How to apply new REGEX patterns to previously processed evidence?

[RamiroMarinB]

Hello everyone,

I’m currently working on a forensic project involving the analysis of data from mobile phones and computers using IPED. During the initial phase, I created and added a set of custom regular expressions (REGEX), which successfully yielded relevant hits.

After reviewing the results, I’ve identified new patterns that I would now like to search for in the same data (i.e., new REGEX patterns).
Is there a way to apply these new REGEX patterns to the evidence that has already been processed—without having to reprocess the entire dataset from scratch?
Or alternatively,
Is it necessary to reprocess all the evidence again in order to include the new REGEX?

Any advice or experience you can share would be greatly appreciated!

[wladimirleite]

Hi @RamiroMarinB!
Unfortunately, currently this is not possible.
There is an open issue of a new feature that would allow doing what you want:
#24

[RamiroMarinB]

Thank you for the prompt response!

I truly appreciate the clarification. While it’s a bit limiting not to be able to apply new REGEX patterns to already processed evidence, I fully understand the current architecture and workflow.

That said, I’d like to highlight how powerful and functional IPED is—it’s been an invaluable tool in our forensic investigations. Its flexibility, performance, and range of features make it a top-tier solution in the DFIR field.

Hopefully, in future versions, features like reprocessing specific modules (e.g., REGEX) over already indexed data might be considered. It would certainly enhance efficiency in iterative forensic workflows.

Thanks again to the development team and community for your continued support and for making such a solid tool available.

best,

Ramiro

[lfcnassif]

Complementing @wladimirleite's answer, you can execute regex searches on the fly using the search box, but just alphanumeric chars are accepted, because just them are indexed by default. To flag a search is a regex search, start it and end it with forward slashes.

If you add additional special characters like -_@.$%: etc into conf/IndexTaskConfig.txt->extraCharsToIndex option before processing, you will be able to execute any regex search, using the specified chars, on the fly in the search box.

But, be aware the search behavior will change considerably. By default, if you search for john, IPED will return hits like john@gmail.com, john.smith or john-smith. However, when indexing @ - . chars, searching for john will stop returning those hits, you will have to search for john*, which can bring other undesired hits, like johnathan and johnson.

[lfcnassif]

Even worse, you will start missing hits like smith.john or smith-john. I don't recommend searching for *john to get those hits again, it makes no sense starting an indexed search with *, it will take a lot of time and will use a lot of memory, possibly hitting OOM and crashing the application. I just suggest starting a search with * when searching into specific fields, like name or path, do not use it to search into file content.

[RamiroMarinB]

I sincerely appreciate the suggestions shared. They are very valuable, and I will definitely explore the proposed alternatives to adapt my workflow and make the most of IPED's current capabilities.

Ramiro

[milcent]

@RamiroMarinB , the idea of reprocessing specific modules is really interesting!