 0 0 0 0
みつびし 12 12 0 12 12 0 0 0 0 0
FT-SS-07-Cyrillic 12 12 0 12 12 0 0 0 0
Сибирь 12 12 0 12 12 0 0 0 0 0
FT-SS-07-Latin 24 24 0 24 24 0 0 0 0
garçon 12 12 0 12 12 0 0 0 0 0
Schönheit 12 12 0 12 12 0 0 0 0 0
FT-SS-07-NoBOM 52 52 0 52 52 0 0 0 0
Россия 12 12 0 12 12 0 0 0 0 0
فلافل 12 12 0 12 12 0 0 0 0 0
中國 12 12 0 12 12 0 0 0 0 0
QuarterHorse 16 16 0 16 16 0 0 0 0 0
FT-SS-07-Norm 100 100 0 100 100 0 0 0 0
mañana (NFD) 12 12 0 12 12 0 0 0 0 0
infinity (No Ligature) 16 16 0 16 16 0 0 0 0 0
Mäuse (NFD) 12 12 0 12 12 0 0 0 0 0
infinity (Ligature) 12 12 0 12 12 0 0 0 0 0
Mäuse (NFC) 12 12 0 12 12 0 0 0 0 0
libertà (NFC) 12 12 0 12 12 0 0 0 0 0
libertà (NFD) 12 12 0 12 12 0 0 0 0 0
mañana (NFC) 12 12 0 12 12 0 0 0 0 0
FT-SS-07-RTL 12 12 0 12 12 0 0 0 0
الكسكس 12 12 0 12 12 0 0 0 0 0
FT-SS-09-Doc 16 14 2 0 0 0 0 0 0
longbow
.html
2 2 0 0 0 0 0 0 0 0
shotgun
Formatted .doc UTF-16
2 2 0 0 0 0 0 0 0 0
revolver
.doc UTF-16
2 2 0 0 0 0 0 0 0 0
peroxide
.docx
2 1 1 0 0 0 0 0 0 0
nitroglycerin
Formatted .docx
2 1 1 0 0 0 0 0 0 0
rifle
.doc UTF-8
2 2 0 0 0 0 0 0 0 0
crossbow
Formatted .html
2 2 0 0 0 0 0 0 0 0
flintlock
Formatted .doc UTF-8
2 2 0 0 0 0 0 0 0 0
FT-SS-09-Meta 8 8 0 8 8 0 0 0 0
cañón 4 4 0 4 4 0 0 0 0 0
thunderbird 4 4 0 4 4 0 0 0 0 0
FT-SS-10-Hex 4 4 0 4 4 0 0 0 0
panda 4 4 0 4 4 0 0 0 0 0
FT-SS-10-Regex 8 8 0 8 8 0 0 0 0
DireWolf 4 4 0 4 4 0 0 0 0 0
WereWolf 4 4 0 4 4 0 0 0 0 0

Meta-Data results for Other_Physical Search of UNIX Data Set


The following table presents search results for strings located in file system meta-data. The Case column identifies the test case, the String column identifies the search string, the Partition column identifies the partition (file system) where the string is located and the Seen column records if the search tool reported at least one instance of the string (yes or no) in meta-data.

CaseStringPartitionSeen
FT-SS-07-CJK-char
中国osxjYes
中国osxcYes
中国apfsYes
東京osxjYes
東京osxcYes
東京apfsYes
FT-SS-07-Cyrillic
СибирьosxjYes
СибирьosxcYes
СибирьapfsYes
FT-SS-07-NoBOM
فلافلosxjYes
فلافلosxcYes
فلافلapfsYes
РоссияosxjYes
РоссияosxcYes
РоссияapfsYes
中國osxjYes
中國osxcYes
中國apfsYes
FT-SS-07-RTL
الكسكسosxjYes
الكسكسosxcYes
الكسكسapfsYes
FT-SS-09-Meta
thunderbirdosxjYes
thunderbirdosxcYes
thunderbirdapfsYes
thunderbirdext4Yes
cañónext4Yes

Comments on Other_Physical Search of UNIX Data Set

The following table presents any comments recorded during testing for a test case.

CaseComments
FT-SS-06 Tool crashes. page protection fault.
FT-SS-07-Latin UTF-16 encoded strings are reported twice.
FT-SS-07-NoBOM UTF-16 strings for "QuarterHorse" are reported twice.
FT-SS-07-Norm Searches do not use Unicode normalization on the search string.
Strings normalized as NFC are reported twice.
FT-SS-09-Doc UTF-16 strings are reported twice.

Results for Indexed Search of UNIX Data Set

The table columns contain the following information:

Notes: If the row identifies a test case, then the results are a summary for all the strings that should be found.

In the Expected String column for test case FT-SS-09-DOC each string is labeled to indicate features of the expected string. The labels include the file type (.doc, .docx or .html), the encoding of the string in the .doc file and if the string has embedded formatting, labeled as Formatted, e.g., the string crossbow has the substring cross formatted as bold and underlined, i.e., crossbow.

CaseExpected StringActive FilesDeleted FilesUnalloc Space
ExpectedHitsMissesExpectedHitsMissesExpectedHitsMisses
FT-SS-01 4 4 0 4 4 0 0 0 0
DireWolf 4 4 0 4 4 0 0 0 0 0
FT-SS-02 20 20 0 20 20 0 0 0 0
WOLF 4 4 0 4 4 0 0 0 0 0
wolf 4 4 0 4 4 0 0 0 0 0
Wolf 4 4 0 4 4 0 0 0 0 0
DireWolf 4 4 0 4 4 0 0 0 0 0
WereWolf 4 4 0 4 4 0 0 0 0 0
FT-SS-03 12 12 0 12 12 0 0 0 0
WOLF 4 4 0 4 4 0 0 0 0 0
wolf 4 4 0 4 4 0 0 0 0 0
Wolf 4 4 0 4 4 0 0 0 0 0
FT-SS-04 4 4 0 4 4 0 0 0 0
panda and fox 4 4 0 4 4 0 0 0 0 0
FT-SS-05 8 8 0 8 8 0 0 0 0
DireWolf 4 4 0 4 4 0 0 0 0 0
WereWolf 4 4 0 4 4 0 0 0 0 0
FT-SS-06 16 0 16 16 0 16 0 0 0
fox and not tiger1601616016000
FT-SS-07-CJK-char 24 8 16 24 8 16 0 0 0
中国 12 4 8 12 4 8 0 0 0 0
東京 12 4 8 12 4 8 0 0 0 0
FT-SS-07-CJK-hangul 12 0 12 12 0 12 0 0 0
서울1201212012000
FT-SS-07-CJK-kana 24 0 24 24 0 24 0 0 0
スバル1201212012000
みつびし1201212012000
FT-SS-07-Cyrillic 12 8 4 12 8 4 0 0 0
Сибирь 12 8 4 12 8 4 0 0 0 0
FT-SS-07-Latin 24 20 4 24 20 4 0 0 0
garçon 12 8 4 12 8 4 0 0 0 0
Schönheit 12 12 0 12 12 0 0 0 0 0
FT-SS-07-NoBOM 52 36 16 52 36 16 0 0 0
Россия 12 8 4 12 8 4 0 0 0 0
فلافل 12 8 4 12 8 4 0 0 0 0
中國 12 4 8 12 4 8 0 0 0 0
QuarterHorse 16 16 0 16 16 0 0 0 0 0
FT-SS-07-Norm 100 45 55 100 45 55 0 0 0
mañana (NFD)1201212012000
libertà (NFD)1201212012000
Mäuse (NFD)1201212012000
infinity (Ligature)1201212012000
Mäuse (NFC) 12 12 0 12 12 0 0 0 0 0
infinity (No Ligature) 16 13 3 16 13 3 0 0 0 0
mañana (NFC) 12 12 0 12 12 0 0 0 0 0
libertà (NFC) 12 8 4 12 8 4 0 0 0 0
FT-SS-07-RTL 12 8 4 12 8 4 0 0 0
الكسكس 12 8 4 12 8 4 0 0 0 0
FT-SS-09-Doc 16 15 1 0 0 0 0 0 0
longbow
.html
2 2 0 0 0 0 0 0 0 0
shotgun
Formatted .doc UTF-16
2 2 0 0 0 0 0 0 0 0
revolver
.doc UTF-16
2 2 0 0 0 0 0 0 0 0
peroxide
.docx
2 2 0 0 0 0 0 0 0 0
nitroglycerin
Formatted .docx
2 2 0 0 0 0 0 0 0 0
rifle
.doc UTF-8
2 2 0 0 0 0 0 0 0 0
crossbow
Formatted .html
2 1 1 0 0 0 0 0 0 0
flintlock
Formatted .doc UTF-8
2 2 0 0 0 0 0 0 0 0
FT-SS-09-Meta 8 8 0 8 8 0 0 0 0
cañón 4 4 0 4 4 0 0 0 0 0
thunderbird 4 4 0 4 4 0 0 0 0 0
FT-SS-10-Hex 4 4 0 4 4 0 0 0 0
panda 4 4 0 4 4 0 0 0 0 0

Meta-Data results for Indexed Search of UNIX Data Set


The following table presents search results for strings located in file system meta-data. The Case column identifies the test case, the String column identifies the search string, the Partition column identifies the partition (file system) where the string is located and the Seen column records if the search tool reported at least one instance of the string (yes or no) in meta-data.

CaseStringPartitionSeen
FT-SS-07-CJK-char
中国osxjYes
中国osxcYes
中国apfsYes
東京osxjYes
東京osxcYes
東京apfsYes
FT-SS-07-Cyrillic
СибирьosxjYes
СибирьosxcYes
СибирьapfsYes
FT-SS-07-NoBOM
فلافلosxjYes
فلافلosxcYes
فلافلapfsYes
РоссияosxjYes
РоссияosxcYes
РоссияapfsYes
中國osxjYes
中國osxcYes
中國apfsYes
FT-SS-07-RTL
الكسكسosxjYes
الكسكسosxcYes
الكسكسapfsYes
FT-SS-09-Meta
thunderbirdosxjYes
thunderbirdosxcYes
thunderbirdapfsYes
thunderbirdext4Yes
cañónext4Yes

Comments on Indexed Search of UNIX Data Set

The following table presents any comments recorded during testing for a test case.

CaseComments
FT-SS-06 Tool hangs & crashes.
FT-SS-07-CJK-hangul Tool crashed.
FT-SS-07-CJK-kana Failed to index; hung & crash.
FT-SS-07-Cyrillic No hits on UTF-16-BE.
FT-SS-07-NoBOM No UTF-16-BE returned for Arabic & Russian.
No UTF-16 returned for Traditional Chinese.

Results for Live Search of UNIX Data Set

The table columns contain the following information:

Notes: If the row identifies a test case, then the results are a summary for all the strings that should be found.

In the Expected String column for test case FT-SS-09-DOC each string is labeled to indicate features of the expected string. The labels include the file type (.doc, .docx or .html), the encoding of the string in the .doc file and if the string has embedded formatting, labeled as Formatted, e.g., the string crossbow has the substring cross formatted as bold and underlined, i.e., crossbow.

CaseExpected StringActive FilesDeleted FilesUnalloc Space
ExpectedHitsMissesExpectedHitsMissesExpectedHitsMisses
FT-SS-01 4 4 0 4 4 0 0 0 0
DireWolf 4 4 0 4 4 0 0 0 0 0
FT-SS-02 20 20 0 20 20 0 0 0 0
WOLF 4 4 0 4 4 0 0 0 0 0
wolf 4 4 0 4 4 0 0 0 0 0
Wolf 4 4 0 4 4 0 0 0 0 0
DireWolf 4 4 0 4 4 0 0 0 0 0
WereWolf 4 4 0 4 4 0 0 0 0 0
FT-SS-03 12 12 0 12 12 0 0 0 0
WOLF 4 4 0 4 4 0 0 0 0 0
wolf 4 4 0 4 4 0 0 0 0 0
Wolf 4 4 0 4 4 0 0 0 0 0
FT-SS-04 4 4 0 4 4 0 0 0 0
panda and fox 4 4 0 4 4 0 0 0 0 0
FT-SS-05 8 8 0 8 8 0 0 0 0
DireWolf 4 4 0 4 4 0 0 0 0 0
WereWolf 4 4 0 4 4 0 0 0 0 0
FT-SS-06 16 16 0 16 16 0 0 0 0
fox and not tiger 16 16 0 16 16 0 0 0 0 0
FT-SS-07-CJK-char 24 24 0 24 24 0 0 0 0
中国 12 12 0 12 12 0 0 0 0 0
東京 12 12 0 12 12 0 0 0 0 0
FT-SS-07-CJK-hangul 12 12 0 12 12 0 0 0 0
서울 12 12 0 12 12 0 0 0 0 0
FT-SS-07-CJK-kana 24 24 0 24 24 0 0 0 0
スバル 12 12 0 12 12 0 0 0 0 0
みつびし 12 12 0 12 12 0 0 0 0 0
FT-SS-07-Cyrillic 12 12 0 12 12 0 0 0 0
Сибирь 12 12 0 12 12 0 0 0 0 0
FT-SS-07-Latin 24 24 0 24 24 0 0 0 0
garçon 12 12 0 12 12 0 0 0 0 0
Schönheit 12 12 0 12 12 0 0 0 0 0
FT-SS-07-NoBOM 52 52 0 52 52 0 0 0 0
Россия 12 12 0 12 12 0 0 0 0 0
فلافل 12 12 0 12 12 0 0 0 0 0
中國 12 12 0 12 12 0 0 0 0 0
QuarterHorse 16 16 0 16 16 0 0 0 0 0
FT-SS-07-Norm 100 100 0 100 100 0 0 0 0
mañana (NFD) 12 12 0 12 12 0 0 0 0 0
infinity (No Ligature) 16 16 0 16 16 0 0 0 0 0
Mäuse (NFD) 12 12 0 12 12 0 0 0 0 0
infinity (Ligature) 12 12 0 12 12 0 0 0 0 0
Mäuse (NFC) 12 12 0 12 12 0 0 0 0 0
libertà (NFC) 12 12 0 12 12 0 0 0 0 0
libertà (NFD) 12 12 0 12 12 0 0 0 0 0
mañana (NFC) 12 12 0 12 12 0 0 0 0 0
FT-SS-07-RTL 12 12 0 12 12 0 0 0 0
الكسكس 12 12 0 12 12 0 0 0 0 0
FT-SS-09-Doc 16 15 1 0 0 0 0 0 0
longbow
.html
2 2 0 0 0 0 0 0 0 0
shotgun
Formatted .doc UTF-16
2 2 0 0 0 0 0 0 0 0
revolver
.doc UTF-16
2 2 0 0 0 0 0 0 0 0
peroxide
.docx
2 2 0 0 0 0 0 0 0 0
nitroglycerin
Formatted .docx
2 2 0 0 0 0 0 0 0 0
rifle
.doc UTF-8
2 2 0 0 0 0 0 0 0 0
crossbow
Formatted .html
2 1 1 0 0 0 0 0 0 0
flintlock
Formatted .doc UTF-8
2 2 0 0 0 0 0 0 0 0
FT-SS-09-Meta 8 8 0 8 8 0 0 0 0
cañón 4 4 0 4 4 0 0 0 0 0
thunderbird 4 4 0 4 4 0 0 0 0 0
FT-SS-10-Hex 4 4 0 4 4 0 0 0 0
panda 4 4 0 4 4 0 0 0 0 0
FT-SS-10-Regex 8 8 0 8 8 0 0 0 0
DireWolf 4 4 0 4 4 0 0 0 0 0
WereWolf 4 4 0 4 4 0 0 0 0 0

Meta-Data results for Live Search of UNIX Data Set


The following table presents search results for strings located in file system meta-data. The Case column identifies the test case, the String column identifies the search string, the Partition column identifies the partition (file system) where the string is located and the Seen column records if the search tool reported at least one instance of the string (yes or no) in meta-data.

CaseStringPartitionSeen
FT-SS-07-CJK-char
中国osxjYes
中国osxcYes
中国apfsYes
東京osxjYes
東京osxcYes
東京apfsYes
FT-SS-07-Cyrillic
СибирьosxjYes
СибирьosxcYes
СибирьapfsYes
FT-SS-07-NoBOM
فلافلosxjYes
فلافلosxcYes
فلافلapfsYes
РоссияosxjYes
РоссияosxcYes
РоссияapfsYes
中國osxjYes
中國osxcYes
中國apfsYes
FT-SS-07-RTL
الكسكسosxjYes
الكسكسosxcYes
الكسكسapfsYes
FT-SS-09-Meta
thunderbirdosxjYes
thunderbirdosxcYes
thunderbirdapfsYes
thunderbirdext4Yes
cañónext4Yes

Comments on Live Search of UNIX Data Set

The following table presents any comments recorded during testing for a test case.

CaseComments
FT-SS-07-Latin Hits on strings encoded UTF-16 are reported twice.
FT-SS-07-NoBOM UTF-16 hits for "QuarterHorse" are reported twice.
FT-SS-07-Norm No Unicode normalization.
Strings normalized as NFC and without a ligature encoded as UTF-16 are reported twice.
Some strings are not found unless searched for alone without any other strings included in the search.

END of REPORT