Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Utilities (aka Last Folder) Plugin

This EnScript plugin (formerly called the Last Folder Plugin) provides a number of utility functions.

Firstly, the plugin allows the examiner to use the menu or toolbar option, or the CTRL + SHIFT + L keyboard combination, to open the export-folder last-used by a script that is 'Last Folder' compatible.

Secondly, the plugin allows the examiner to use the menu or toolbar option, or the CTRL + SHIFT + E keyboard combination, to open the current case's export-folder.

The third function allows the examiner to select the contents of all blue-checked folders en masse.

Notwithstanding that this function can be used under quite a few tabs, it is particularly useful when the examiner wishes to select the attachments of email messages that are shown as selected in the table pane but not the tree pane. This can happen when the emails in question been located by other means (e.g., by using the Item Ancestor Resolution EnScript), added to a result-set, tagged, and then blue-checked.

The same result can be achieved manually, but it is less than ideal if the attachments are contained in a large number of emails.

Linked to the previous function, the fourth function allows the examiner to blue-check the email(s) containing selected attachments. Note that the script will select the first email it finds at a level above the attachment being processed. This function can only be used in the Artifacts view.

The last two functions are node-specific, i.e., they are activated by using the right-click context-menu. A restriction in EnScript means that newly blue-checked items won't be visible until the view has been refreshed, e.g., by collapsing and expanding the root folder, or by switching to another tab and switching back again.

Finally, the script can be used to convert a line-delimited list of search-terms to a single-line query that can be used for indexed searching. Each term will be quoted automatically. The terms can be joined with AND or OR logic. The resultant query will be copied to the clipboard ready to be pasted into the Indexed Items search box.

Download Now



Version: 4.0.0
Tested with:
EnCase Forensic 8.08
Developer: Simon Key
Category: Utility

7221 DOWNLOADS

YOU MAY ALSO LIKE

Utility

SQLite Blob Extractor

This script is designed to extract BLOB-data from SQLite database files.
By Simon Key
303 Downloads
App
Utility

Volatility Plugin

This EnScript is designed to facilitate easier use of Volatility in EnCase. It can be configured for any number of Volatility plugins and supports multithreading.
By Simon Key
142 Downloads
App
Utility

Registry Viewer Plugin

This script allows the examiner to to use a right-click context-menu-option or keyboard shortcut to view Registry hive files (SYSTEM, SOFTWARE, SECURITY, SAM, NTUSER,DAT, etc.).
By Simon Key
121 Downloads
App
Utility

Run Condition As Filter

This download consists two filters designed to make it easier to locate, edit, and launch conditions from multiple locations. They also make it easier to create modified copies of the conditions that ship with EnCase.
By Simon Key
72 Downloads
App