Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Windows NTUSER.DAT Drive Letter Mappings

This is a simple script that extracts the drive-letter mappings from HKCU\Network.

The script will process specified NTUSER.DAT files from the current case.

Output is by way of bookmarks and a tab-delimited spreadsheet file openable in Microsoft Excel.

This script was developed for use in EnCase training. For more details, please click the following link:

Download Now

Download Now


Version: 1.0
Tested with:
EnCase Forensic
Developer: Simon Key
Category: Artifact

20 Downloads in last 6 months