Regarding the underscore ( _ ) character, I can see words/strings that contain an underscore, however I am not receiving search results that include those examples. Why is that?
Default dtSearch settings in Accessdata FTK have the underscore character defined as a "letter". This means that the underscore character is indexed as a literal character, rather than treated as a word-breaker.
Thus, for an FTK case using default dtSearch settings, to find a string that contains an underscore, one must include the underscore in the query.
E.g. For a string like "older_version_documentation" to be returned as a search hit, one would need to search like below:
This also means that searching for any of the following would not return "older_version_documentation" as a search hit:
older w/1 version
Note: One can change this default treatment of the underscore character during case creation.
E.g. remove the underscore from the "letters" section and add it to the "hyphen" or "space" section.
Contributors: Bryan Gorczyk, Tom Angle