NirSoft ESEDatabaseView Plugin
NirSoft ESEDatabaseView executable integration with EnCase for centralized reporting of parsed ESE a.k.a. Jet Blue databases through the use of bookmarks. The plugin requires the NirSoft ESE Database Viewer, which can be downloaded from :
The plugin also requires the Microsoft ESENTUTL Tool, which is typically located here: C:\Windows\System32\esentutl.exe
Initially the Executable Location will need to be set by locating the NirSoft ESEDatabaseView executable that was downloaded. Once selected the location is stored in the NirSoftESEDatabaseView.ini file located in the C:\Users\\AppData\Roaming\EnCase\EnCase7-1\Config folder.
It is highly recommended that the ESE Metadata Dump option is always run first to determine if the Extensible Storage Engine (ESE) a.k.a. JET Blue file that you right clicked on is intact or corrupted. The EnScript will check to see if the file exists in the case temp folder otherwise it will be extracted and identified by a unique GUID. If the file is intact then table structure will be displayed in the console view and bookmarked. However if the file was corrupted than the ESE Database Repair option could be selected. Than you would be able to use the ESE Metadata Dump option again to verify that the file was successfully repaired. Now your all set to use the Manual Table Extraction option by entering a table name identified from the ESE MetaData Dump output. NirSoft ESEDatabaseView will parse the table from the ESE file located in the case temp directory than EnCase will create a XML bookmark. The XML output is also available in the case export folder too.