The purpose of this plugin is two-fold.

Firstly, for entries, it allows the examiner to view and bookmark the information shown under the Attributes tab en masse rather than on a per-file/folder basis.

Secondly, for artifacts (aka records), it allows the examiner to view and bookmark the information shown under the Fields tab in a similar manner. This is particularly useful for custom fields, which cannot be added to the Table pane.

The information provided by the script will be shown in the context of the folder currently in view. Attributes will be displayed in a sub-folder called Root Attribute; fields will be displayed in a sub-folder called Root Field.

It’s important to note the following in respect of attributes:

• Attributes containing binary property-list data will be decoded into XML-format automatically.
• Each attribute’s name and value will be in the form of a string, which is how EnCase stores the data internally. Whilst this may make sorting/filtering dates a little difficult, changing the format to ‘yyyy-MM-dd’ in EnCase may assist.

It’s important to note the following in respect of fields:

• The data bookmarks used by the script may be insufficient to store all of the MAPI data associated with artifacts from PST and OST files. In such cases, any bookmark created by the script will appear empty and viewing its contents will generate an error.
• The script will show dates as both an ISO-formatted string in UTC and an EnCase formatted timestamp in the examiner’s local time-zone. Note that the latter is determined when EnCase starts - changing the time-zone while EnCase is running will not affect the output of the script.

The examiner can choose to blue-check attributes and fields using internal conditions, which will be saved for future use.

This script was developed for use as part of EnCase training. For more details, please visit the following links:

• EnCase Forensic Learning Paths
• EnCase Endpoint Security Learning Paths