Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Mac OS X Outlook Mail Converter

This EnScript is designed to convert Microsoft Outlook *.olk14MsgSource and *.olk15MsgSource message-files to *.EML files that can be opened in a suitable application.

Mozilla Thunderbird works well for this purpose, as does the Apple Mail application. Microsoft Outlook can also be used, but it may not format every message properly.

The script will process all or selected message-files in a single blue-checked folder in the current view. Note that the folder should be blue-checked in the right-hand table pane, *not* the folder pane, which could inadvertently blue-check one or more sub-folders.

Each converted file will be written with a *.EML extension appended to its file-name. The structure of the folder(s) containing converted Outlook messages will be preserved. Folders that don't contain converted Outlook messages won't be created.

In addition to writing each converted message to a separate file, the script will write each message to a single MBOX file in a logical evidence file, which can be brought back into EnCase, processed and the resultant e-mail data examined, searched and bookmarked in the usual way.

The bookmark-folder name specified by the examiner will also be used for the name of the logical evidence file and the name of output sub-folder created by the script. It cannot therefore contain characters such as '<>:"/\|?*', which aren't permissible Windows file/folder-name characters.

Note that each message in the MBOX file will start with a line having the following format -

From - <date>

The date is taken from when the script was executed. The examiner should be aware of this because the Transport Message Headers field will include it.

The mail data contained within converted Outlook message files will also be bookmarked.

Note that the script will not process deleted Outlook message files.

It's also important to note that the message-content will only be available if the entire message has been downloaded.

Download Now

Version: 1.01
Tested with:
EnCase Forensic 8.07
Developer: Simon Key
Category: Artifact




WebCacheV01.dat Internet History Decoder

This EnScript parses Internet history data from WebCacheV01.dat files. This includes the Internet history data generated by the Microsoft Internet Explorer and Edge web-browser programs.
By Simon Key

ShellBags Parser

Parses recent-folder view settings maintained by the Microsoft Windows operating system.
By Simon Key

User Assist Registry Value Decoder

Decodes data used by the Microsoft Windows operating system to populate each user's start menu with frequently used applications.
By Simon Key

Windows Search Application Data Parser

This script parses data maintained by the Windows search function relating to recently-used applications and documents
By Simon Key