Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Create LEF From Folders Using Logical and UNC Path

This script is designed to create an EnCase logical evidence file (LEF) from the contents of one or more folders specified by the user.

Folders can be identified by logical or UNC paths, which can be passed via the command-line if so desired. This can be achieved by creating a Windows shortcut to EnCase, one set to run the script using the '-r' and '-min' command-line switches. Please see the following Twitter post for more details:

The resultant LEF can be an L01 or Lx01 file. The script will set the appropriate type according to the file-extension set in the script-dialog.

The script will scan the contents of the chosen folders and display a list of their contents. The user can then select the files they would like added to the LEF. Files with a non-null logical size will be pre-selected automatically.

The user also has the option of selecting items programmatically through the use of conditions, which can be saved for later use. The script can only use conditions created by itself: it can't use standard EnCase conditions.

When a condition is run it will replace any existing selection. The script will still show non-selected items so that the user can verify that the condition has worked as expected.

Note that folders can never be selected as individual items: folders will be added to the LEF automatically if they contain selected files.

Note that it may not be possible for EnCase to access UNC paths whilst running under User Account Control (UAC). This can apply even if the user running EnCase would normally have access to those folders.

For more information and a resolution for Windows Vista and Windows 7, please see the following Microsoft Technet article:

Download Now

Version: 5.0
Tested with:
EnCase Forensic 8.09
Developer: Simon Key
Category: Utility




Run Condition As Filter

This download consists two filters designed to make it easier to locate, edit, and launch conditions from multiple locations. They also make it easier to create modified copies of the conditions that ship with EnCase.
By Simon Key

Export Result-Set to Project VIC

This script is designed to extract a user-specified result-set to a Project VIC data-set.
By Simon Key

Microsoft Word ASD Document Viewer

This EnScript plugin allows Autosave Document (ASD) files to be extracted and opened with Microsoft Word.
By Simon Key

Multiple Date Range Filter - Entries Only (EnFilter)

This EnScript filter allows the examiner to show/hide entries using multiple date-ranges and one of four different logic options.
By Simon Key