[sleuthkit-users] Difference in Keyword Searching between Unallocated and "Original"

[Chuck W. <chu...@ne...>]

Hi all,

I have a question about searching in Autopsy.  What is the difference 
between the "Unallocated" searching and the "Original" searching 
specifically.  That is, does the "Original" search only allocated space 
(logical files) or does it search the entire drive, including allocated 
and unallocated space?  I assume that the "Unallocated" search does not 
search logical files, but what about deleted files?

Part of the reason that I am confused by this is that I have done some 
testing and found that the "original" searches would find text in the 
boot sector of a floppy disk where the "unallocated" search would not.

Thanks for your help and have a good day!

Chuck Willis