Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Item Ancestor Resolution

This script allows the examiner to identify the ancestors of items listed in a given result-set.

This makes it possible, for example, to identify the e-mail that has a compound-file attachment containing files of interest. This will allow the e-mail to be bookmarked and/or extracted.

The script works by scanning the current case and determining the relationships between primary devices (typically evidence files) and the mounted volumes they contain.

This information is stored in a SQLite database, which is then used to construct a tree showing the path to each target item starting with the source-entry on the primary device.

The tree will be presented to the examiner so that he/she can choose the ancestors that should be added to the result-set that will be created by the script.

The path of each source-file on the primary device will be shown in the description column.

The examiner should be aware that the script may take some time to finish particularly if there are many items to process; also if there a large number of mounted volumes in the case.

Download Now



Version: 1.0.3
Tested with:
EnCase Forensic 8.05
Developer: Simon Key
Category: Utility

2222 DOWNLOADS

YOU MAY ALSO LIKE

Utility

Registry Viewer Plugin

This script allows the examiner to to use a right-click context-menu-option or keyboard shortcut to view Registry hive files (SYSTEM, SOFTWARE, SECURITY, SAM, NTUSER,DAT, etc.).
By Simon Key
785 Downloads
App
Utility

Run Condition As Filter

This download consists two filters designed to make it easier to locate, edit, and launch conditions from multiple locations. They also make it easier to create modified copies of the conditions that ship with EnCase.
By Simon Key
350 Downloads
App
Utility

Export Result-Set to Project VIC

This script is designed to extract a user-specified result-set to a Project VIC data-set.
By Simon Key
32 Downloads
App
Utility

Multiple Date Range Filter - Entries Only (EnFilter)

This EnScript filter allows the examiner to show/hide entries using multiple date-ranges and one of four different logic options.
By Simon Key
27 Downloads
App