Every resident and citizen in the state of Qatar is issued an eleven-digit Qatari ID number, the logic of those eleven numbers are as follows:
A list of all country codes could be found here., in addition to those, the state of Qatar utilizes (user-assigned) codes to address special requirements … the full list of valid codes are listed in the regex(es) below…
The Regular Expression
Simple regex
The regex could be as simple as
(2|3)\d{10}
Which means:
- `(2|3)` -> either a “2 or 3”
- `\d` -> a Digit
- `{10}` -> repeat the preceding 10 times (the single `\d` digit in our case)
So, it’s either a 2 or 3 followed by 10 digits:
Problem with that is it is going to match invalid country codes (like 2819950000 in this example).
Accurate(err) regex
One way to avoid matching invalid QID, is to include all valid country codes in the regex itself … it will take considerably longer time to process, but will reduce false positives
(2|3)\d{2}(000|004|008|012|016|020|024|028|031|032|036|040|044|048|050|051|052|056|060|064|068|072|074|076|080|084|086|090|092|096|100|101|104|108|112|116|120|124|132|136|140|144|148|152|156|162|166|170|174|175|178|180|184|188|191|192|196|200|204|208|212|214|218|222|226|230|233|234|238|242|246|248|250|254|258|262|266|268|270|280|288|292|296|300|304|308|312|316|320|324|328|332|334|336|340|344|348|352|356|360|364|368|372|376|380|384|388|392|396|398|400|404|408|410|414|417|418|422|426|428|430|434|438|440|442|446|450|454|458|462|466|470|474|478|480|484|488|492|496|498|499|500|504|508|512|516|520|524|528|532|533|540|544|548|554|558|562|566|570|574|578|580|582|583|584|585|586|590|598|600|604|608|612|616|620|624|626|630|634|638|642|643|646|652|654|658|659|660|662|663|666|670|674|678|682|686|688|690|694|702|703|704|705|706|710|716|724|728|732|736|740|744|748|752|756|760|762|764|768|772|776|780|784|788|792|795|796|798|800|804|807|810|818|826|830|831|832|833|834|840|850|854|858|860|862|872|876|882|886|888|890|891|894|901|981|983|990|991|999)\d{5}
which means:
- `(2|3)` -> either a “2 or 3”
- `\d{2}` -> a two digit number “year of birth”
- `(000|004|…..)` -> Any valid country code
- `\d{5}` -> any five digits
Now invalid country ID is not matched anymore:
Adding the Qatari ID Regex to EnCase
Open “Case Processor”, click on “Personal Information”
Go to the “Government ID” tab, click “New”
A very important note!
In EnCase, as explained in the screenshot, the `hash` sign `#` is used to indicate a general number `we used \d in the standard regex example` … so we change our regex accordingly “please note that (2|3) is exactly the same as [23]”.
The problem with EnCase! [Check updates below]
EnCase only supports regex’es with a maximum of 254 characters … so the long, more accurate regex explained earlier won’t fit
So, we will have to “split” that one into FIVE separate pieces … then search for all of them.
[23]#{2}(000|004|008|012|016|020|024|028|031|032|036|040|044|048|050|051|052|056|060|064|068|072|074|076|080|084|086|090|092|096|100|101|104|108|112|116|120|124|132|136|140|144|148|152|156|162|166|170|174|175|178|180|184|188|191|192|196|200|204)#{5}
[23]#{2}(208|212|214|218|222|226|230|233|234|238|242|246|248|250|254|258|262|266|268|270|280|288|292|296|300|304|308|312|316|320|324|328|332|334|336|340|344|348|352|356|360|364|368|372|376|380|384|388|392|396|398|400|404|408|410|414|417|418|422)#{5}
[23]#{2}(426|428|430|434|438|440|442|446|450|454|458|462|466|470|474|478|480|484|488|492|496|498|499|500|504|508|512|516|520|524|528|532|533|540|544|548|554|558|562|566|570|574|578|580|582|583|584|585|586|590|598|600|604|608|612|616|620|624|626)#{5}
[23]#{2}(630|634|638|642|643|646|652|654|658|659|660|662|663|666|670|674|678|682|686|688|690|694|702|703|704|705|706|710|716|724|728|732|736|740|744|748|752|756|760|762|764|768|772|776|780|784|788|792|795|796|798|800|804|807|810|818|826|830|831)#{5}
[23]#{2}(832|833|834|840|850|854|858|860|862|872|876|882|886|888|890|891|894|901|981|983|990|991|999)#{5}
This will take ages if run against the whole case 🙂 you might want to run the case processor only against selected files.
EDIT 2015-02-16 06:04
Whoa! it turned out that EnCase supports only regex with max of 254 characters!!! (I’m using v7.10.3) … contacting guidance software and will write back the result.
EDIT 2015-02-16 12:44
It’s official … EnCase only supports 254-length regex … hope they `fix` that limit soon.
I came up with the previous solution rather than the gentlemen’s suggestion, which worked just fine.