ProDiscover Incident Response Edition

Re: Search Term Set Construction

Alex — Tue, 07 Apr 2009 18:10:42 GMT

Noah,

Are you using Content Search and searching for files named?

Re: Search Term Set Construction

nocdavis — Fri, 30 Jan 2009 16:45:10 GMT

I have created the following .sts file to remove unwanted file types but it does not appear to be working. Could someone advise me on how to construct appropriately?

NOT *.dll
NOT *.bat
NOT *.sys
NOT *.com
NOT *.dat
NOT *.bin
NOT *.vdm
NOT *.cat
NOT *.MYD
NOT *.MYI
NOT *.exe
NOT *.dat
NOT *.reg
NOT *.inf
NOT *.lnk
NOT *.msi
NOT *.ini
NOT *.dtd
NOT *.xsd
NOT *.x3d
NOT *.js
NOT *.h
NOT *.c
NOT *.cpp
NOT *.ttf
NOT *.jsa
NOT *.jar
NOT *.xml
NOT *.sys
NOT *.aspx
NOT *.asp
NOT *.php
NOT *.cs
NOT *.mof
NOT *.mui

Search Term Set Construction

nocdavis — Wed, 28 Jan 2009 15:17:40 GMT

I am just wondering the best way to construct a search term set that will prevent duplicates as much as possible and eliminate all of the .dll, .exe, files that are returned within the content search. Right now I have a list of 30-45 file types (by extension) I would like to exclude.

I understand the potential to mask files, etc... but that is not of a primary concern.