Question
What does the "Accumulate Results" option for "Index Search" accomplish?
Understanding “Accumulate Results”
The “Accumulate Results” checkbox in the Index Search can be confusing to users. “Accumulate Results” doesn’t actually have any affect on a search, but simply provides a quick preview to users to let them know how many hits/results to expect from a search. This way, a user can see before hitting “Search Now” that their search will have 5000+ hits and their search may take a while to complete and populate in the FTK GUI.
The following example will explain what “Accumulate Results” is doing, using these 3 text files:
Our index will show that we have 5 total hits (in 3 documents) for the word “cat”, and 3 hits (in 2 documents) for the word “dog”. As the Search Terms window show hits rather than document matches, FTK will look like the following after adding both of these terms:
If we were to perform this search (cat AND dog), our search results would display the following:
We can see now that there are 2 documents that contain both “cat” and “dog”, resulting in 6 hits (1 instance of “cat” and 2 instances of “dog” in 2.txt + 2 instance of “cat” and 1 instance of “dog” in 3.txt = 6 instances of either word).
“Accumulate Results” simply shows the number of hits (not the number of documents) that a search will produce in the “Search Terms” box before the search actually happens, so checking “Accumulate Results” in the previous search would display the following:
Now we know that our end result of the search will have 6 total hits:
The most important thing to remember is that “Accumulate Results” does not change your search at all. It just lets you see how many hits will result from your search before actually performing the search.