Are there options to restrict search space (i.e. limit data sources that could potentially contaminate an investigation)?
And if so, is that a common practice, or is it more typical to search through all avaliable data for anything potentially useful and weed out later?