Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer
Enfuse 2018 | May 21- 24
Learn More

EnScript to send file metadata directly to Splunk

This EnScript was original designed to aid in the triage and processing of multiple hosts by multiple examiners while conducting Incident Response & Investigations and quickly collate all the data together. This can also be used to create simple timelines.

Imagine you work for a medium to large company and you have an incident that requires some immediate triage. "Triage" in this sense means that responders are going to need to connect, examine and evaluate several hosts to determine what is going on or what has happened. During this triage, it is likely that the examiner(s) are going to come across files/folders of interest that may need to be remembered, compared to other files found on other hosts and/or documented later.

This EnScript was designed to allow the examiner to simply "tag" those files/folders and send the data directly to To make this simple, you can easily setup your own IR/Investigative instance of Splunk that can digest up to 500MB of data daily, for free. The idea is to let each examiner dig through images/drives and quickly tag things of interest. All the data is sent to Splunk so it can easily be overlaid on top of other data and shown in relation to other hosts. This allows analysts to query and build real-time reports in Splunk while the triage is still happening.

Download Now



Version: 1
Tested with:
EnCase Forensic 7.06
Developer: Lance Mueller
Category: Incident Response

638 DOWNLOADS

YOU MAY ALSO LIKE

Incident Response

MemoryAnalysis

Process Windows, Linux, and OS X memory images and find running processes, parents, create dates, and more.
By Casimer Szyper
3052 Downloads
App
Incident Response

Volatility Reporting Plugin

Volatility 2.4 Standalone executable integration with EnCase for centralized reporting of memory forensic results through the use of bookmarks.
By John Lukach
1898 Downloads
App
Incident Response

Hacker Offender

This App is designed to discover files that are hidden by rootkits. It will place all detected files into a LEF for further analysis. This may include the malware and additional files deemed important by the attacker.
By James Habben
1048 Downloads
App
Incident Response

EnCase Integrated Threat Toolkit (EITT)

EnCase Integrated Threat Toolkit (EITT) is a GUI interface and aggregate for a number of EnCase® Enterprise functions and over 15 open source tools designed to assist in DFIR investigations.
By Guidance Software
1012 Downloads
App