Using the Distributed Forensic Search wizard

Omnipeek User Guide

Introduction
Using Capture Engines with Omnipeek
The Capture Window
Dashboards
Viewing and Decoding Packets
Creating and Using Filters
Post-capture Analysis
- About post-capture analysis
- Saving packets
- Copying selected packets to a new window
- Hiding and unhiding packets
- Selecting related packets
- Label selected packets
- Finding strings in packets
- Selecting packets matching user-defined criteria
- Forensic search from the Files tab
- Forensic search from the Forensics tab
- Forensic search from the ‘Forensics Capture’ window
- Using the Distributed Forensic Search wizard
  Time range & filter Engines Capture sessions Search and Download Progress Merge Merge Progess
Expert Analysis
Multi-Segment Analysis
Web Analysis
Voice & Video Analysis
Displaying and Reporting Statistics
Using the Peer Map
Creating Graphs
Setting Alarms and Triggers
Sending Notifications
Using the Name Table
Viewing Logs and Events
Applying Analysis Modules
Configuring Options
Capturing Data for Wireless Analysis
Configuring capture adapters
Omnipeek Remote Assistant
Global Positioning System
Menus and Keyboard Shortcuts
Reference
Analysis Modules
Expert Events
Real-World Security Investigations
Connecting to a Capture Engine

Omnipeek: Omnipeek User GuideDownload PDF

Post-capture Analysis : Using the Distributed Forensic Search wizard

The Distributed Forensic Search wizard lets you perform a forensic search across multiple Capture Engines, download packet files from selected Capture Engines, and then combine the downloaded packet files into a single larger merged packet file.

To access the Distributed Forensic Search wizard:

• On the Tools menu, click Distributed Forensic Search…. The Time Range & Filter dialog of the Distributed Forensic Search wizard appears. See Time range & filter.

Forensic search from the ‘Forensics Capture’ window Time range & filter