Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

MacOS Var-Folders Name Converter

Decodes the UUID and UID from the names of sub-folders under /private/var/folders in MacOS.

This scripts supports the 5-bit encoding method used by Mac OS 10.9 and later.

This encoding-method uses the following character-array, which is 32-characters in length (2^5 = 32):

  •  0123456789_bcdfghjklmnpqrstvwxyz

After concatenating the UUID and UID of a folder's owner into a binary string, each 5-bit value in that string is used to index a character in the aforementioned character-array, e.g., 00000 would index the character '0'; 11111 would index the character 'z'.

The first two indexed characters become the name of the folder's parent. The remainder become the name of the folder itself.

Output is via the console window and bookmarks.

This script was developed for use in EnCase training. For more details, please click the following link:

Download Now

Download Now


Version: 1.0
Tested with:
EnCase Forensic
Developer: Simon Key
Category: Artifact

3 Downloads in last 6 months