Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

CD Image Loader Plugin

This plugin is designed to load the CD/DVD ISO images listed in a user-specified Windows text-file into the current case. The absolute path of each-image file should be listed one-per-line; each line being terminated by the Windows carriage-return line-feed sequence. Each file of a multipart image should be listed. The first file should have an 'iso' file-extension; second and subsequent files should have the extensions 'iso01' 'iso02' etc. The image files do not have to be listed in order, for instance all of the 'iso' files could be at the top of the list with the remainder following.

The script will take a number of steps to try and identify the parameters needed to correctly mount each image the first of which is to determine the presence of raw sector data as indicated by the presence of a 10-byte sync field defined by the CD-ROM yellow-book standard. If raw sector-data isn't detected then the script will assume that the image contains 2048-byte sectors with no error correction/detection data. If raw sector data is detected then the script will treat the image as one of two types depending on the mode-byte located in the sector-header: a yellow-book CD-ROM Mode 1 disk or a green-book CD-ROM XA Mode 2 Form 1 disk. Both of these contain 2352-byte sectors consisting of 2048-bytes of user-data plus 304-bytes of error detection/correction data. For CD-ROM Mode 1 disks 16 of these 304-bytes will be located before the 2048 data-bytes and 288-bytes afterwards. For CD-ROM XA Mode 2 disks there will be 24-bytes before and 280-bytes afterwards.

The script will consider an image not to be mounted correctly if it only contains a single 'Unallocated Clusters' object. In such cases the script will write a warning to the console window. It may still be possible to mount any such image by giving it a '.dmg' file-extension and then dragging and dropping it into EnCase.

The plugin runs in the foreground thread so you will not be able to perform any other tasks during processing. If you are planning to mount a large number of CD/DVD images then you are advised to test the operation of the script using an empty case first.

Note: EnCase will not allow duplicate images to be added to a case. If this happens the script will report the duplicate as having been added even though EnCase will have blocked it.

Download Now

Version: 5.0.1
Tested with:
EnCase Forensic 7.12
Developer: Simon Key
Category: Utility




Run Condition As Filter

This download consists two filters designed to make it easier to locate, edit, and launch conditions from multiple locations. They also make it easier to create modified copies of the conditions that ship with EnCase.
By Simon Key

Export Result-Set to Project VIC

This script is designed to extract a user-specified result-set to a Project VIC data-set.
By Simon Key

Microsoft Word ASD Document Viewer

This EnScript plugin allows Autosave Document (ASD) files to be extracted and opened with Microsoft Word.
By Simon Key

Multiple Date Range Filter - Entries Only (EnFilter)

This EnScript filter allows the examiner to show/hide entries using multiple date-ranges and one of four different logic options.
By Simon Key