Pre-Evidence Processing Tasks
This EnScript is designed to be run before the Evidence Processor. This EnScript does three things:
- Bookmarks and writes to the console certain timezone information.
- Mounts document files based on file extensions of: docx xlsx pptx odt ods and odp
- Mounts the following registries from Windows\System32\config: SAM SYSTEM SOFTWARE SECURITY
- Mounts NTUser.dat from the User Profiles.
- Mounts and Bookmarks settings.dat files that have values from the User Profiles.