Pre-Evidence Processing Tasks
This EnScript is designed to be run before the Evidence Processor. This EnScript does three things:
- Bookmarks and writes to the console certain timezone information.
- Mounts document files based on file extensions of: docx xlsx pptx odt ods and odp
- Mounts the following registries from Windows\System32\config: SAM SYSTEM SOFTWARE SECURITY
- Mounts NTUser.dat from the User Profiles.
- Mounts and Bookmarks settings.dat files that have values from the User Profiles.
Version:
1
Tested with:
EnCase Forensic 7.07
EnCase Forensic 7.07
Developer: Tim Taylor
Category: Utility
1274
Downloads
15
Downloads in last 6 months