This script allows the examiner to import user and group accounts from Active Directory into EnCase. This allows the examiner to more easily ascertain the ownership of files/folders through the use of file-system permissions. The script achieves this by querying a domain controller using LDAP.

For this reason the examiner's workstation must belong to the domain in question; it must also have network connectivity and the examiner must be logged into the workstation as an authenticated domain user.

There is no reason why the case cannot be transferred to another workstation: one that is not on the domain once the account entries have been created. See the embedded help text for more details.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training