Support Forums

I have created an image of a hard drive (eve file) and was given a list of search terms to find.  It appears that the search functionality of ProDiscover is not working on Office 2007 documents.  Is there an update I’m missing?  I’m on version 5.5.

 

Thanks

kmcconell,

Thanks for taking the time to post to the forums. ProDiscover has no build-in MS Office viewers nor does it currently have a way to index those file types. We are currently working on Index based search from within PD and expect this functionality to it in the later part of August.

Will the update you are releasing this month be able to search Office 2007 documents? 

Our forensic team which will be using this software (and bought the software) expects it to be able to search documents created by our users.  Since we have been using Office 2007 for almost two years now most relevant documents will in this new format.  If the update you are releasing is not going to support this type of search functionality and if you have no plans to implement this functionality fairly soon (2009), we will have no choice, but to find another product that can meet this need.

 

Kmcconnell,
ProDiscover 5.5’s raw search capability doesn’t care about the document format in its search and therefore should have no problem searching the office documents you suggest. Conducting a raw content search should return any search term from documents including any office meta data or header values. The only situation where this would not be true is if the document was encrypted using Office, EFS, or otherwise. Please feel free to call or email us directly and we’ll walk through things to try and identify the problem you are having.

Chris, I sent a message to the support email address and will call later once you get into the office.

After discussing your issue with Alex this morning we looked into it a bit. It looks like the new .docx format is a compressed xml format that is not ACSII or Unicode readable therefore your raw searches will not identify the search terms just as they would not in an encrypted or compressed document. Until we can implement a file parsing tool within ProDiscover you will need to do some pre-processing. A good approach would be to extract all .docx documents you want to search to a temporary work area, then convert them to text format using one of the many tools available (Google docx to txt). Once they are extracted and converted, you can add that staging disk to ProDiscover and conduct your searches of the converted documents. I would like to thank you for bringing the issue to our attention. As you might expect it’s difficult to keep up with every iteration of file format around. Customers like you help keep us pointed in the right direction.

BTW: We found a nice little batch converter at:

http://batchwork.com/?p=doc2doc&v=2009.1.804.1186&c=r2c1w12a7s4f0k3&i=990535784

All,

Just to amplify Chris' posts....

One of the new features in ProDiscover 6 is the ability index live disks and images. This feature will support the indexing of PDF, XML (including .DOCX) and other file types. We'll be working on internal viewers within ProDiscover post 6.0 release. So, in addition to the pre-processed work around posted above, the index base search will return search sets not currently supported in our RAW search.