Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

CD Image Loader Plugin

This plugin is designed to load the CD/DVD ISO images listed in a user-specified Windows text-file into the current case. The absolute path of each-image file should be listed one-per-line; each line being terminated by the Windows carriage-return line-feed sequence. Each file of a multipart image should be listed. The first file should have an 'iso' file-extension; second and subsequent files should have the extensions 'iso01' 'iso02' etc. The image files do not have to be listed in order, for instance all of the 'iso' files could be at the top of the list with the remainder following.

The script will take a number of steps to try and identify the parameters needed to correctly mount each image the first of which is to determine the presence of raw sector data as indicated by the presence of a 10-byte sync field defined by the CD-ROM yellow-book standard. If raw sector-data isn't detected then the script will assume that the image contains 2048-byte sectors with no error correction/detection data. If raw sector data is detected then the script will treat the image as one of two types depending on the mode-byte located in the sector-header: a yellow-book CD-ROM Mode 1 disk or a green-book CD-ROM XA Mode 2 Form 1 disk. Both of these contain 2352-byte sectors consisting of 2048-bytes of user-data plus 304-bytes of error detection/correction data. For CD-ROM Mode 1 disks 16 of these 304-bytes will be located before the 2048 data-bytes and 288-bytes afterwards. For CD-ROM XA Mode 2 disks there will be 24-bytes before and 280-bytes afterwards.

The script will consider an image not to be mounted correctly if it only contains a single 'Unallocated Clusters' object. In such cases the script will write a warning to the console window. It may still be possible to mount any such image by giving it a '.dmg' file-extension and then dragging and dropping it into EnCase.

The plugin runs in the foreground thread so you will not be able to perform any other tasks during processing. If you are planning to mount a large number of CD/DVD images then you are advised to test the operation of the script using an empty case first.

Note: EnCase will not allow duplicate images to be added to a case. If this happens the script will report the duplicate as having been added even though EnCase will have blocked it.

Download Now



Version: 5.0.1
Tested with:
EnCase Forensic 7.12
Developer: Simon Key
Category: Utility

6120 DOWNLOADS

YOU MAY ALSO LIKE

Utility

SQLite Blob Extractor

This script is designed to extract BLOB-data from SQLite database files.
By Simon Key
219 Downloads
App
Utility

View SQLite With WAL Plugin

Allows SQLite database files to be opened in conjunction with any write-ahead log (WAL) file.
By Simon Key
126 Downloads
App
Utility

Volatility Plugin

This EnScript is designed to facilitate easier use of Volatility in EnCase. It can be configured for any number of Volatility plugins and supports multithreading.
By Simon Key
91 Downloads
App
Utility

Registry Viewer Plugin

This script allows the examiner to to use a right-click context-menu-option or keyboard shortcut to view Registry hive files (SYSTEM, SOFTWARE, SECURITY, SAM, NTUSER,DAT, etc.).
By Simon Key
50 Downloads
App