Thursday, July 2, 2009

EnScript to Export files based on Extension v1.1

A few days ago I posted a blog about a new EnScript I wrote based on a reader's suggestion here.

I have updated this EnScript based on a suggestion from Iain Kenny & Jerry Hatchett to add the feature to de-duplicate exported files based on the hash values. The initial screen now has a check box to perform de-duplication by hash values:



If you check this box, the EnScript will hash every file it exports and if any additional files match the hash values of previous files, the contents will not be exported. Instead, the duplicate file will be created, but the contents will contain the text "DUPLICATE" as well as the path of the ORIGINAL file with the same hash.



The log file "index.csv" will also indicate each file that is a duplicate and list the hash values for all the files.



Download v1.1 Here

2 comments:

Becki's Bedroom Blog Saturday, 04 July, 2009  

We use a similar script to export on either file category, extension or signature. I assume you deal with duplicate content by amending the file name. Currently we change the names of all files to consecutive numbers, this also addresses arabic script we sometimes come across. The EnScript creates a list of either filetypes, categories, extension from which certian types can be excluded. It can be set to ignore knows or unselected files.

Anonymous Wednesday, 08 January, 2014  

Is it possible to get a EnCase 7 version of this script?

Post a Comment

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles