Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Known _met Search and Parse

This EnScript will search all tagged items for known.met record fragments from eMule 0.5. If these records are found it will parse the records and the output will be to a tab delimited file in the default case export folder for further analysis in Excel or other spreadsheet application.

This is designed to parse known .met records recovered from a search of tagged entries.  It was written based on the file tags used in the known.met from eMule version .50 MorphXT.  It is intended to be used to carve out known.met record fragments from unallocated or slack to 'Triage' eMule activity on the drive(s). Since Unallocated space or Slack space data can run into sector boundries or have data overwritten  the data reported may contain inaccurate information and must be confirmed by manual examination of the 'Hit' using the Hit File Name and Hit Offset information in the output file.  The output file will be located in the case Export Folder titled 'known_met Record Search Results.txt'. This file is in Tab Delimited format so that it can be opened with Excel or any other application that handles Tab Delimited files.

Download Now



Version: 1.0.0
Tested with:
EnCase Forensic 7.05
Developer: William Lynn
Category: Utility

3487 DOWNLOADS

YOU MAY ALSO LIKE

Utility

Registry Viewer Plugin

This script allows the examiner to to use a right-click context-menu-option or keyboard shortcut to view Registry hive files (SYSTEM, SOFTWARE, SECURITY, SAM, NTUSER,DAT, etc.).
By Simon Key
785 Downloads
App
Utility

Run Condition As Filter

This download consists two filters designed to make it easier to locate, edit, and launch conditions from multiple locations. They also make it easier to create modified copies of the conditions that ship with EnCase.
By Simon Key
350 Downloads
App
Utility

Export Result-Set to Project VIC

This script is designed to extract a user-specified result-set to a Project VIC data-set.
By Simon Key
32 Downloads
App
Utility

Multiple Date Range Filter - Entries Only (EnFilter)

This EnScript filter allows the examiner to show/hide entries using multiple date-ranges and one of four different logic options.
By Simon Key
27 Downloads
App