This is an update to a previously submitted (and approved) EnScript that parses all Windows, OSX and Linux memory images. This update fixes an issue that ocurred when a user attempted to use the script against an evidence file (.E01). There are no other changes to the script.

This EnPack will process ANY Windows memory image from XP thru Windows 8x64, including Server. The EnPack will also process any Linux and OSX memory image. Results are output to console; with a text version available for user selected export. The user can expect to obtain, at a minimum, all running processes, parents, create dates, and process names. Additonal processing functions can be selected by simply putting a 1 in the appropriate box on the start up menu. Memory resident MFT entries, Registry entries, IP addresses, Open Ports, Twitter artifacts and more can be selected. To use: double click EnPack, at opening menu select memory image to process (type) from list at top. If you do not know what the exact image type is start with the 32 bit version first. If you don't know anything about the memory image you can select "Unknown" and the EnPack will attempt to identify the image file based on Dispatch Header Values. You can disable processing for running processess by selecting "Disable" - You will still be able to run the other processing selections against the image file. You can also parse ANY MFT with this script - by simply blue checking the MFT file, disabling the specific memory search and enabling the MFT parsing. This EnPack will only process "Blue Checked" files; for memory image files it is HIGHLY recommended that you process one file at a time as the output is to the console and will be cleared by the next entry before you will have time to view the first.