This script is designed to copy tagged items into a single output-folder and report-on user-specified properties in the process.

The script will generate two types of report: one in tab-delimited format and the other in HTML format.

If a signature analysis has been performed in advance, the script will use the information in the file-signatures table to try and give each output file its correct extension. If the table lists more than one extension for a given type, the first extension will be used.

Regardless of user selection, the script will not process files that are deleted-overwritten, nor files that are zero bytes in size.

The script will use each file's hash-value to prevent extraction of duplicate files. If a file is a duplicate of one that's already been extracted, it will be marked as such in both reports. The path of the file will still be listed, but the Output File Name column shown in the report will refer/link to the copy of the file that's already been extracted.

Extracted files are named using an incremental index so as to avoid duplicate names. The source entry of an extracted file will be bookmarked as a matter of course; the extracted file-name will be shown in the bookmark comment.

In order to include a property in the report it will be necessary to blue-check it. Properties can be ordered by using drag and drop. The list of properties together with the bookmark folder name and export path will be stored for re-use. Note that it may be necessary to use the Adjust Rows option on the Sort menu if column-sorting has been used.

Note that hashing files before running the script is only necessary if the examiner want to show hash values in the reports. For de-duplication purposes the script will use a hash value if available: if not it will calculate one.

Please note that support for records is limited. The script should work reasonably well with email attachments that are regular files but only generic item-properties will be available. If a record is an email, the script will extract it in the form of an HTML report. The content of all other records will be that shown by EnCase in the text/hex tab of the view pane.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training