Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer
Enfuse 2018 | May 21- 24
Learn More

CD Image Loader Plugin

This plugin is designed to load the CD/DVD ISO images listed in a user-specified Windows text-file into the current case. The absolute path of each-image file should be listed one-per-line; each line being terminated by the Windows carriage-return line-feed sequence. Each file of a multipart image should be listed. The first file should have an 'iso' file-extension; second and subsequent files should have the extensions 'iso01' 'iso02' etc. The image files do not have to be listed in order, for instance all of the 'iso' files could be at the top of the list with the remainder following.

The script will take a number of steps to try and identify the parameters needed to correctly mount each image the first of which is to determine the presence of raw sector data as indicated by the presence of a 10-byte sync field defined by the CD-ROM yellow-book standard. If raw sector-data isn't detected then the script will assume that the image contains 2048-byte sectors with no error correction/detection data. If raw sector data is detected then the script will treat the image as one of two types depending on the mode-byte located in the sector-header: a yellow-book CD-ROM Mode 1 disk or a green-book CD-ROM XA Mode 2 Form 1 disk. Both of these contain 2352-byte sectors consisting of 2048-bytes of user-data plus 304-bytes of error detection/correction data. For CD-ROM Mode 1 disks 16 of these 304-bytes will be located before the 2048 data-bytes and 288-bytes afterwards. For CD-ROM XA Mode 2 disks there will be 24-bytes before and 280-bytes afterwards.

The script will consider an image not to be mounted correctly if it only contains a single 'Unallocated Clusters' object. In such cases the script will write a warning to the console window. It may still be possible to mount any such image by giving it a '.dmg' file-extension and then dragging and dropping it into EnCase.

The plugin runs in the foreground thread so you will not be able to perform any other tasks during processing. If you are planning to mount a large number of CD/DVD images then you are advised to test the operation of the script using an empty case first.

Note: EnCase will not allow duplicate images to be added to a case. If this happens the script will report the duplicate as having been added even though EnCase will have blocked it.

Download Now



Version: 5.0.1
Tested with:
EnCase Forensic 7.12
Developer: Simon Key
Category: Utility

503 DOWNLOADS

YOU MAY ALSO LIKE

Utility

ZIP Index Entry Finder

This EnScript will search for, and bookmark, ZIP-file index-entries. It was designed for the recovery of data from deleted ZIP files that can't otherwise be recovered, either because they're partially overwritten or fragmented.
By Simon Key
272 Downloads
App
Utility

Item Ancestor Resolution

This script allows the examiner to identify the ancestors (emails, etc.) of items in a given result-set so they can be bookmarked and/or extracted.
By Simon Key
268 Downloads
App
Utility

Flat File Export

This script is designed to copy tagged items into a single output-folder and report-on user-specified properties in the process.
By Simon Key
207 Downloads
App
Utility

Image Analyzer - 30 Day Free Trial

Free 30 day trial with unlimited image scans – download today and accelerate your investigation. Image Analyzer scans image files within entries and records to identify pornographic content.
By Image Analyzer
145 Downloads
App