Hi,
It´s possible to create a word list and remove windows system files from the search?
Thanks
No you can’t specify which files to run on in the word list. You might be able to use a file filter: http://sleuthkit.org/autopsy/docs/user-docs/4.16.0/ingest_page.html#file_filters
It’s going to be a bit tricky since a filter is generally saying what to include not exclude, but it might be possible to do a negative in a path substring regex.
Keyword search does not index “known” files by default. You could use the NSRL or create your own hash set to prevent the system files from being indexed and therefore excluded from search results.
http://sleuthkit.org/autopsy/docs/user-docs/4.16.0/keyword_search_page.html#generalSettingsTab
http://sleuthkit.org/autopsy/docs/user-docs/4.16.0/hash_db_page.html