Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer
/div>

Ares Registry Report

APPS | Artifact

This script will find NTUSER.dat files and extract the subkey [\\Software\\Ares] into a bookmark. It will also interpret a number of known values and decrypt some values that are encrypted. Research by Matt McFadden and James Habben.

Download Now

Download Now

DISCUSSION BOARD
Version: 1.1
Tested with:
EnCase Forensic 7.07
Developer: James Habben
Category: Artifact