Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer
/div>

Identify and Extract Date & Time Changes

This EnScript reads the Security.evtx file and identifies all 4616 events (date and time change). It then bookmarks and exports to csv all date and time changes that exceed a user specified number of minutes. The EnScript allows the user to quickly cull and discard 4616 events created as a result of Time Server syncs.

Download Now

Download Now



Version: 1
Tested with:
EnCase Forensic 7.11
Developer: Lynette Goh
Category: Artifact