Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

CD Image Loader Plugin

This plugin is designed to load the CD/DVD ISO images listed in a user-specified Windows text-file into the current case. The absolute path of each-image file should be listed one-per-line; each line being terminated by the Windows carriage-return line-feed sequence. Each file of a multipart image should be listed. The first file should have an 'iso' file-extension; second and subsequent files should have the extensions 'iso01' 'iso02' etc. The image files do not have to be listed in order, for instance all of the 'iso' files could be at the top of the list with the remainder following.

The script will take a number of steps to try and identify the parameters needed to correctly mount each image the first of which is to determine the presence of raw sector data as indicated by the presence of a 10-byte sync field defined by the CD-ROM yellow-book standard. If raw sector-data isn't detected then the script will assume that the image contains 2048-byte sectors with no error correction/detection data. If raw sector data is detected then the script will treat the image as one of two types depending on the mode-byte located in the sector-header: a yellow-book CD-ROM Mode 1 disk or a green-book CD-ROM XA Mode 2 Form 1 disk. Both of these contain 2352-byte sectors consisting of 2048-bytes of user-data plus 304-bytes of error detection/correction data. For CD-ROM Mode 1 disks 16 of these 304-bytes will be located before the 2048 data-bytes and 288-bytes afterwards. For CD-ROM XA Mode 2 disks there will be 24-bytes before and 280-bytes afterwards.

The script will consider an image not to be mounted correctly if it only contains a single 'Unallocated Clusters' object. In such cases the script will write a warning to the console window. It may still be possible to mount any such image by giving it a '.dmg' file-extension and then dragging and dropping it into EnCase.

The plugin runs in the foreground thread so you will not be able to perform any other tasks during processing. If you are planning to mount a large number of CD/DVD images then you are advised to test the operation of the script using an empty case first.

Note: EnCase will not allow duplicate images to be added to a case. If this happens the script will report the duplicate as having been added even though EnCase will have blocked it.

Download Now



Version: 5.0.1
Tested with:
EnCase Forensic 7.12
Developer: Simon Key
Category: Utility

5909 DOWNLOADS

YOU MAY ALSO LIKE

Utility

Generic SQLite Database Parser

This script allows one or more pre-defined queries to be run across SQLite database files with names matching those specified.
By Simon Key
72 Downloads
App
Utility

Volatility Plugin

This EnScript is designed to facilitate easier use of Volatility in EnCase. It can be configured for any number of Volatility plugins and supports multithreading.
By Simon Key
60 Downloads
App
Utility

Case Analyzer and Sweep Enterprise Data Extraction

Use this script to batch-extract selected Case Analyzer and Sweep Enterprise reports to comma-delimited spreadsheets.
By Simon Key
54 Downloads
App
Utility

View SQLite With WAL Plugin

Allows SQLite database files to be opened in conjunction with any write-ahead log (WAL) file.
By Simon Key
51 Downloads
App