Tool Name: X-Ways
Tool Version: Forensic
Vendor:
Insert vendor name and contact information.
This section describes test hardware, software, test data sets and test cases.
List and describe any hardware used during testing in sufficient detail to repeat the tests.
Testing was performed using CFTT Federated Testing Test Suite Version
Insert version here.
List and describe any additional software used during
testing in sufficient detail
to repeat the tests.
String search test data set package Version Insert version here was used. The package can be downloaded from either the CFTT web site (www.cftt.nist.gov then select String Searching) or the CFReDS web site (www.cfreds.nist.gov). The package includes two dd files with known content. One of the dd test images contains target strings within FAT, ExFAT and NTFS file systems (Windows), the other dd test image contains target strings from HFS+ journaled, case insensitive (OSXJ), HFS+ journaled, case sensitive (OSXC), ext4 file system and APFS (Apple file system) (UNIX-like).
In general, each target string is encoded in ASCII and located in both an active file and a recoverable deleted file in each partition of the test image. The Windows dd image also has a block of unallocated storage that contains the target strings without a file system. Some of the target strings are also encoded in Unicode UTF-8, UTF-16BE and UTF-16LE with a byte-order-mark. Test case FT-SS-07 is organized to test language and Unicode specific situations such as Unicode UTF-16 without a byte-order-mark, Unicode text with and without combining characters (diacritic marks), Unicode text with and without ligatures ("fi" as two characters and as one character) Test case FT-SS-09 is organized to test specific situations such as formatted strings, strings spanning file fragments, and strings located in inaccessible areas. Each instance of a target string also has a unique associated string ID located immediately after the target string. The string ID helps identify the specific string matched by the search tool.
The following table gives a brief description of available test cases in the data sets. Not
all test cases are used for all data sets.
You can delete the row in the table for any cases not used.
Case | Case Description |
---|---|
FT-SS-01 | Search ASCII |
FT-SS-02 | Search Ignore Case |
FT-SS-03 | Search for Words |
FT-SS-04 | Search Logical AND |
FT-SS-05 | Search Logical OR |
FT-SS-06 | Search Logical NOT |
FT-SS-07-CJK-char | Search Unicode Chinese/Japanese ideograms (Asian) |
FT-SS-07-CJK-hangul | Search Unicode CJK Korean Hangul (Asian) |
FT-SS-07-CJK-kana | Search Unicode CJK Japanese phonetic Kana (Asian) |
FT-SS-07-Cyrillic | Search Unicode Cyrillic (Russian) |
FT-SS-07-Latin | Search Unicode Latin (French & German) |
FT-SS-07-NoBOM | Search Unicode 16 without a byte-order-mark |
FT-SS-07-Norm | Normalized Search of Unicode text with diacritic marks (NFC & NFD) and ligatures (NFKC & NFKD) |
FT-SS-07-RTL | Search Unicode RTL (Arabic) |
FT-SS-08-Email | Search Tool-defined Queries -- Email Address |
FT-SS-08-Phone | Search Tool-defined Queries -- Telephone Number |
FT-SS-08-SS | Search Tool-defined Queries -- Social Security |
FT-SS-09-Doc | Search Formatted Document Text |
FT-SS-09-Frag* | Search Fragmented File |
FT-SS-09-Lost* | Search Inaccessible (lost) Areas |
FT-SS-09-MFT* | Search File in NTFS Master File Table (MFT) |
FT-SS-09-Meta | Search file name substring in Meta-data |
FT-SS-09-Stem | Search for matches to word stem |
FT-SS-10-Hex | Search Hexadecimal Character Match |
FT-SS-10-Regex | Search Pattern Character Match |
Some test cases are for specific features, e.g., logical conditions (and, or, not), built in searches (email, telephone numbers), etc. Three test cases (marked with "*"), FT-SS-09-Frag, FT-SS-09-Lost & FT-SS-09-MFT, are only applied to the Windows data set.
If a test case applies to a feature that is not supported by the tested tool, the case should be omitted and listed here.
A string search tool may implement more than one search algorithm (also known as a search engine) for searching text. The two most common search engines are indexed search and live search. An indexed search reads all the acquired data once before doing any searching and builds an index to all words found. Each query can be looked up quickly in the index. A Live search reads all the acquired data for each query.
This section presents test results by test image (windows file systems, or UNIX-like file systems). For each test image, there is a result table for each search engine tested. Each table shows results by test case of the number of expected search hits, the number of actual search hits and the number of strings missed (i.e., expected hits minus actual hits) for allocated files, deleted files and unallocated space.
The following search engines were tested: Other_Physical, Indexed and Live.
This section provides results for the Windows data set.
The table columns contain the following information:
Notes: If the row identifies a test case, then the results are a summary for all the strings that should be found.
In the Expected String column for test case FT-SS-09-DOC each string is labeled to
indicate features of the expected string. The labels include the file type
(.doc, .docx or .html) and the encoding of the string (if a .doc file).
If the string has embedded formatting it is
labeled as Formatted, e.g., the string crossbow
has the substring cross formatted as bold and underlined, i.e., crossbow.
Results for Other_Physical Search of Windows Data Set | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
Case | Expected String | Active Files | Deleted Files | Unalloc Space | ||||||
Expected | Hits | Misses | Expected | Hits | Misses | Expected | Hits | Misses | ||
FT-SS-01 | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
DireWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-02 | 15 | 15 | 0 | 15 | 15 | 0 | 5 | 5 | 0 | |
WOLF | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
wolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
Wolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
DireWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
WereWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-03 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
WOLF | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
wolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
Wolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-04 | 3 | 3 | 0 | 3 | 3 | 0 | 0 | 0 | 0 | |
panda and fox | 3 | 3 | 0 | 3 | 3 | 0 | 0 | 0 | 0 | |
FT-SS-05 | 6 | 6 | 0 | 6 | 6 | 0 | 2 | 2 | 0 | |
DireWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
WereWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-06 | 12 | 0 | 12 | 12 | 0 | 12 | 0 | 0 | 0 | |
fox and not tiger | 12 | 0 | 12 | 12 | 0 | 12 | 0 | 0 | 0 | |
FT-SS-07-CJK-char | 18 | 18 | 0 | 18 | 18 | 0 | 6 | 6 | 0 | |
中国 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
東京 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-CJK-hangul | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
서울 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-CJK-kana | 18 | 18 | 0 | 18 | 18 | 0 | 6 | 6 | 0 | |
スバル | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
みつびし | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-Cyrillic | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
Сибирь | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-Latin | 18 | 18 | 0 | 18 | 18 | 0 | 6 | 6 | 0 | |
garçon | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
Schönheit | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-NoBOM | 39 | 39 | 0 | 39 | 39 | 0 | 13 | 13 | 0 | |
Россия | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
فلافل | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
中國 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
QuarterHorse | 12 | 12 | 0 | 12 | 12 | 0 | 4 | 4 | 0 | |
FT-SS-07-Norm | 75 | 75 | 0 | 75 | 75 | 0 | 25 | 25 | 0 | |
mañana (NFD) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
infinity (No Ligature) | 12 | 12 | 0 | 12 | 12 | 0 | 4 | 4 | 0 | |
Mäuse (NFD) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
infinity (Ligature) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
Mäuse (NFC) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
libertà (NFC) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
libertà (NFD) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
mañana (NFC) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-RTL | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
الكسكس | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-09-Doc | 16 | 13 | 3 | 0 | 0 | 0 | 16 | 13 | 3 | |
longbow .html | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
shotgun Formatted .doc UTF-16 | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
revolver .doc UTF-16 | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
peroxide .docx | 2 | 1 | 1 | 0 | 0 | 0 | 2 | 1 | 1 | |
nitroglycerin Formatted .docx | 2 | 1 | 1 | 0 | 0 | 0 | 2 | 1 | 1 | |
rifle .doc UTF-8 | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
crossbow Formatted .html | 2 | 1 | 1 | 0 | 0 | 0 | 2 | 1 | 1 | |
flintlock Formatted .doc UTF-8 | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
FT-SS-09-Frag | 2 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | |
Washington | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | |
California | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
FT-SS-09-Lost | 0 | 0 | 0 | 0 | 0 | 0 | 4 | 4 | 0 | |
SecretKey | 0 | 0 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
disconnected | 0 | 0 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
FT-SS-09-MFT | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
bear | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-09-Meta | 6 | 6 | 0 | 6 | 6 | 0 | 2 | 2 | 0 | |
cañón | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
thunderbird | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-10-Hex | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
panda | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-10-Regex | 6 | 6 | 0 | 6 | 6 | 0 | 2 | 2 | 0 | |
DireWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
WereWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 |
The following table presents search results for strings located in file system meta-data.
The Case column identifies the test case, the String column identifies the search string,
the Partition column identifies the partition (file system)
where the string is located and the Seen column records if the search tool
reported at least one instance of the string (yes or no) in meta-data.
Meta-Data Results for Other_Physical Search of Windows Data Set | |||
---|---|---|---|
Case | String | Partition | Seen |
FT-SS-09-Meta | |||
thunderbird | ntfs | Yes | |
cañón | fat32 | Yes | |
cañón | exfat | Yes | |
cañón | ntfs | Yes |
The following table presents any comments recorded during testing for a test case.
Case | Comments on Other_Physical Search of Windows Data Set |
---|---|
FT-SS-06 | Page Fault |
FT-SS-07-Latin | UTF-16 encoded strings are reported twice. |
FT-SS-07-NoBOM | Hits on the string "QuarterHorse" encoded as UTF-16 are reported twice. |
FT-SS-07-Norm | Searches do not use Unicode normalization on the search string. Strings normalized as NFC are reported twice. |
FT-SS-09-Frag | Not finding the string "Washington" is the real expected result because the string is split across two file fragments and should be missed in a sector by sector physical search. |
The table columns contain the following information:
Notes: If the row identifies a test case, then the results are a summary for all the strings that should be found.
In the Expected String column for test case FT-SS-09-DOC each string is labeled to
indicate features of the expected string. The labels include the file type
(.doc, .docx or .html) and the encoding of the string (if a .doc file).
If the string has embedded formatting it is
labeled as Formatted, e.g., the string crossbow
has the substring cross formatted as bold and underlined, i.e., crossbow.
Results for Indexed Search of Windows Data Set | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
Case | Expected String | Active Files | Deleted Files | Unalloc Space | ||||||
Expected | Hits | Misses | Expected | Hits | Misses | Expected | Hits | Misses | ||
FT-SS-01 | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
DireWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-02 | 15 | 15 | 0 | 15 | 15 | 0 | 5 | 5 | 0 | |
WOLF | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
wolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
Wolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
DireWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
WereWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-03 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
WOLF | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
wolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
Wolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-04 | 3 | 3 | 0 | 3 | 3 | 0 | 0 | 0 | 0 | |
panda and fox | 3 | 3 | 0 | 3 | 3 | 0 | 0 | 0 | 0 | |
FT-SS-05 | 6 | 6 | 0 | 6 | 6 | 0 | 2 | 2 | 0 | |
DireWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
WereWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-06 | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
fox and not tiger | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-CJK-char | 18 | 18 | 0 | 18 | 18 | 0 | 6 | 6 | 0 | |
中国 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
東京 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-CJK-hangul | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
서울 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-CJK-kana | 18 | 9 | 9 | 18 | 9 | 9 | 6 | 3 | 3 | |
スバル | 9 | 0 | 9 | 9 | 0 | 9 | 3 | 0 | 3 | |
みつびし | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-Cyrillic | 9 | 6 | 3 | 9 | 6 | 3 | 3 | 2 | 1 | |
Сибирь | 9 | 6 | 3 | 9 | 6 | 3 | 3 | 2 | 1 | |
FT-SS-07-Latin | 18 | 15 | 3 | 18 | 15 | 3 | 6 | 5 | 1 | |
garçon | 9 | 6 | 3 | 9 | 6 | 3 | 3 | 2 | 1 | |
Schönheit | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-NoBOM | 39 | 27 | 12 | 39 | 27 | 12 | 13 | 9 | 4 | |
Россия | 9 | 6 | 3 | 9 | 6 | 3 | 3 | 2 | 1 | |
فلافل | 9 | 6 | 3 | 9 | 6 | 3 | 3 | 2 | 1 | |
中國 | 9 | 3 | 6 | 9 | 3 | 6 | 3 | 1 | 2 | |
QuarterHorse | 12 | 12 | 0 | 12 | 12 | 0 | 4 | 4 | 0 | |
FT-SS-07-Norm | 75 | 39 | 36 | 75 | 39 | 36 | 25 | 13 | 12 | |
mañana (NFD) | 9 | 0 | 9 | 9 | 0 | 9 | 3 | 0 | 3 | |
libertà (NFD) | 9 | 0 | 9 | 9 | 0 | 9 | 3 | 0 | 3 | |
Mäuse (NFD) | 9 | 0 | 9 | 9 | 0 | 9 | 3 | 0 | 3 | |
infinity (Ligature) | 9 | 0 | 9 | 9 | 0 | 9 | 3 | 0 | 3 | |
Mäuse (NFC) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
infinity (No Ligature) | 12 | 12 | 0 | 12 | 12 | 0 | 4 | 4 | 0 | |
mañana (NFC) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
libertà (NFC) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-RTL | 9 | 6 | 3 | 9 | 6 | 3 | 3 | 2 | 1 | |
الكسكس | 9 | 6 | 3 | 9 | 6 | 3 | 3 | 2 | 1 | |
FT-SS-09-Doc | 16 | 15 | 1 | 0 | 0 | 0 | 16 | 13 | 3 | |
longbow .html | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
shotgun Formatted .doc UTF-16 | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
revolver .doc UTF-16 | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
peroxide .docx | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 1 | 1 | |
nitroglycerin Formatted .docx | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 1 | 1 | |
rifle .doc UTF-8 | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
crossbow Formatted .html | 2 | 1 | 1 | 0 | 0 | 0 | 2 | 1 | 1 | |
flintlock Formatted .doc UTF-8 | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
FT-SS-09-Frag | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
Washington | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
California | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
FT-SS-09-Lost | 0 | 0 | 0 | 0 | 0 | 0 | 4 | 4 | 0 | |
SecretKey | 0 | 0 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
disconnected | 0 | 0 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
FT-SS-09-MFT | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
bear | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-09-Meta | 6 | 5 | 1 | 6 | 5 | 1 | 2 | 2 | 0 | |
cañón | 3 | 2 | 1 | 3 | 2 | 1 | 1 | 1 | 0 | |
thunderbird | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-10-Hex | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
panda | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 |
The following table presents search results for strings located in file system meta-data.
The Case column identifies the test case, the String column identifies the search string,
the Partition column identifies the partition (file system)
where the string is located and the Seen column records if the search tool
reported at least one instance of the string (yes or no) in meta-data.
Meta-Data Results for Indexed Search of Windows Data Set | |||
---|---|---|---|
Case | String | Partition | Seen |
FT-SS-09-Meta | |||
thunderbird | ntfs | Yes | |
cañón | fat32 | No | |
cañón | exfat | No | |
cañón | ntfs | Yes |
The following table presents any comments recorded during testing for a test case.
Case | Comments on Indexed Search of Windows Data Set |
---|---|
FT-SS-02 | Hits on strings "WOLF", "Wolf" and "wolf" were reported twice. |
FT-SS-07-CJK-char | The search was run more than once after re indexing and the results were inconsistent. Sometimes all strings were found, other times no strings were found and sometimes only the UTF-8 strings were found. |
FT-SS-07-CJK-kana | Building an index was a problem. There were two possible options that could be selected: Japanese or Unicode Multi-lingual Plane. Selecting "Japanese" failed to produce an index and returned a "non-hex char" error. The other option worked once for "みつびし", but then would not yield any hits after re indexing later. No hits were returned for "スバル". |
FT-SS-07-Latin | UTF-16 hits were reported twice. |
FT-SS-07-RTL | No UTF-16-BE hits were reported. |
FT-SS-09-MFT | Also listed in $MFT. |
FT-SS-09-Meta | String IDs 2641 & 2645 in NTFS were probably matched, but the "Search Hits" did not show any context around the string hit. (Therefore the string ID of the hit was not visible.) |
The table columns contain the following information:
Notes: If the row identifies a test case, then the results are a summary for all the strings that should be found.
In the Expected String column for test case FT-SS-09-DOC each string is labeled to
indicate features of the expected string. The labels include the file type
(.doc, .docx or .html) and the encoding of the string (if a .doc file).
If the string has embedded formatting it is
labeled as Formatted, e.g., the string crossbow
has the substring cross formatted as bold and underlined, i.e., crossbow.
Results for Live Search of Windows Data Set | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
Case | Expected String | Active Files | Deleted Files | Unalloc Space | ||||||
Expected | Hits | Misses | Expected | Hits | Misses | Expected | Hits | Misses | ||
FT-SS-01 | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
DireWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-02 | 15 | 15 | 0 | 15 | 15 | 0 | 5 | 5 | 0 | |
WOLF | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
wolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
Wolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
DireWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
WereWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-03 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
WOLF | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
wolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
Wolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-04 | 3 | 3 | 0 | 3 | 3 | 0 | 0 | 0 | 0 | |
panda and fox | 3 | 3 | 0 | 3 | 3 | 0 | 0 | 0 | 0 | |
FT-SS-05 | 6 | 6 | 0 | 6 | 6 | 0 | 2 | 2 | 0 | |
DireWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
WereWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-06 | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
fox and not tiger | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-CJK-char | 18 | 18 | 0 | 18 | 18 | 0 | 6 | 6 | 0 | |
中国 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
東京 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-CJK-hangul | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
서울 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-CJK-kana | 18 | 18 | 0 | 18 | 18 | 0 | 6 | 6 | 0 | |
スバル | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
みつびし | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-Cyrillic | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
Сибирь | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-Latin | 18 | 18 | 0 | 18 | 18 | 0 | 6 | 6 | 0 | |
garçon | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
Schönheit | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-NoBOM | 39 | 39 | 0 | 39 | 39 | 0 | 13 | 13 | 0 | |
Россия | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
فلافل | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
中國 | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
QuarterHorse | 12 | 12 | 0 | 12 | 12 | 0 | 4 | 4 | 0 | |
FT-SS-07-Norm | 75 | 75 | 0 | 75 | 75 | 0 | 25 | 25 | 0 | |
mañana (NFD) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
infinity (No Ligature) | 12 | 12 | 0 | 12 | 12 | 0 | 4 | 4 | 0 | |
Mäuse (NFD) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
infinity (Ligature) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
Mäuse (NFC) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
libertà (NFC) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
libertà (NFD) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
mañana (NFC) | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-07-RTL | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
الكسكس | 9 | 9 | 0 | 9 | 9 | 0 | 3 | 3 | 0 | |
FT-SS-09-Doc | 16 | 16 | 0 | 0 | 0 | 0 | 16 | 13 | 3 | |
longbow .html | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
shotgun Formatted .doc UTF-16 | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
revolver .doc UTF-16 | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
peroxide .docx | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 1 | 1 | |
nitroglycerin Formatted .docx | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 1 | 1 | |
rifle .doc UTF-8 | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
crossbow Formatted .html | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 1 | 1 | |
flintlock Formatted .doc UTF-8 | 2 | 2 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
FT-SS-09-Frag | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
Washington | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
California | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
FT-SS-09-Lost | 0 | 0 | 0 | 0 | 0 | 0 | 4 | 4 | 0 | |
SecretKey | 0 | 0 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
disconnected | 0 | 0 | 0 | 0 | 0 | 0 | 2 | 2 | 0 | |
FT-SS-09-MFT | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
bear | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-09-Meta | 6 | 6 | 0 | 6 | 6 | 0 | 2 | 2 | 0 | |
cañón | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
thunderbird | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-10-Hex | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
panda | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
FT-SS-10-Regex | 6 | 6 | 0 | 6 | 6 | 0 | 2 | 2 | 0 | |
DireWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 | |
WereWolf | 3 | 3 | 0 | 3 | 3 | 0 | 1 | 1 | 0 |
The following table presents search results for strings located in file system meta-data.
The Case column identifies the test case, the String column identifies the search string,
the Partition column identifies the partition (file system)
where the string is located and the Seen column records if the search tool
reported at least one instance of the string (yes or no) in meta-data.
Meta-Data Results for Live Search of Windows Data Set | |||
---|---|---|---|
Case | String | Partition | Seen |
FT-SS-09-Meta | |||
thunderbird | ntfs | Yes | |
cañón | fat32 | Yes | |
cañón | exfat | Yes | |
cañón | ntfs | Yes |
The following table presents any comments recorded during testing for a test case.
Case | Comments on Live Search of Windows Data Set |
---|---|
FT-SS-06 | UTF-16 strings are reported twice. |
FT-SS-07-Latin | UTF-16 strings are reported twice. |
FT-SS-07-NoBOM | UTF-16 strings for "QuarterHorse" are reported twice. |
FT-SS-07-Norm | UTF-16 strings normalized as NFC are reported twice. |
FT-SS-09-Doc | UTF-16 strings are reported twice. |
FT-SS-09-Lost | UTF-16 strings are reported twice. |
This section provides results for the UNIX data set.
The table columns contain the following information:
Notes: If the row identifies a test case, then the results are a summary for all the strings that should be found.
In the Expected String column for test case FT-SS-09-DOC each string is labeled to
indicate features of the expected string. The labels include the file type
(.doc, .docx or .html) and the encoding of the string (if a .doc file).
If the string has embedded formatting it is
labeled as Formatted, e.g., the string crossbow
has the substring cross formatted as bold and underlined, i.e., crossbow.
Results for Other_Physical Search of UNIX Data Set | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
Case | Expected String | Active Files | Deleted Files | Unalloc Space | ||||||
Expected | Hits | Misses | Expected | Hits | Misses | Expected | Hits | Misses | ||
FT-SS-01 | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
DireWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-02 | 20 | 20 | 0 | 20 | 20 | 0 | 0 | 0 | 0 | |
WOLF | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
wolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
Wolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
DireWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
WereWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-03 | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
WOLF | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
wolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
Wolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-04 | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
panda and fox | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-05 | 8 | 8 | 0 | 8 | 8 | 0 | 0 | 0 | 0 | |
DireWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
WereWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-06 | 16 | 0 | 16 | 16 | 0 | 16 | 0 | 0 | 0 | |
fox and not tiger | 16 | 0 | 16 | 16 | 0 | 16 | 0 | 0 | 0 | |
FT-SS-07-CJK-char | 24 | 24 | 0 | 24 | 24 | 0 | 0 | 0 | 0 | |
中国 | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
東京 | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-CJK-hangul | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
서울 | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-CJK-kana | 24 | 24 | 0 | 24 | 24 | 0 | 0 | 0 | 0 | |
スバル | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
みつびし | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-Cyrillic | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
Сибирь | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-Latin | 24 | 24 | 0 | 24 | 24 | 0 | 0 | 0 | 0 | |
garçon | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
Schönheit | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-NoBOM | 52 | 52 | 0 | 52 | 52 | 0 | 0 | 0 | 0 | |
Россия | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
فلافل | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
中國 | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
QuarterHorse | 16 | 16 | 0 | 16 | 16 | 0 | 0 | 0 | 0 | |
FT-SS-07-Norm | 100 | 100 | 0 | 100 | 100 | 0 | 0 | 0 | 0 | |
mañana (NFD) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
infinity (No Ligature) | 16 | 16 | 0 | 16 | 16 | 0 | 0 | 0 | 0 | |
Mäuse (NFD) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
infinity (Ligature) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
Mäuse (NFC) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
libertà (NFC) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
libertà (NFD) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
mañana (NFC) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-RTL | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
الكسكس | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-09-Doc | 16 | 13 | 3 | 0 | 0 | 0 | 0 | 0 | 0 | |
longbow .html | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
shotgun Formatted .doc UTF-16 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
revolver .doc UTF-16 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
peroxide .docx | 2 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | |
nitroglycerin Formatted .docx | 2 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | |
rifle .doc UTF-8 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
crossbow Formatted .html | 2 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | |
flintlock Formatted .doc UTF-8 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
FT-SS-09-Meta | 8 | 8 | 0 | 8 | 8 | 0 | 0 | 0 | 0 | |
cañón | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
thunderbird | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-10-Hex | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
panda | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-10-Regex | 8 | 8 | 0 | 8 | 8 | 0 | 0 | 0 | 0 | |
DireWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
WereWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 |
The following table presents search results for strings located in file system meta-data.
The Case column identifies the test case, the String column identifies the search string,
the Partition column identifies the partition (file system)
where the string is located and the Seen column records if the search tool
reported at least one instance of the string (yes or no) in meta-data.
Meta-Data Results for Other_Physical Search of UNIX Data Set | |||
---|---|---|---|
Case | String | Partition | Seen |
FT-SS-07-CJK-char | |||
中国 | osxj | Yes | |
中国 | osxc | Yes | |
中国 | apfs | Yes | |
東京 | osxj | Yes | |
東京 | osxc | Yes | |
東京 | apfs | Yes | |
FT-SS-07-Cyrillic | |||
Сибирь | osxj | Yes | |
Сибирь | osxc | Yes | |
Сибирь | apfs | Yes | |
FT-SS-07-NoBOM | |||
فلافل | osxj | Yes | |
فلافل | osxc | Yes | |
فلافل | apfs | Yes | |
Россия | osxj | Yes | |
Россия | osxc | Yes | |
Россия | apfs | Yes | |
中國 | osxj | Yes | |
中國 | osxc | Yes | |
中國 | apfs | Yes | |
FT-SS-07-RTL | |||
الكسكس | osxj | Yes | |
الكسكس | osxc | Yes | |
الكسكس | apfs | Yes | |
FT-SS-09-Meta | |||
thunderbird | osxj | Yes | |
thunderbird | osxc | Yes | |
thunderbird | apfs | Yes | |
thunderbird | ext4 | Yes | |
cañón | ext4 | Yes |
The following table presents any comments recorded during testing for a test case.
Case | Comments on Other_Physical Search of UNIX Data Set |
---|---|
FT-SS-06 | Tool crashes. page protection fault. |
FT-SS-07-Latin | UTF-16 encoded strings are reported twice. |
FT-SS-07-NoBOM | UTF-16 strings for "QuarterHorse" are reported twice. |
FT-SS-07-Norm | Searches do not use Unicode normalization on the search string. Strings normalized as NFC are reported twice. |
FT-SS-09-Doc | UTF-16 strings are reported twice. |
The table columns contain the following information:
Notes: If the row identifies a test case, then the results are a summary for all the strings that should be found.
In the Expected String column for test case FT-SS-09-DOC each string is labeled to
indicate features of the expected string. The labels include the file type
(.doc, .docx or .html) and the encoding of the string (if a .doc file).
If the string has embedded formatting it is
labeled as Formatted, e.g., the string crossbow
has the substring cross formatted as bold and underlined, i.e., crossbow.
Results for Indexed Search of UNIX Data Set | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
Case | Expected String | Active Files | Deleted Files | Unalloc Space | ||||||
Expected | Hits | Misses | Expected | Hits | Misses | Expected | Hits | Misses | ||
FT-SS-01 | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
DireWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-02 | 20 | 20 | 0 | 20 | 20 | 0 | 0 | 0 | 0 | |
WOLF | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
wolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
Wolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
DireWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
WereWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-03 | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
WOLF | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
wolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
Wolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-04 | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
panda and fox | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-05 | 8 | 8 | 0 | 8 | 8 | 0 | 0 | 0 | 0 | |
DireWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
WereWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-06 | 16 | 0 | 16 | 16 | 0 | 16 | 0 | 0 | 0 | |
fox and not tiger | 16 | 0 | 16 | 16 | 0 | 16 | 0 | 0 | 0 | |
FT-SS-07-CJK-char | 24 | 8 | 16 | 24 | 8 | 16 | 0 | 0 | 0 | |
中国 | 12 | 4 | 8 | 12 | 4 | 8 | 0 | 0 | 0 | |
東京 | 12 | 4 | 8 | 12 | 4 | 8 | 0 | 0 | 0 | |
FT-SS-07-CJK-hangul | 12 | 0 | 12 | 12 | 0 | 12 | 0 | 0 | 0 | |
서울 | 12 | 0 | 12 | 12 | 0 | 12 | 0 | 0 | 0 | |
FT-SS-07-CJK-kana | 24 | 0 | 24 | 24 | 0 | 24 | 0 | 0 | 0 | |
スバル | 12 | 0 | 12 | 12 | 0 | 12 | 0 | 0 | 0 | |
みつびし | 12 | 0 | 12 | 12 | 0 | 12 | 0 | 0 | 0 | |
FT-SS-07-Cyrillic | 12 | 8 | 4 | 12 | 8 | 4 | 0 | 0 | 0 | |
Сибирь | 12 | 8 | 4 | 12 | 8 | 4 | 0 | 0 | 0 | |
FT-SS-07-Latin | 24 | 20 | 4 | 24 | 20 | 4 | 0 | 0 | 0 | |
garçon | 12 | 8 | 4 | 12 | 8 | 4 | 0 | 0 | 0 | |
Schönheit | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-NoBOM | 52 | 36 | 16 | 52 | 36 | 16 | 0 | 0 | 0 | |
Россия | 12 | 8 | 4 | 12 | 8 | 4 | 0 | 0 | 0 | |
فلافل | 12 | 8 | 4 | 12 | 8 | 4 | 0 | 0 | 0 | |
中國 | 12 | 4 | 8 | 12 | 4 | 8 | 0 | 0 | 0 | |
QuarterHorse | 16 | 16 | 0 | 16 | 16 | 0 | 0 | 0 | 0 | |
FT-SS-07-Norm | 100 | 48 | 52 | 100 | 48 | 52 | 0 | 0 | 0 | |
mañana (NFD) | 12 | 0 | 12 | 12 | 0 | 12 | 0 | 0 | 0 | |
libertà (NFD) | 12 | 0 | 12 | 12 | 0 | 12 | 0 | 0 | 0 | |
Mäuse (NFD) | 12 | 0 | 12 | 12 | 0 | 12 | 0 | 0 | 0 | |
infinity (Ligature) | 12 | 0 | 12 | 12 | 0 | 12 | 0 | 0 | 0 | |
Mäuse (NFC) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
infinity (No Ligature) | 16 | 16 | 0 | 16 | 16 | 0 | 0 | 0 | 0 | |
mañana (NFC) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
libertà (NFC) | 12 | 8 | 4 | 12 | 8 | 4 | 0 | 0 | 0 | |
FT-SS-07-RTL | 12 | 8 | 4 | 12 | 8 | 4 | 0 | 0 | 0 | |
الكسكس | 12 | 8 | 4 | 12 | 8 | 4 | 0 | 0 | 0 | |
FT-SS-09-Doc | 16 | 15 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | |
longbow .html | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
shotgun Formatted .doc UTF-16 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
revolver .doc UTF-16 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
peroxide .docx | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
nitroglycerin Formatted .docx | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
rifle .doc UTF-8 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
crossbow Formatted .html | 2 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | |
flintlock Formatted .doc UTF-8 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
FT-SS-09-Meta | 8 | 8 | 0 | 8 | 8 | 0 | 0 | 0 | 0 | |
cañón | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
thunderbird | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-10-Hex | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
panda | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 |
The following table presents search results for strings located in file system meta-data.
The Case column identifies the test case, the String column identifies the search string,
the Partition column identifies the partition (file system)
where the string is located and the Seen column records if the search tool
reported at least one instance of the string (yes or no) in meta-data.
Meta-Data Results for Indexed Search of UNIX Data Set | |||
---|---|---|---|
Case | String | Partition | Seen |
FT-SS-07-CJK-char | |||
中国 | osxj | Yes | |
中国 | osxc | Yes | |
中国 | apfs | Yes | |
東京 | osxj | Yes | |
東京 | osxc | Yes | |
東京 | apfs | Yes | |
FT-SS-07-Cyrillic | |||
Сибирь | osxj | Yes | |
Сибирь | osxc | Yes | |
Сибирь | apfs | Yes | |
FT-SS-07-NoBOM | |||
فلافل | osxj | Yes | |
فلافل | osxc | Yes | |
فلافل | apfs | Yes | |
Россия | osxj | Yes | |
Россия | osxc | Yes | |
Россия | apfs | Yes | |
中國 | osxj | Yes | |
中國 | osxc | Yes | |
中國 | apfs | Yes | |
FT-SS-07-RTL | |||
الكسكس | osxj | Yes | |
الكسكس | osxc | Yes | |
الكسكس | apfs | Yes | |
FT-SS-09-Meta | |||
thunderbird | osxj | Yes | |
thunderbird | osxc | Yes | |
thunderbird | apfs | Yes | |
thunderbird | ext4 | Yes | |
cañón | ext4 | Yes |
The following table presents any comments recorded during testing for a test case.
Case | Comments on Indexed Search of UNIX Data Set |
---|---|
FT-SS-06 | Tool hangs & crashes. |
FT-SS-07-CJK-hangul | Tool crashed. |
FT-SS-07-CJK-kana | Failed to index; hung & crash. |
FT-SS-07-Cyrillic | No hits on UTF-16-BE. |
FT-SS-07-NoBOM | No UTF-16-BE returned for Arabic & Russian. No UTF-16 returned for Traditional Chinese. |
The table columns contain the following information:
Notes: If the row identifies a test case, then the results are a summary for all the strings that should be found.
In the Expected String column for test case FT-SS-09-DOC each string is labeled to
indicate features of the expected string. The labels include the file type
(.doc, .docx or .html) and the encoding of the string (if a .doc file).
If the string has embedded formatting it is
labeled as Formatted, e.g., the string crossbow
has the substring cross formatted as bold and underlined, i.e., crossbow.
Results for Live Search of UNIX Data Set | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|
Case | Expected String | Active Files | Deleted Files | Unalloc Space | ||||||
Expected | Hits | Misses | Expected | Hits | Misses | Expected | Hits | Misses | ||
FT-SS-01 | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
DireWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-02 | 20 | 20 | 0 | 20 | 20 | 0 | 0 | 0 | 0 | |
WOLF | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
wolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
Wolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
DireWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
WereWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-03 | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
WOLF | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
wolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
Wolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-04 | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
panda and fox | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-05 | 8 | 8 | 0 | 8 | 8 | 0 | 0 | 0 | 0 | |
DireWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
WereWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-06 | 16 | 16 | 0 | 16 | 16 | 0 | 0 | 0 | 0 | |
fox and not tiger | 16 | 16 | 0 | 16 | 16 | 0 | 0 | 0 | 0 | |
FT-SS-07-CJK-char | 24 | 24 | 0 | 24 | 24 | 0 | 0 | 0 | 0 | |
中国 | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
東京 | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-CJK-hangul | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
서울 | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-CJK-kana | 24 | 24 | 0 | 24 | 24 | 0 | 0 | 0 | 0 | |
スバル | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
みつびし | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-Cyrillic | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
Сибирь | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-Latin | 24 | 24 | 0 | 24 | 24 | 0 | 0 | 0 | 0 | |
garçon | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
Schönheit | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-NoBOM | 52 | 52 | 0 | 52 | 52 | 0 | 0 | 0 | 0 | |
Россия | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
فلافل | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
中國 | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
QuarterHorse | 16 | 16 | 0 | 16 | 16 | 0 | 0 | 0 | 0 | |
FT-SS-07-Norm | 100 | 100 | 0 | 100 | 100 | 0 | 0 | 0 | 0 | |
mañana (NFD) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
infinity (No Ligature) | 16 | 16 | 0 | 16 | 16 | 0 | 0 | 0 | 0 | |
Mäuse (NFD) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
infinity (Ligature) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
Mäuse (NFC) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
libertà (NFC) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
libertà (NFD) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
mañana (NFC) | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-07-RTL | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
الكسكس | 12 | 12 | 0 | 12 | 12 | 0 | 0 | 0 | 0 | |
FT-SS-09-Doc | 16 | 15 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | |
longbow .html | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
shotgun Formatted .doc UTF-16 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
revolver .doc UTF-16 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
peroxide .docx | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
nitroglycerin Formatted .docx | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
rifle .doc UTF-8 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
crossbow Formatted .html | 2 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | |
flintlock Formatted .doc UTF-8 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | |
FT-SS-09-Meta | 8 | 8 | 0 | 8 | 8 | 0 | 0 | 0 | 0 | |
cañón | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
thunderbird | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-10-Hex | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
panda | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
FT-SS-10-Regex | 8 | 8 | 0 | 8 | 8 | 0 | 0 | 0 | 0 | |
DireWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 | |
WereWolf | 4 | 4 | 0 | 4 | 4 | 0 | 0 | 0 | 0 |
The following table presents search results for strings located in file system meta-data.
The Case column identifies the test case, the String column identifies the search string,
the Partition column identifies the partition (file system)
where the string is located and the Seen column records if the search tool
reported at least one instance of the string (yes or no) in meta-data.
Meta-Data Results for Live Search of UNIX Data Set | |||
---|---|---|---|
Case | String | Partition | Seen |
FT-SS-07-CJK-char | |||
中国 | osxj | Yes | |
中国 | osxc | Yes | |
中国 | apfs | Yes | |
東京 | osxj | Yes | |
東京 | osxc | Yes | |
東京 | apfs | Yes | |
FT-SS-07-Cyrillic | |||
Сибирь | osxj | Yes | |
Сибирь | osxc | Yes | |
Сибирь | apfs | Yes | |
FT-SS-07-NoBOM | |||
فلافل | osxj | Yes | |
فلافل | osxc | Yes | |
فلافل | apfs | Yes | |
Россия | osxj | Yes | |
Россия | osxc | Yes | |
Россия | apfs | Yes | |
中國 | osxj | Yes | |
中國 | osxc | Yes | |
中國 | apfs | Yes | |
FT-SS-07-RTL | |||
الكسكس | osxj | Yes | |
الكسكس | osxc | Yes | |
الكسكس | apfs | Yes | |
FT-SS-09-Meta | |||
thunderbird | osxj | Yes | |
thunderbird | osxc | Yes | |
thunderbird | apfs | Yes | |
thunderbird | ext4 | Yes | |
cañón | ext4 | Yes |
The following table presents any comments recorded during testing for a test case.
Case | Comments on Live Search of UNIX Data Set |
---|---|
FT-SS-07-Latin | Hits on strings encoded UTF-16 are reported twice. |
FT-SS-07-NoBOM | UTF-16 hits for "QuarterHorse" are reported twice. |
FT-SS-07-Norm | No Unicode normalization. Strings normalized as NFC and without a ligature encoded as UTF-16 are reported twice. Some strings are not found unless searched for alone without any other strings included in the search. |
END of REPORT