Basic System Volume Information EnScript

I was recently contacted by Hans Heins in the Netherlands, who had some EnScripts that were written in v4 by a student trainee. The EnScripts parse out basic information from the System Volume Information, Restore Point files. He posted these EnScripts to his website listed here.

I have ported these over to EnCase v6 EnPack format.

The first one parses the rp.log for basic information on when the restore point was made. To use, select (blue check) one or several rp.log files and then run the script. A small text file with the information is created in your default export folder. You can download the v6 version here.

The second one parses the change.log and lists the files that are in the restore point. To use, select (blue check) one or several change.log files and then run the EnScript. A small text file with the information is created in your default export folder. You can download the v6 version here.

Thanks to Hans for sharing the EnScripts.