# Keyword Search for variable values in a pattern?

**URL:** <https://sleuthkit.discourse.group/t/keyword-search-for-variable-values-in-a-pattern/110>\
**Category:** Autopsy Feature Requests\
**Created:** [June 11, 2019, 6:39pm UTC](https://sleuthkit.discourse.group/t/keyword-search-for-variable-values-in-a-pattern/110 "2019-06-11T18:39:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![fmartin2](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@fmartin2](https://sleuthkit.discourse.group/u/fmartin2)\
**Post date:** [June 11, 2019, 6:39pm UTC](https://sleuthkit.discourse.group/t/keyword-search-for-variable-values-in-a-pattern/110/1 "2019-06-11T18:39:15Z")

</div>

Hi. I would like to be able to use the Keyword Search feature in Autopsy to be able to search for strings of data that match a pattern, rather than an explicit value. A specific example of what I am looking for would be the ability to keyword search across a forensic image for any strings of data that match the pattern of a U.S. Social Security Number (i.e. a pattern integers where they are typed as 3 digits, a hyphen, 2 digits, a hyphen, and 4 digits; and example would be \* \* \* - \* \* - \* \* \* \* ). This would allow me to discover instances where this type of information exists on an image (for cases where this type of information should not be present in a storage device). I wonder whether this might not already be possible, simply by properly formatting the keyword, but I cannot seem to find any documentation that would clarify whether or not this is possible, nor if so, how. I look forward to the prospect of this becoming a feature in the future. Thanks!

---

<div class="post-metadata">

**Author:** ![Richard\_Cordovano](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/richard_cordovano/32/15_2.png) [@Richard\_Cordovano](https://sleuthkit.discourse.group/u/Richard_Cordovano)\
**Post date:** [June 12, 2019, 9:20pm UTC](https://sleuthkit.discourse.group/t/keyword-search-for-variable-values-in-a-pattern/110/2 "2019-06-12T21:20:10Z")

</div>

This feature already exists. You can configure a keyword list with a keyword that is a regular expression and run the keyword search ingest module with this list selected:

 ![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/1X/b4b1437832a71b58afabe2d94e8a2f7847d79862.png)

You can also choose to do an “ad hoc” search outside of ingest using the list or a regex defined on the fly:

![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/1X/efa92556266b300a07be24efbf27299d1a83a662.png)

Please consult [http://sleuthkit.org/autopsy/docs/user-docs/4.11.0/ad\_hoc\_keyword\_search\_page.html#ad\_hoc\_kw\_types\_section](http://sleuthkit.org/autopsy/docs/user-docs/4.11.0/ad_hoc_keyword_search_page.html#ad_hoc_kw_types_section) for details on regular expression syntax.