Identify and Extract Date & Time Changes
This EnScript reads the Security.evtx file and identifies all 4616 events (date and time change). It then bookmarks and exports to csv all date and time changes that exceed a user specified number of minutes. The EnScript allows the user to quickly cull and discard 4616 events created as a result of Time Server syncs.
Download Now
Version:
1
Tested with:
EnCase Forensic 7.11
EnCase Forensic 7.11
Developer: Lynette Goh
Category: Artifact
321
Downloads
19
Downloads in last 6 months