Create LEF From Folders Using Logical and UNC Path
This script is designed to create an EnCase logical evidence file (LEF) from the contents of one or more folders specified by the user.
Folders can be identified by logical or UNC paths, which can be passed via the command-line if so desired. This can be achieved by creating a Windows shortcut to EnCase, one set to run the script using the '-r' and '-min' command-line switches. Please see the following Twitter post for more details:
The resultant LEF can be an L01 or Lx01 file. The script will set the appropriate type according to the file-extension set in the script-dialog.
The script will scan the contents of the chosen folders and display a list of their contents. The user can then select the files they would like added to the LEF. Files with a non-null logical size will be pre-selected automatically.
The user also has the option of selecting items programmatically through the use of conditions, which can be saved for later use. The script can only use conditions created by itself: it can't use standard EnCase conditions.
When a condition is run it will replace any existing selection. The script will still show non-selected items so that the user can verify that the condition has worked as expected.
Note that folders can never be selected as individual items: folders will be added to the LEF automatically if they contain selected files.
Note that it may not be possible for EnCase to access UNC paths whilst running under User Account Control (UAC). This can apply even if the user running EnCase would normally have access to those folders.
For more information and a resolution for Windows Vista and Windows 7, please see the following Microsoft Technet article:Download Now