Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

NirSoft ESEDatabaseView Plugin

NirSoft ESEDatabaseView executable integration with EnCase for centralized reporting of parsed ESE a.k.a. Jet Blue databases through the use of bookmarks. The plugin requires the NirSoft ESE Database Viewer, which can be downloaded from :

http://www.nirsoft.net/utils/ese_database_view.html

The plugin also requires the Microsoft ESENTUTL Tool, which is typically located here: C:\Windows\System32\esentutl.exe

Initially the Executable Location will need to be set by locating the NirSoft ESEDatabaseView executable that was downloaded. Once selected the location is stored in the NirSoftESEDatabaseView.ini file located in the C:\Users\\AppData\Roaming\EnCase\EnCase7-1\Config folder.

It is highly recommended that the ESE Metadata Dump option is always run first to determine if the Extensible Storage Engine (ESE) a.k.a. JET Blue file that you right clicked on is intact or corrupted. The EnScript will check to see if the file exists in the case temp folder otherwise it will be extracted and identified by a unique GUID. If the file is intact then table structure will be displayed in the console view and bookmarked. However if the file was corrupted than the ESE Database Repair option could be selected. Than you would be able to use the ESE Metadata Dump option again to verify that the file was successfully repaired. Now your all set to use the Manual Table Extraction option by entering a table name identified from the ESE MetaData Dump output. NirSoft ESEDatabaseView will parse the table from the ESE file located in the case temp directory than EnCase will create a XML bookmark. The XML output is also available in the case export folder too.

Download Now



Version: 1.03
Tested with:
EnCase Forensic 7.08
Developer: John Lukach
Category: Reporting

3620 DOWNLOADS

YOU MAY ALSO LIKE

Reporting

E-mail Address Finder

This EnScript will locate, bookmark, and count all unique e-mail addresses in a case.
By Ryan Jay Ollerenshaw
5246 Downloads
App
Reporting

Drive Space Audit

This EnScript will audit the space of all devices in the case. A table will be built in the bookmarks tab as a summary to show usage of devices in the case.
By James Habben
4741 Downloads
App
Reporting

Manfred's Comprehensive Case Template

This template may serve you as basis for your own specific template and includes many Bookmark folders for often encountered topics during your exams.
By Manfred Hatzesberger
3185 Downloads
App
Reporting

Inventory

Hash and parse all your case files to create an inventory of your cases.
By James Habben
3164 Downloads
App