Attribute Helper Plugin
This plugin allows the examiner to view and bookmark the information shown under the Attributes tab en-masse rather than on a per-file/folder basis.
Attribute-values containing binary property-list data will be decoded into XML-format automatically.
When it comes to viewing the attributes associated with selected entries, those entries will be shown in the context of the folder structure currently in view. Selected entries that have one or more attributes will be shown with a red triangular overlay. The attributes for these entries will be contained in a sub-folder called '<Root Attribute>'.
The examiner can choose to blue-check attributes using an internal filter-condition, which will be saved for later use.
For more information, please see the following Twitter post:
This script was developed for use in EnCase training. For more details, please click the following link:
Download Now