Please select a template

EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Become a Developer

Registry Viewer Plugin

This is a self-installing viewer for Windows Registry-hive files. Once installed, it is invoked using the CTRL+SHIFT+Y keyboard shortcut.

The viewer allows the examiner to interpret long-integer (QWORD) and 8-byte binary values as Windows FILETIME timestamps.

Binary data can also rendered as ANSI/ASCII characters. Any non-ANSI/ASCII character will be rendered as a centre-dot (·) character.

If both of the above options are chosen, 8-byte binary values will be decoded as timestamps only.

Output is by way of data bookmarks.

This script was developed for use in EnCase training. For more details, please click the following link:

Download Now

Download Now


FAQ

Version: 1.4
Tested with:
EnCase Forensic 8.08
Developer: Simon Key
Category: Utility

791 Downloads
86 Downloads in last 6 months