Monday, September 28, 2009

EnScript to alert you if there is data in the unused disk area of a physical device

This EnScript was designed to quickly scan the sectors classified as "Unused Disk Area" & "Volume Slack" for any data. If any data is found in these areas, then a bookmark of that sector is created and at the end of the EnScript a warning message will be displayed indicating that data was found in this area.

Data in this area is generally not a problem as long as you search and process all objects on the physical device. This is just a quick way to indicate if there is data and a way to quickly review what data exists in that area without having to scroll sector to sector.

Simply run the EnScript and it will check the "Unused Disk Area" of all the physical devices and then display a warning message if data was found. A bookmark is made of every sector that contains data in Unused or Volume Slack. You can then view the bookmark tab and quickly scroll through the bookmarks looking for recognizable data.

Download Here


Anonymous Tuesday, 29 September, 2009  

Hi Lance

Nice Enscript.
Does this enscript work together with preview funtionality of EnCase Enterprise?


Lance Mueller Tuesday, 29 September, 2009  

When you say "preview" I assume you mean attaching a device and looking at the original device as opposed to an image. In that case, absolutely.

Post a Comment

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles