- Basic Searches 101
- Time Based Searches
- Person and Organizational Searches
- Other Relevant Searches
- Expanding on the Tool
Other Relevant Searches
It’s now wrap up time. The PC is still running and is on the net. You share out the disk and index it. What are the chances WonderCoder filled the recycle bin without emptying it? The is:deleted may show those files if the recycle bin is part of the indexing, but we can simply open the recycle bin and look inside.
At this point, it’s pretty obvious that a fuller investigation, coordinated with the Legal Department, is warranted. Maybe there are other file types you might want to single out. The term kind:im will bring up any Instant Messaging transcripts that may be recorded. Amazingly, people think IM is unrecordable and untraceable. Not so. Expect your Buddy List to be reviewed during an investigation.
As the pressure increases to monitor and discipline companies for possible illegal copies of music, the kind:music directive will help you find all kinds of files, even those with renamed extensions. The kind:pics can show the pictures sent in emails, received in emails, and stored on the computer. Of course, HTML email often has many embedded graphics that are harmless. You’ll see those as well. But if you change Folder view to "Tiles," you will see the images stored locally, possibly cached browser images. Pornography can get company equipment confiscated by law enforcement as well as get you in the news. Pornography is a true business and risk issue.
Maybe you want to zero in on a specific directory. The modifier foldername:mydocs will pinpoint files in the My Documents folder. As you scroll through the listing of found files, done with a general search, you can move and sort the columns. Checking the File Location data may show deeply nested directories as a way to hide content, which can guide more specific location queries.