Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Ares Registry Report

APPS | Artifact

This script will find NTUSER.dat files and extract the subkey [\\Software\\Ares] into a bookmark. It will also interpret a number of known values and decrypt some values that are encrypted. Research by Matt McFadden and James Habben.

DISCUSSION BOARD

FAQ

Version: 1.1

Tested with:
EnCase Forensic 7.07

Developer: James Habben

Category: Artifact

846 Downloads

10 Downloads in last 6 months

YOU MAY ALSO LIKE

ShellBags Parser

Parses recent-folder view settings maintained by the Microsoft Windows operating system.

By Simon Key
62 Downloads
60 Downloads in last 6 months

User Assist Registry Value Decoder

Decodes data used by the Microsoft Windows operating system to populate each user's start menu with frequently used applications.

By Simon Key
61 Downloads
59 Downloads in last 6 months

VSS Examiner

Quickly and easily identify and preserve data of interest in Microsoft Windows volume shadow copies.

By Simon-Key
14105 Downloads
47 Downloads in last 6 months

Windows Device Properties Parser

This script parses extended device-property information from Microsoft Windows SYSTEM Registry hive files.

By Simon Key
25 Downloads
23 Downloads in last 6 months