Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

NTFS Index Buffer Reader

This script is designed to parse the contents of NTFS index buffers.

The script can parse the index buffer highlighted by the user (identified by the header 'INDX'); alternatively it can search all or selected entries in the current view.

In addition to processing current index records the script will also search for deleted records (those located in the slack space of index buffers).

Be warned that searching for index buffers in file-system-objects other than current NTFS folders can cause problems; this is especially the case with $LOGFILE, which will often contain truncated index buffers.

Based on a script originally written by Howard 'Howie' Williamson.

For additional information, please see the following Twitter post:

This script was developed for use in EnCase training. For more details, please click the following link:

Download Now

Download Now


Version: 2.5
Tested with:
EnCase Forensic
Developer: Simon Key
Category: Artifact

8 Downloads in last 6 months