Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Item Ancestor Resolution

This script allows the examiner to identify the ancestors of items listed in a given result-set.

This makes it possible, for example, to identify the e-mail that has a compound-file attachment containing files of interest. This will allow the e-mail to be bookmarked and/or extracted.

The script works by scanning the current case and determining the relationships between primary devices (typically evidence files) and the mounted volumes they contain.

This information is stored in a SQLite database, which is then used to construct a tree showing the path to each target item starting with the source-entry on the primary device.

The tree will be presented to the examiner so that he/she can choose the ancestors that should be added to the result-set that will be created by the script.

It should be noted that email certain attachments, e.g., those in PST/OST files, will be contained in a folder of the same name when viewed in the tree presented to the examiner, which represents the entry view rather than the artifact view.

The path of each source-file on the primary device will be shown in the description column.

In many cases, the examiner will want to use this script to identify the PST/OST emails containing notable attachments.

To try and make this process as easy as possible, the script provides an option to select the grandparent of each leaf-node.

This will work provided there is a simple child-parent relationship between each notable attachment and the containing email when viewed in the Artifacts tab. It will not work if the notable attachment is contained in a mounted compound file attached to the email.

The examiner should be aware that the script may take some time to finish particularly if there are many items to process; also if there a large number of mounted volumes in the case.

This script was developed for use in EnCase training. For more details, please click the following link:

Download Now

Download Now


FAQ

Version: 2.0
Tested with:
EnCase Forensic 8.11.00.74
Developer: Simon Key
Category: Utility

22 Downloads
8 Downloads in last 6 months