This is going to be difficult to do with Everything currently..
Example usage to find "Acoustid Id"
Code: Select all
"02 Skit 1.mp3" regex:binary:content:"\x41\x00\x63\x00\x6F\x00\x75\x00\x73\x00\x74\x00\x69\x00\x64\x00\x20\x00\x49\x00\x64\x00\x00\x00\xFF\xFE(.*?)\x00\x00"
regex: = enable regular expressions so we can capture the tag value.
binary: = treat the search and content as a byte stream.
content: = search for content
\x?? = the tag in hex
(.?*) = capture the UTF-16 text after the tag.
\x00\x00 = match the trailing double null terminator.
Use the Regex Match 1 column to view the capture.
Unfortunately, the captured text is treated as a byte stream, so you will see something like:
Code: Select all
0 4 c c b 3 e 9 - 9 c a f - 4 1 f f - a 1 7 2 - f 5 c 3 c 2 9 a 9 1 3 3
You could the right click this column and click find duplicates to find duplicated Acoustid Id.
I am working on a hexcontent: search function to treat content as a binary in hexidecimal values to make this easier to search and easier to read the regex captures.
I can successfully match content:"Acoustid Id"
This shouldn't match.
I was unable to produce this result my end.
The default iFilter for mp3 files should return the content as empty.
Could you please confirm content:"Acoustid Id" is matching this file.
contentw: or utf16becontent: will most likely not match because it will treat the entire content as UTF-16LE / UTF-16BE
These functions will not work because the header and tags are not word aligned.
I need a contentw+1: search function...