URL and Windows File-Path Finder
This script is designed to locate URLs and Windows file-paths containing one or more keywords.
Windows file paths may be DOS paths (e.g., those starting ‘C:\’) or UNC paths (e.g., those starting ‘file:///’).
Both entries and records can be searched although the Current View - Selected option won’t work with records.
Should the examiner wish to locate paths within a specific parent folder, the name of that folder can be entered as keyword enclosed by forward-slashes or backward-slashes depending on the type of path being sought, e.g., ‘\DropBox\’ and/or ‘/DropBox/’.
The console will show each item as it is being processed. Furthermore, if the size of an item is 100MB or greater, the status bar will show the progress being made in searching that file.
It’s important to note that the script won’t always be able to determine the exact length of a path or URL. This is particularly so when it comes to DOS paths stored in binary structures. These may be packed with other string data thus preventing the script from locating any obvious delimiter.
Output is via bookmarks such that the hits for each keyword will be written to a separate bookmark sub-folder whose comment will be the the associated keyword’s search-term.
Note that bookmark sub-folders will only be created when needed, so their order may not match the order of the associated keywords.
To overcome this, the folders can be dragged and dropped into place after removing any sort or green-check. Alternatively, the Adjust Rows option can be used after sorting the folders by name.
The comment of each bookmark will contain the URL/path that has been found. EnCase’s Save As option can be used to extract the paths to an external file.
This script was developed for use in EnCase training. For more details, please click the following link: