forensickb.com
Computer Forensics, Malware Analysis & Digital Investigations: Forensic Practical
http://www.forensickb.com/2008/01/forensic-practical.html
EnScript v6 Tutorial IV. EnScript v6 Tutorial I. EnScript v6 Tutorial II. EnScript v6 Tutorial III. EnScript v6 Tutorial IV. Large EnScript v6 PDF/Tutorial. Friday, January 18, 2008. The image is provided here. In the EnCase evidence format (400mb). A network capture in tcpdump format is provided here. Posted by Lance Mueller. At Friday, January 18, 2008. Saturday, 19 January, 2008. I'm curious.I haven't downloaded the image yet but is the Encase image a complete XP image? Saturday, 19 January, 2008.
forensickb.com
Computer Forensics, Malware Analysis & Digital Investigations: January 2014
http://www.forensickb.com/2014_01_01_archive.html
EnScript v6 Tutorial IV. EnScript v6 Tutorial I. EnScript v6 Tutorial II. EnScript v6 Tutorial III. EnScript v6 Tutorial IV. Large EnScript v6 PDF/Tutorial. Wednesday, January 29, 2014. EnCase EnScript (v6 and v7) to parse Skype chatsync files for IP addresses (internal and external) of each user. The beginning of a chatsync file will appear like this:. You can select (blue check) any/all chatsync files in EnCase v6 or 'tag" them with 'chatsync in EnCase v7 and run the below linked EnScript. This EnS...
forensickb.com
Computer Forensics, Malware Analysis & Digital Investigations: EnScript Tutorial - Part I
http://www.forensickb.com/2007/09/enscript-tutorial-part-i.html
EnScript v6 Tutorial IV. EnScript v6 Tutorial I. EnScript v6 Tutorial II. EnScript v6 Tutorial III. EnScript v6 Tutorial IV. Large EnScript v6 PDF/Tutorial. Tuesday, September 4, 2007. EnScript Tutorial - Part I. The purpose of this tutorial is to try and provide some basic concepts and instruction to an EnCase user who also does not have any programming experience so they can write some basic EnScripts and/or modify existing ones for a specific need. Void Main(CaseClass c) {. EnCase actually does some b...
forensickb.com
Computer Forensics, Malware Analysis & Digital Investigations: EnScript Tutorial Part III
http://www.forensickb.com/2007/10/enscript-tutorial-part-iii.html
EnScript v6 Tutorial IV. EnScript v6 Tutorial I. EnScript v6 Tutorial II. EnScript v6 Tutorial III. EnScript v6 Tutorial IV. Large EnScript v6 PDF/Tutorial. Sunday, October 28, 2007. EnScript Tutorial Part III. After being gone out of the country for nearly 6 weeks, I finally have some time to continue this tutorial. The next step is to use conditional control structures to select only certain files based on certain criteria. If (entry.Name() = "system"){. EnCase provides a few built-in functions to help...
forensickb.com
Computer Forensics, Malware Analysis & Digital Investigations: EnScript Tutorial IV
http://www.forensickb.com/2008/01/enscript-tutorial-iv.html
EnScript v6 Tutorial IV. EnScript v6 Tutorial I. EnScript v6 Tutorial II. EnScript v6 Tutorial III. EnScript v6 Tutorial IV. Large EnScript v6 PDF/Tutorial. Wednesday, January 16, 2008. It has been several weeks since my last EnScript Tutorial, so I decided it was time for the next installment in the EnScript tutorial series. In the last tutorial. The third line of code recurses through all the evidence loaded in EnCase in a loop. Line four compares the name of each object to see if the name matches ...
forensickb.com
Computer Forensics, Malware Analysis & Digital Investigations: EnCase v7 EnScript to create LEF based on condition
http://www.forensickb.com/2015/05/encase-v7-enscript-to-create-lef-based.html
EnScript v6 Tutorial IV. EnScript v6 Tutorial I. EnScript v6 Tutorial II. EnScript v6 Tutorial III. EnScript v6 Tutorial IV. Large EnScript v6 PDF/Tutorial. Sunday, May 10, 2015. EnCase v7 EnScript to create LEF based on condition. A reader recently asked if I could create an EnScript that would create a LEF based on a condition. Unfortunately, the reader wanted to use it with the free EnCase Imager program, which does not support creating LEFs or using the ConditionClass. Posted by Lance Mueller. Contac...
forensickb.com
Computer Forensics, Malware Analysis & Digital Investigations: CEIC 2015 - EnScripting for EnVestigators
http://www.forensickb.com/2015/05/ceic-2015-enscripting-for-envestigators.html
EnScript v6 Tutorial IV. EnScript v6 Tutorial I. EnScript v6 Tutorial II. EnScript v6 Tutorial III. EnScript v6 Tutorial IV. Large EnScript v6 PDF/Tutorial. Thursday, May 21, 2015. CEIC 2015 - EnScripting for EnVestigators. Below is a link to the slides from my presentation at CEIC 2015, as well as some example EnScripts. Posted by Lance Mueller. At Thursday, May 21, 2015. Subscribe to: Post Comments (Atom). EnCase v7 EnScript to check files to VirusTotal - . CEIC 2015 - EnScripting for EnVestigators.
forensickb.com
Computer Forensics, Malware Analysis & Digital Investigations: EnCase v7 EnScript to Parse PST Email Metadata to Excel
http://www.forensickb.com/2015/05/encase-v7-enscript-to-parse-pst-email.html
EnScript v6 Tutorial IV. EnScript v6 Tutorial I. EnScript v6 Tutorial II. EnScript v6 Tutorial III. EnScript v6 Tutorial IV. Large EnScript v6 PDF/Tutorial. Tuesday, May 5, 2015. EnCase v7 EnScript to Parse PST Email Metadata to Excel. But he wanted a way to quickly show some of the common fields, including attachments, in a spreadsheet. This EnScript grabs some of the common fields and builds an Excel spreadsheet automatically:. Posted by Lance Mueller. At Tuesday, May 05, 2015. Thursday, 07 May, 2015.
forensickb.com
Computer Forensics, Malware Analysis & Digital Investigations: August 2014
http://www.forensickb.com/2014_08_01_archive.html
EnScript v6 Tutorial IV. EnScript v6 Tutorial I. EnScript v6 Tutorial II. EnScript v6 Tutorial III. EnScript v6 Tutorial IV. Large EnScript v6 PDF/Tutorial. Monday, August 18, 2014. EnCase v7 EnScript to find files based on MD5 hash values. I had written a version of this years ago for EnCase v6 and I was recently asked to update it for EnCase v7. Any files found that match the size/hash value in the specified text file are bookmarked for later review/export. Download v7 EnScript to do comparison. All th...
forensickb.com
Computer Forensics, Malware Analysis & Digital Investigations: March 2014
http://www.forensickb.com/2014_03_01_archive.html
EnScript v6 Tutorial IV. EnScript v6 Tutorial I. EnScript v6 Tutorial II. EnScript v6 Tutorial III. EnScript v6 Tutorial IV. Large EnScript v6 PDF/Tutorial. Thursday, March 20, 2014. EnCase EnScript to show file summary of user's profile by extension. Download EnCase v6 EnScript Here. Posted by Lance Mueller. At Thursday, March 20, 2014. Wednesday, March 19, 2014. EnCase EnScript to parse each NTUSER.DAT for RecentDocs. HKEY CURRENT USER Software Microsoft Windows CurrentVersion Explorer RecentDocs.
