Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Create LEF From Folders Using Logical and UNC Path

This script is designed to create an EnCase logical evidence file (LEF) from the contents of one or more folders specified by the user.

Folders can be identified by logical or UNC paths, which can be passed via the command-line if so desired. This can be achieved by creating a Windows shortcut to EnCase, one set to run the script using the '-r' and '-min' command-line switches. Please see the following Twitter post for more details:

The resultant LEF can be an L01 or Lx01 file. The script will set the appropriate type according to the file-extension set in the script-dialog.

The script will scan the contents of the chosen folders and display a list of their contents. The user can then select the files they would like added to the LEF. Files with a non-null logical size will be pre-selected automatically.

The user also has the option of selecting items programmatically through the use of conditions, which can be saved for later use. The script can only use conditions created by itself: it can't use standard EnCase conditions.

When a condition is run it will replace any existing selection. The script will still show non-selected items so that the user can verify that the condition has worked as expected.

Note that folders can never be selected as individual items: folders will be added to the LEF automatically if they contain selected files.

Note that it may not be possible for EnCase to access UNC paths whilst running under User Account Control (UAC). This can apply even if the user running EnCase would normally have access to those folders.

For more information and a resolution for Windows Vista and Windows 7, please see the following Microsoft Technet article:

Download Now

Download Now

Version: 5.0
Tested with:
EnCase Forensic 8.09
Developer: Simon Key
Category: Utility