Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer
Enfuse 2018 | May 21- 24
Learn More

$Filename Attribute Dates of tagged file(s)

This EnScript will display the (8) eight NTFS time-stamps associated with each tagged file/folder in EnCase. The EnScript looks specifically for the "review" tag and displays the four common time-stamps that are from the Standard Information Attribute (same ones EnCase shows in the table pane). In addition, the four time-stamps stored in the $FILENAME attribute are also displayed for comparison and to help determine if any time-stamp altering tools may have been used.

This EnScript will print out the four (Created, Accessed, Written, Entry Modified) date fields in the Filename Atttribute along with those in the Standard Information Attribute for the purpose of comparing them as an indication that a time-altering tool may have been used.

This EnScript processes any file that is tagged with the "Review" tag and prints the information in the Console tab:

nacl64.exe
Standard Info Attribute Filename Attribute
11/05/12 05:20:20PM 11/05/12 06:20:20PM
10/24/12 12:04:51AM 11/05/12 06:20:20PM
11/05/12 05:20:20PM 11/05/12 06:20:20PM
11/05/12 05:20:20PM 11/05/12 06:20:20PM

Download Now



Version: 1
Tested with:
EnCase Forensic 7.06
Developer: Lance Mueller
Category: Utility

1005 DOWNLOADS

YOU MAY ALSO LIKE

Utility

Image Analyzer - 30 Day Free Trial

Free 30 day trial with unlimited image scans – download today and accelerate your investigation. Image Analyzer scans image files within entries and records to identify pornographic content.
By Image Analyzer
145 Downloads
App
Utility

Item Ancestor Resolution

This script allows the examiner to identify the ancestors (emails, etc.) of items in a given result-set so they can be bookmarked and/or extracted.
By Simon Key
69 Downloads
App
Utility

ZIP Index Entry Finder

This EnScript will search for, and bookmark, ZIP-file index-entries. It was designed for the recovery of data from deleted ZIP files that can't otherwise be recovered, either because they're partially overwritten or fragmented.
By Simon Key
65 Downloads
App
Utility

Flat File Export

This script is designed to copy tagged items into a single output-folder and report-on user-specified properties in the process.
By Simon Key
53 Downloads
App