Description


This EnScript will search all tagged items for known.met record fragments from eMule 0.5. If these records are found it will parse the records and the output will be to a tab delimited file in the default case export folder for further analysis in Excel or other spreadsheet application.

This is designed to parse known .met records recovered from a search of tagged entries.  It was written based on the file tags used in the known.met from eMule version .50 MorphXT.  It is intended to be used to carve out known.met record fragments from unallocated or slack to 'Triage' eMule activity on the drive(s). Since Unallocated space or Slack space data can run into sector boundries or have data overwritten  the data reported may contain inaccurate information and must be confirmed by manual examination of the 'Hit' using the Hit File Name and Hit Offset information in the output file.  The output file will be located in the case Export Folder titled 'known_met Record Search Results.txt'. This file is in Tab Delimited format so that it can be opened with Excel or any other application that handles Tab Delimited files.

Releases

Release
Size
Date
Known _met Search and Parse 1.0.0
  |  
Aug 1, 2024
More info Less info
Product compatibility
Release notes

Tested with:
EnCase Forensic 7.05

Languages
English

Unsubscribe from notifications

You are receiving release updates for this item because you have subscribed to the following products:
If you unsubscribe, you will no longer receive any notifications for these products.
Tip: to update your subscription preferences, go to Manage Subscriptions from your Dashboard, uncheck the products you no longer want to receive notifications for, and click 'Save'.

Marketplace Terms of Service

In order to continue, you must accept the updated Marketplace Terms of Service
Since you are downloading an app from the OpenText Marketplace, you need to accept the updated Marketplace Terms of Service before you can continue. Use the link to review the Marketplace Terms of Service. Once complete check the, "I accept the Marketplace Terms of Service" box below and click accept to continue your download.


Your download has begun...

Your download has begun

Related content and resources

Your browser is not supported!

Please upgrade to one of the following broswers: Internet Explorer 11 (or greater) or the latest version of Chrome or Firefox

release-rel-2025-2-1-6322 | Wed Feb 5 16:30:41 PST 2025