USB Device History
I have modified the USB device history EnScript a little to generate a error dialog box if you do not have a case open when trying to run the script and if you run the EnScript with multiple pieces of evidence, the output is now separated and a line at the top of each output indicates where the information was obtained.
Download Here V5 (.enscript)
Download Here V6 (.enpack)
ShareThis
Posts
1 comments:
Lance,
Great job. This'll bring others closer to what's discussed in my book. One of the issues we've had recently with EnCase 6.8 is it "blowing up" after the Registry has been mounted. This has also occurred when trying to assist other investigators over the phone. We've ultimately resorted to Perl scripts, or exporting the hive file and opening it in RegEdit.
thanks,
Harlan
Post a Comment