If you've looked at GREP but found it too cryptic to want to tackle learning it, this is the webinar for you. I walk you through the GREP implementation in EnCase and explain the commands one by one. We build GREP expressions from simple to complex, adding as we go along to account for the use cases. Using the keyword tester and a datafile with positive and negative examples of the data we might want to find, we can verify that our GREP expressions are working as planned before we use them on case data.
You can download the sample chapter from the Book Files section of this site, which covers GREP in more detail, and also the other searching features available to you in EnCase. You can also download the two GREP data files and a file with the GREP expressions I use in the chapter and the webinar.