This script will iterate through specified entries in the current case and create a tally of the total number and size of items with a particular extension or description.
Furthermore, the examiner can apply a filter providing fine-grain control over what is processed based on individual properties.
The default filter will exclude entries that are rarely significant in their own right, e.g., areas of unallocated clusters, folders, files with no logical data, overwritten files, and internal file-system files.The script will write the results to data bookmarks in the designated bookmark folder; also, to two tab-delimited output files in a nominated output folder.
This script was developed for use in EnCase training. For more details, please click the following link:
735 items
13 item
211 item
238 item
88 item
10 item
9 item
1 item
169 item