Rearrange date and time information to build an informative timeline.

EnCase has one record per file. Each record may contain five timestamp-values: file created, last written, last accessed, file deleted and entry modified.

The script will create a record for each of a file's timestamp-values that is unique.

The fields in each record allow the examiner to determine which properties share the value in question.

Take, for example, the following data as shown in EnCase:

The script's output for this data would be:

3000-01-01 M . . . samplefile1.txt
3000-02-01 M . . . samplefile2.txt
3001-01-01 . A . . samplefile1.txt
3001-02-01 . A . . samplefile2.txt
3002-01-01 . . C . samplefile1.txt
3002-02-01 . . C E samplefile2.txt
3003-01-01 . . . E samplefile1.txt

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training