AND operator

A place for general discussion of sleuthkit.org projects or other open source forensics software.

Moderator: carrier

AND operator

Postby lorpar » Mon Jun 05, 2017 6:33 pm

I searched a lot and found that the only logical operator I can use in a keyword serach is OR (|). This means that I can search and indexed HD for KWord1 OR KWord2 ... but can not search for KWord1 AND KWord2. Is there a way or trick to search and indexed HD (with all ingests done) for files containing BOTH KWord1 AND KWord2 ??
Thanks for your help.
lorpar
 
Posts: 1
Joined: Mon Jun 05, 2017 6:17 pm

Re: AND operator

Postby Hoyt » Thu Jul 20, 2017 1:58 pm

I wasn't aware that logical operators could be used in the search bar at all. Even though it would be much faster to run an index search that way, you could still run it as a list even if only two words were in the list. I'm sure you're trying to save some time there, which is why you're asking in the first place.
Hoyt
 
Posts: 61
Joined: Thu Dec 11, 2014 4:02 am
Location: Little Rock, AR


Return to General

Who is online

Users browsing this forum: No registered users and 1 guest

cron