This script adds right-click context-menu options allowing the examiner to view the highlighted item using the default Windows viewer for the file-type concerned.

In order to achieve this, the script will extract the item's data to a temporary file in the Viewer Plugin sub-folder of the current case's temporary folder. The file-name used for this purpose will be the item GUID.

The script provides an option allowing the extension of the extracted item to be changed, which may be beneficial in certain cases. For example:

• Some applications won't open a file that doesn't have a recognized extension.
• If a file doesn't have an extension, Windows will not know which application(s) can be used to open it.

If the latter of these examples applies, the script will suggest an extension provided that signature analysis has already identified the file's type. In such cases, the extension provided will be the first listed in the File Types table for the file-type in question.

The plugin also allows highlighted data to be extracted and viewed in a similar manner. This is useful when viewing embedded data that cannot be rendered sufficiently by EnCase's bookmark-decode feature, e.g., HTML data.

Note that the temporary files created by the script will need to be removed manually.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training