Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Flat File Export

This script is designed to copy tagged items into a single output-folder and report-on user-specified properties in the process.

The script will generate two types of report: one in tab-delimited format and the other in HTML format.

If a signature analysis has been performed in advance, the script will use the information in the file-signatures table to try and give each output file its correct extension. If the table lists more than one extension for a given type, the first extension will be used.

Regardless of user selection, the script will not process files that are deleted-overwritten, nor files that are zero bytes in size.

The script will use each file's hash-value to prevent extraction of duplicate files. If a file is a duplicate of one that's already been extracted, it will be marked as such in both reports. The path of the file will still be listed, but the Output File Name column shown in the report will refer/link to the copy of the file that's already been extracted.

Extracted files are named using an incremental index so as to avoid duplicate names. The source entry of an extracted file will be bookmarked as a matter of course; the extracted file-name will be shown in the bookmark comment.

In order to include a property in the report it will be necessary to blue-check it. Properties can be ordered by using drag and drop. The list of properties together with the bookmark folder name and export path will be stored for re-use. Note that it may be necessary to use the Adjust Rows option on the Sort menu if column-sorting has been used.

Note that hashing files before running the script is only necessary if the examiner want to show hash values in the reports. For de-duplication purposes the script will use a hash value if available: if not it will calculate one.

Please note that support for records is limited. The script should work reasonably well with email attachments that are regular files but only generic item-properties will be available. If a record is an email, the script will extract it in the form of an HTML report. The content of all other records will be that shown by EnCase in the text/hex tab of the view pane.

Download Now

Version: 4.0.0
Tested with:
EnCase Forensic 8.0.5
Developer: Simon Key
Category: Utility




SQLite Blob Extractor

This script is designed to extract BLOB-data from SQLite database files.
By Simon Key

Volatility Plugin

This EnScript is designed to facilitate easier use of Volatility in EnCase. It can be configured for any number of Volatility plugins and supports multithreading.
By Simon Key

Registry Viewer Plugin

This script allows the examiner to to use a right-click context-menu-option or keyboard shortcut to view Registry hive files (SYSTEM, SOFTWARE, SECURITY, SAM, NTUSER,DAT, etc.).
By Simon Key

Run Condition As Filter

This download consists two filters designed to make it easier to locate, edit, and launch conditions from multiple locations. They also make it easier to create modified copies of the conditions that ship with EnCase.
By Simon Key