Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Binary Plist Finder

This script searches specified items for binary plist files. It was designed primarily to recover such files from unallocated clusters.

Output is via bookmarks and a logical evidence file (LEF). The LEF can be brought-back into EnCase and its contents examined using the Plist Parser or Plist Viewer EnScripts. It may also be possible to process the LEF in order to recover Mac OS X related artifacts such as Safari Internet history and bookmarks.

The script works by using a basic search-term to locate deleted plists in each of the records/entries it has been told to search.

Before each entry/item is searched its path will be written to the console. The search will then be performed and the status-bar updated to reflect the progress that's been made. At the conclusion of each search the script will write the number of hits that have been found, reset the status bar and then attempt to verify each hit. The status bar will then be used to represent the progress of the hit-validation process.

The examiner should expect to find many thousands of hits particularly when searching the unallocated clusters of a Mac OS X system volume. Once the script has finished processing, the examiner can use a raw keyword search to identify plist files of particular note.

The script provides the option to de-duplicate the plist files that it finds. It will also skip plist files that it finds in other plist files. Due to the way in which it works, the script accomplishes the latter by processing the hits it finds in each file in reverse order. The examiner might need to bear this in mind when reviewing hits that have been bookmarked.

Download Now



Version: 4.2
Tested with:
EnCase Forensic 8.07
Developer: Simon Key
Category: Artifact

8170 DOWNLOADS

YOU MAY ALSO LIKE

Artifact

WebCacheV01.dat Internet History Decoder

This EnScript parses Internet history data from WebCacheV01.dat files. This includes the Internet history data generated by the Microsoft Internet Explorer and Edge web-browser programs.
By Simon Key
9646 Downloads
App
Artifact

ShellBags Parser

Parses recent-folder view settings maintained by the Microsoft Windows operating system.
By Simon Key
908 Downloads
App
Artifact

User Assist Registry Value Decoder

Decodes data used by the Microsoft Windows operating system to populate each user's start menu with frequently used applications.
By Simon Key
669 Downloads
App
Artifact

Windows Search Application Data Parser

This script parses data maintained by the Windows search function relating to recently-used applications and documents
By Simon Key
571 Downloads
App