This script is designed to extract one or more blocks of data from the file highlighted in the EnCase GUI.
The blocks to be extracted must be listed in a tab-delimited text file with at least 3-numeric columns:
An output filename can be specified by adding a 4th column:
Each block will be written to the designated output folder. If a
Filename value doesn't exist, the following naming convention will be used.
- <index> (<offset>, <length>).<extension>
The examiner must specify the file-extension to be used for the output file. He/she may also opt for the index to be padded to 8-digits. These options will be ignored if a
Filename value is present.
An example input file is included with the script. Its structure is similar to the
Unicode Text format specified by Excel.
The example input file contains some entries with
Filename values and some without. These entries refer to deleted JPG files in the
Unallocated Clusters object of the
SanDisk 2GB SD Card (From Nikon S3000) evidence file used for EnCase training.
Bookmarks can be created to view the extracted data in situ - the bookmark comment will contain the path to the extracted data.
Output can be monitored via the console.
This script was developed for use in EnCase training. For more details, please click the following link:
734 items
211 item
10 item
9 item
13 item
169 item
88 item
1 item
237 item