Current digital forensic text string search tools use match and/or indexing algorithms to
search digital evidence at the physical level to locate specific text strings. They are designed
to achieve 100% query recall (ie find all instances of the text strings). Given the nature of the
data set, this leads to an extremely high incidence of hits that are not relevant to investigative
objectives. Although Internet search engines suffer similarly, they employ ranking algorithms
to present the search results in a more effective and efficient manner from the user's …