Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

$Filename Attribute Dates of tagged file(s)

This EnScript will display the (8) eight NTFS time-stamps associated with each tagged file/folder in EnCase. The EnScript looks specifically for the "review" tag and displays the four common time-stamps that are from the Standard Information Attribute (same ones EnCase shows in the table pane). In addition, the four time-stamps stored in the $FILENAME attribute are also displayed for comparison and to help determine if any time-stamp altering tools may have been used.

This EnScript will print out the four (Created, Accessed, Written, Entry Modified) date fields in the Filename Atttribute along with those in the Standard Information Attribute for the purpose of comparing them as an indication that a time-altering tool may have been used.

This EnScript processes any file that is tagged with the "Review" tag and prints the information in the Console tab:

nacl64.exe
Standard Info Attribute Filename Attribute
11/05/12 05:20:20PM 11/05/12 06:20:20PM
10/24/12 12:04:51AM 11/05/12 06:20:20PM
11/05/12 05:20:20PM 11/05/12 06:20:20PM
11/05/12 05:20:20PM 11/05/12 06:20:20PM

Download Now



Version: 1
Tested with:
EnCase Forensic 7.06
Developer: Lance Mueller
Category: Utility

6084 DOWNLOADS

YOU MAY ALSO LIKE

Utility

Run Condition As Filter

This download consists two filters designed to make it easier to locate, edit, and launch conditions from multiple locations. They also make it easier to create modified copies of the conditions that ship with EnCase.
By Simon Key
441 Downloads
App
Utility

Multiple Date Range Filter - Entries Only (EnFilter)

This EnScript filter allows the examiner to show/hide entries using multiple date-ranges and one of four different logic options.
By Simon Key
106 Downloads
App
Utility

Export Result-Set to Project VIC

This script is designed to extract a user-specified result-set to a Project VIC data-set.
By Simon Key
101 Downloads
App
Utility

Microsoft Word ASD Document Viewer

This EnScript plugin allows Autosave Document (ASD) files to be extracted and opened with Microsoft Word.
By Simon Key
47 Downloads
App