Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

PDF File Finder

This script is designed to find deleted PDF files using the header, '%PDF-#.#' (GREP), and the footer, '%%EOF'.

The script was primarily designed for the recovery of PDF files generated during the CUPS (Common UNIX Printing System) spooling process. Unlike other types of PDF, these are guaranteed to have a single footer at the end.

PDFs that are not printer spool files may have more than one occurrence of the footer due to the way in which PDFs can be extended. Such files may be corrupt or partially complete when recovered.

This script was developed for use in EnCase training. For more details, please click the following link:

Download Now

Download Now


Version: 3.0
Tested with:
EnCase Forensic
Developer: Simon Key
Category: Artifact

20 Downloads in last 6 months