0

How do I convert February 2, 2002 at 10 to GREP REGEX for EnCase Forensics?

Thanks

2
  • 1
    What do you mean by "convert (a date) to regex"?
    – PhiLho
    Apr 28, 2011 at 18:36
  • Regular Expressions.... like in pearl? It's for EnCase Forensics search on Regular Expression needed to find specific time.
    – ITSecurity
    Apr 28, 2011 at 20:40

2 Answers 2

0

I don't know EnCase Forensics and given the astounding number of answers here, I am not alone...
This is probably not even a programming question, more like a superuser one, "how to use a program".
But well, if it uses traditional regexes (regular expressions, right), like in Perl (not pearl), just enter the string as given, it doesn't use any special character used in regexes. Ie. that will be a plain text search.

0

It depends on the format. For Month/Day/Year formatting, I would recommend 0?2/11/(20)?02. This makes a leading zero optional as well as allowing for a 2 digit or 4 digit year.

A general month/day/year date regexp in EnCase could be [01]?#/##/(##)?##. However, there will be many dates in a different format, using abbreviations for months or formatted as year/month/day, etc.

(NB: EnCase uses '#' for [0-9] whereas most grep engines use \d.)

Jon

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.