Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

EnScript to send file metadata directly to Splunk

This EnScript was original designed to aid in the triage and processing of multiple hosts by multiple examiners while conducting Incident Response & Investigations and quickly collate all the data together. This can also be used to create simple timelines.

Imagine you work for a medium to large company and you have an incident that requires some immediate triage. "Triage" in this sense means that responders are going to need to connect, examine and evaluate several hosts to determine what is going on or what has happened. During this triage, it is likely that the examiner(s) are going to come across files/folders of interest that may need to be remembered, compared to other files found on other hosts and/or documented later.

This EnScript was designed to allow the examiner to simply "tag" those files/folders and send the data directly to To make this simple, you can easily setup your own IR/Investigative instance of Splunk that can digest up to 500MB of data daily, for free. The idea is to let each examiner dig through images/drives and quickly tag things of interest. All the data is sent to Splunk so it can easily be overlaid on top of other data and shown in relation to other hosts. This allows analysts to query and build real-time reports in Splunk while the triage is still happening.

Download Now

Version: 1
Tested with:
EnCase Forensic 7.06
Developer: Lance Mueller
Category: Incident Response



Incident Response


Process Windows, Linux, and OS X memory images and find running processes, parents, create dates, and more.
By Casimer Szyper
Incident Response

Hacker Offender

This App is designed to discover files that are hidden by rootkits. It will place all detected files into a LEF for further analysis. This may include the malware and additional files deemed important by the attacker.
By James Habben
Incident Response

Volatility Reporting Plugin

Volatility 2.4 Standalone executable integration with EnCase for centralized reporting of memory forensic results through the use of bookmarks.
By John Lukach
Incident Response

Team Cymru Malware Hash Registry Search

Review evidence files to assist in learning if any might correspond to malware.
By Jeffrey Savoy