Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Data Extraction Utility

This script is designed to extract one or more blocks of data from the file highlighted in the EnCase GUI.

The blocks to be extracted must be listed in a tab-delimited text file with at least 3-numeric columns:

  • Index
  • Offset
  • Length

An output filename can be specified by adding a 4th column:

  • Filename

Each block will be written to the designated output folder. If a Filename value doesn’t exist, the following naming convention will be used.

  • <index> (<offset>, <length>).<extension>

The examiner must specify the file-extension to be used for the output file. He/she may also opt for the index to be padded to 8-digits. These options will be ignored if a Filename value is present.

An example input file is included with the script. Its structure is similar to the Unicode Text format specified by Excel.

The example input file contains some entries with Filename values and some without. These entries refer to deleted JPG files in the Unallocated Clusters object of the SanDisk 2GB SD Card (From Nikon S3000) evidence file used for EnCase training.

Bookmarks can be created to view the extracted data in situ - the bookmark comment will contain the path to the extracted data.

Output can be monitored via the console.

This script was developed for use in EnCase training. For more details, please click the following link:

Download Now

Download Now


FAQ

Version: 2.0
Tested with:
EnCase 23.4
Developer: Simon Key
Category: Utility

4 Downloads
4 Downloads in last 6 months