Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Office 2007 Metadata Processor

This script reads XML-based metadata from entries in the current case that are identified as Office 2007 documents by way of file-extension. The script supports both Microsoft Office Open XML and OpenDocument formats, both of which are a collection of zipped XML-files.

For those documents that are in the Microsoft Office Open XML format, the script will bookmark all data stored in the 'docProps\app.xml\Properties' and 'docProps\core.xml\cp:coreProperties' nodes. For documents that are in the OpenDocument format, the script will bookmark all data in the 'meta.xml\office:document-meta\office:meta' node.

In addition to bookmarking all of the XML metadata for a file, the script will write the most relevant document properties into into the bookmark-comment and a summary spreadsheet, which will be in tab-delimited format. Note that XML attributes and other lower-level XML data will be excluded from this process for the sake of clarity/simplicity: if the provenance of a document is particularly important then the examiner should view the complete set of XML-metadata as captured in the bookmark itself.

Dates and times will be shown as-is. The spreadsheet will contain the true-path of each entry that is processed. If an entry has been mounted prior to running the script then the name of that entry will appear twice in the path: this is a known limitation. The presence of a given property in the summary spreadsheet will indicate that a non-empty value exists for at least one processed document.

Download Now



Version: 1.0
Tested with:
EnCase Forensic 8.07
Developer: Simon Key
Category: Utility

260 DOWNLOADS

YOU MAY ALSO LIKE

Utility

SQLite Blob Extractor

This script is designed to extract BLOB-data from SQLite database files.
By Simon Key
235 Downloads
App
Utility

View SQLite With WAL Plugin

Allows SQLite database files to be opened in conjunction with any write-ahead log (WAL) file.
By Simon Key
140 Downloads
App
Utility

Volatility Plugin

This EnScript is designed to facilitate easier use of Volatility in EnCase. It can be configured for any number of Volatility plugins and supports multithreading.
By Simon Key
99 Downloads
App
Utility

Registry Viewer Plugin

This script allows the examiner to to use a right-click context-menu-option or keyboard shortcut to view Registry hive files (SYSTEM, SOFTWARE, SECURITY, SAM, NTUSER,DAT, etc.).
By Simon Key
72 Downloads
App