Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

$Filename Attribute Dates of tagged file(s)

This EnScript will display the (8) eight NTFS time-stamps associated with each tagged file/folder in EnCase. The EnScript looks specifically for the "review" tag and displays the four common time-stamps that are from the Standard Information Attribute (same ones EnCase shows in the table pane). In addition, the four time-stamps stored in the $FILENAME attribute are also displayed for comparison and to help determine if any time-stamp altering tools may have been used.

This EnScript will print out the four (Created, Accessed, Written, Entry Modified) date fields in the Filename Atttribute along with those in the Standard Information Attribute for the purpose of comparing them as an indication that a time-altering tool may have been used.

This EnScript processes any file that is tagged with the "Review" tag and prints the information in the Console tab:

nacl64.exe
Standard Info Attribute Filename Attribute
11/05/12 05:20:20PM 11/05/12 06:20:20PM
10/24/12 12:04:51AM 11/05/12 06:20:20PM
11/05/12 05:20:20PM 11/05/12 06:20:20PM
11/05/12 05:20:20PM 11/05/12 06:20:20PM

Download Now



Version: 1
Tested with:
EnCase Forensic 7.06
Developer: Lance Mueller
Category: Utility

8680 DOWNLOADS

YOU MAY ALSO LIKE

Utility

Generic SQLite Database Parser

This script allows one or more pre-defined queries to be run across SQLite database files with names matching those specified.
By Simon Key
72 Downloads
App
Utility

Volatility Plugin

This EnScript is designed to facilitate easier use of Volatility in EnCase. It can be configured for any number of Volatility plugins and supports multithreading.
By Simon Key
60 Downloads
App
Utility

Case Analyzer and Sweep Enterprise Data Extraction

Use this script to batch-extract selected Case Analyzer and Sweep Enterprise reports to comma-delimited spreadsheets.
By Simon Key
54 Downloads
App
Utility

View SQLite With WAL Plugin

Allows SQLite database files to be opened in conjunction with any write-ahead log (WAL) file.
By Simon Key
51 Downloads
App