Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer
/div>

Find and Parse Prefetch Files in Unallocated

This EnScript was written to search unallocated cluster for deleted prefetch data. If found, the EnScript will parse out the name of the executable, last run time and run count. The data is displayed in the console as well as bookmarked. This EnScript supports finding prefetch file data in unallocated for Windows XP, Vista & 7.

http://www.forensickb.com Customized EnCase EnScript development (v6 & v7) Customized Forensic Automation / Workflow

Download Now

Download Now



Version: 1
Tested with:
EnCase Forensic 7.08
Developer: Lance Mueller
Category: Artifact