Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Create LEF From Folders Using Logical and UNC Path

This script is designed to create an EnCase logical evidence file (LEF) from the contents of one or more folders specified by the user. Folders can be identified by logical or UNC paths.

The resultant LEF can be an L01 or Lx01 file. The script will set the appropriate type according to the file-extension set in the script-dialog.

The script will scan the contents of the chosen folders and  display a list of their contents. The user can then select the files they would like added to the LEF. Files with a non-null logical size will be pre-selected automatically.

The user also has the option of selecting items programmatically through the use of conditions, which can be saved for later use. The script can only use conditions created by itself: it can't use standard EnCase conditions.

When a condition is run it will replace any existing selection. The script will still show non-selected items so that the user can verify that the condition has worked as expected.

Note that folders can never be selected as individual items: folders will be added to the LEF automatically if they contain selected files.

Note that it may not be possible for EnCase to access UNC paths whilst running under User Account Control (UAC). This can apply even if the user running EnCase would normally have access to those folders.

For more information and a resolution for Windows Vista and Windows 7 see the following Microsoft Technet article -

Download Now

Version: 4.0
Tested with:
EnCase Forensic 8.07
Developer: Simon Key
Category: Utility




SQLite Blob Extractor

This script is designed to extract BLOB-data from SQLite database files.
By Simon Key

Volatility Plugin

This EnScript is designed to facilitate easier use of Volatility in EnCase. It can be configured for any number of Volatility plugins and supports multithreading.
By Simon Key

Registry Viewer Plugin

This script allows the examiner to to use a right-click context-menu-option or keyboard shortcut to view Registry hive files (SYSTEM, SOFTWARE, SECURITY, SAM, NTUSER,DAT, etc.).
By Simon Key

Run Condition As Filter

This download consists two filters designed to make it easier to locate, edit, and launch conditions from multiple locations. They also make it easier to create modified copies of the conditions that ship with EnCase.
By Simon Key