Keyword Search now runs straight from Shield's touchscreen. Pick a source drive, tell it what you're looking for, and decide where it should look.
You can type your own keywords, select one or more saved keyword lists, or do both at once. That's the combination I'd use most: a standard list for routine terms, plus a name, email address, or case-specific reference you only need this one time. Saved lists are built and kept current in the Network Dashboard, so you're not retyping the same terms onto every drive.
Search scope is a separate choice from search terms. You can look at filenames and their recorded paths, file contents, or both.
Filename searching is quick.
Content searching takes longer, and it can turn up terms that never show up in a name — depending on the file's format and whether the text underneath is still readable. Case-sensitive matching and regular expressions help when a plain keyword isn't specific enough.
You can narrow things further before running it. Search every scanned partition or just a few, include or exclude extensions with a saved list, cap the file size, and control whether binary files get scanned at all. Narrower runs faster, but anything excluded could be exactly where the hit was.
A handful of advanced options reach further: into some archive and document formats, compressed content, and alternate text encodings, into deleted-file entries the scan already flagged, and into unallocated space on supported partitions. This touchscreen workflow doesn't cover APFS unallocated space. What any of it turns up still depends on the format and on whether the underlying data is still intact.
Keyword Search matches text and patterns. It doesn't do OCR and it doesn't interpret what a document means, so a term that exists only inside an image won't turn up. Searching deleted entries or unallocated space doesn't guarantee the deleted material is actually there to find.
Once the search finishes, the real work happens in the Network Dashboard. Each hit shows the matched term, the file path, how many times it hit, the offset, and the surrounding context, so you can tell whether a file is worth opening before you open it. You can export results as CSV, JSON, or TXT, or extract the matching files straight out of the dashboard for a closer look.
Content search is the slower option. It's also the one that finds what filename search missed — when the format cooperates.