9.11.1 DATE RANGE FILTER
The Date Range filter tool is applied to the items displayed in a list view and allows filtering by Created, Modified, and Accessed dates.
To access the Date Range filter tool:
1. Right click on the File list viewcolumn headings; 2. From the drop down menu, select “Date Filter Tool”:
The Date Range filter tool then appears above the List view column headings, as shown in Figure 93 below.
C h a p t e r 9 - W o r k i n g w i t h d a t a 115 | P a g e
Copyright GetData Forensics Pty Ltd 2010 - 2014, All rights reserved. Figure 93, Date filter tool
The applied filter column is displayed in red (e.g. “Accessed”).
To change filter criteria, click on the date icon in the Modified, Created, or Access columns and select the “Show Date Range Tool” for that column.
To apply a date filter:
Select and drag the slide bar pointers at either end of the date range to the required position on the date range bar. As the date range is narrowed, the filter is applied to the list view. In the example below, the filter is set to show only files with a date between 2011 and 2012:
Figure 94, Application of date range sliders
To modify the time scale, double click at either end of the date range. To clear the date range filter, click on the icon.
To close the date range filter, click the icon.
9.11.2 TEXT FILTER TOOL
The text filter tool is applied in a list view and allows instant text filtering on column data.
To access the text filter tool:
1. Right click on a List viewwindow;
Copyright GetData Forensics Pty Ltd 2010 - 2015, All rights reserved.
3. The text filter then appears above the List view column headings, as shown in Figure 95 below.
To apply a text filter:
1. Type into the filter field above the column heading: i. Requires A-Z characters;
ii. Requires numbers 1 – 9.
Use >, =, or < symbols to list data greater than, equal to or less than the typed number;
iii. Requires a date format (click for auto selection calendar). 2. As text is typed into the filed the displayed content updates based upon the
typed criteria.
When the filter is applied, the outline of the filter box/s turns red in color, as shown in Figure 95 below;
Figure 95, Text filter tool
To apply multiple column text filters: Enter the filter criteria into the field above each column heading. Multiple text filters are joined with the “and” operator.
To clear a text filter: Remove the text from the filter. To clear all filters: Press the icon.
To close the text filter, click the icon. To change search options, click the▼ icon:
C h a p t e r 9 - W o r k i n g w i t h d a t a 117 | P a g e
Copyright GetData Forensics Pty Ltd 2010 - 2014, All rights reserved. Figure 96, Text filter search options
Simple: Filters for text entered.
NOT: Displays any value which does NOT match text entered. When the NOT column filter is active, the A-Z icon turns black, as shown in Figure 97 below:
Figure 97, NOT column filter active
RegEx: Regular expression search. When the RegEx column filter is active the icon changes to a formula, as shown in xx below:
Figure 98, RegEx column filter
RegEx quick start guide: abc… Letters 123… Digits \d any Digit . any Character \. Period [abc] Only a, b, or c [^abc] Not a, b, nor c [a-z] Characters a to z [0-9] Numbers 0 to 9 {m} m Repetitions {m,n} m to n Repetitions * Zero or more repetitions + One or more repetitions
? Optional
\s any Whitespace ^…$ Starts and ends () capture Group (a(bc)) capture Sub group (.*) capture Variable content (a|b) Match’s a or b
Copyright GetData Forensics Pty Ltd 2010 - 2015, All rights reserved.
\W
any Non-alphanumeric character
\d any Digit
\D any Non-digit character \s any Whitespace
\S any Non-whitespace character
Note: The Flag Column is a currently a binary search (it will be upgraded in a future version):
Flags Text Filter Value Flags shown
1 Shows column 1 (red) onward
2 Shows column 2 (blue) onward
4 Shows column 3 (yellow) onward
8 Shows column 4 (orange) onward
16 Shows column 5 (green) onward
32 Shows column 6 (pink) onward
64 Shows column 7 (aqua) onward
128 Shows column 8 (brown) onward
9.11.3 EXPLORER TOOL
The Explorer Tool is applied in a list view and allows navigation of the file system in a similar fashion to Windows Explorer.
To access the Explorer tool:
1. Right click on a List view window;
2. From the drop down menu, select “Explorer Tool”:
3. The Explorer Tool then appears above the List view column headings, as shown in Figure 99, Explorer Tool below.
C h a p t e r 9 - W o r k i n g w i t h d a t a 119 | P a g e
Copyright GetData Forensics Pty Ltd 2010 - 2014, All rights reserved. Figure 99, Explorer Tool
Click on a folder in the path to jump to that folder in the List view. Use the drop down menu to jump to a recent path.
9.11.4 FOLDERS FILTER
Folders filters are applied using scripts. See Filters, page 218, for more information.