Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Find and Parse Prefetch Files in Unallocated

This EnScript was written to search unallocated cluster for deleted prefetch data. If found, the EnScript will parse out the name of the executable, last run time and run count. The data is displayed in the console as well as bookmarked. This EnScript supports finding prefetch file data in unallocated for Windows XP, Vista & 7.

http://www.forensickb.com Customized EnCase EnScript development (v6 & v7) Customized Forensic Automation / Workflow

Download Now

Download Now


FAQ

Version: 1
Tested with:
EnCase Forensic 7.08
Developer: Lance Mueller
Category: Artifact

1147 Downloads
21 Downloads in last 6 months