Thursday, November 26, 2009

EnScript to create thumbnails of selected video files

This EnScript was designed to take all selected (blue checked) video files (avi, mp4, 3gp, etc.) in the case and to automatically create thumbnail pictures for each video. In order to do this, a program named “Video Thumbnails Maker” is required. This is a free program, but in order to use it in the method described below, you need to give a donation of $25.00 or more to the author of the program (I have no affiliation with the author, I use this program because its the only program that works from the command-line and works reliably, just make sure you have all the appropriate codecs loaded).

Once you give a donation, a reg key is sent via email that enables the program to be used from the command line (Platinum level). It is this feature that is required in order to integrate it with an EnScript. The program can be downloaded from and can be used for free via the GUI and you can manually convert videos using the GUI but you will not be able to use it as the described below until you register it and receive the activation code, which enables the command-line features.   


The “Video Thumbnails Maker” program supports many of the different video types, but I have found AVI to be the most reliable video type that seems to work 100% of the time.

To use this EnScript, simply select any video files you wish to make thumbnails of:

Then run the EnScript named “Make Thumbnails of selected video files”. The EnScript will create a root folder named “Video Thumbnails” in the default export folder specified in your case. Inside this folder, the EnScript will create a sub folder for each video file that you selected (The hash value is appended to avoid a collision of two files named the same but from different paths):

Inside each subfolder that is named after the video that was exported, the original video and all the thumbnail photos will be present. In addition, there will be a text file named “Video_Header.txt” that contains all the video metadata, name, path, hash, created date, written date. This information can be copied into an external report as the header information describing the video, then show all the thumbnails.

You can see that the thumbnails are all named after the original video, along with a timestamp of when in the video the thumbnail was created. In the example above, a thumbnail was created every second as that is what I have set in my EnCase.vtm file.  You can then quickly scan the images in Windows Explorer thumbnail view to see which picture contain valuable images and which you can delete. In the same folder is a text file with the video metadata that can be quickly inserted into an external report:

The “Video Thumbnail Maker” program  has many different options that you can set and then save those settings to a “preset” file. When you install the “Video Thumbnail Maker” program, there is a subfolder created under the program folder of “C:\Program Files\Video Thumbnails Maker” named “Presets”:

The five “Base_Presets_x.vtm” are installed when you install the program the first time. In order for the EnScript to work with this program, you must create a preset file named “EnCase.vtm” with the settings you want to use when creating the thumbnail pictures. Here is an example of my settings as I set them in the program GUI and then saved them to the “EnCase.vtm” preset:

This last option screen is where you can set the time sequence for your thumbnails. You can see above that I have the “Specific Time” option selected and the box below says “2 secs”, this means that regardless of how long the video is, this program will create a JPG thumbnail picture every two seconds until the end of the video.
At the top of this last screen you can see the “export” option. This is where you can set all the options you want to use with the program and the export them to a file named “EnCase.vtm” in the c:\Program Files\Video Thumbnail Maker\Preset\” folder. Whatever you save into that preset file are the options that the EnScript will use when creating your thumbnails. Some common mistakes:
1.   Make sure on the Environment screen, in the "output" section,  you do not select the “Save thumbnails to your folder” option. By default the program will place the thumbnails in the same folder where the video file is found, which is that subfolder that the EnScript automatically creates.
2.   When trying to create thumbnails of video files other than “AVI”, I have had to change the “Video Rendering” option on the Environment page between “Engine 1” and some of the other options. “AVI” seems to work great with “Engine 1”, but sometimes .3GP, MP4 and others fail with that option, so changing that option to “Engine 2” or “Extreme” usually fixes the failure.
Once you set all your options and save them to the EnCase.vmt file, you will not need to reconfigure the program unless you want to change some of the settings.
One valuable use for this EnScript is to export out any videos and then quickly scan the thumbnail images in Windows Explorer to see if it contains any images of interest. 

Sunday, November 15, 2009

EnScript to find Limewire download remnants.

This EnScript was written for a reader who requested an EnScript to search for the common "URN:SHA1:{Sha1_base32 hash} associated with Limewire downloads. When run, the EnScript will search SELECTED files for that tag. If found, it will read the SHA1_base32 value that immediately follows the tag and then compute a SHA1_base32 hash for all the files that have matching extensions to those you specify. If a file with the same hash is found, it is bookmarked as a matching file.

Once completed, check the bookmark folder for two different folders. One contains any "URN:SHA1" tags found in the selected files, and the second one is each file that matches a found SHA1 value

Download Here

Sunday, November 8, 2009

EnScript to display the number of search hits per file.

A reader asked if I could write an EnScript to calculate how many search hits were in each individual file, instead of the total number of search hits that EnCase displays.

Below is an EnScript that will calculate the number of unique files with each selected search hit, as well as how many hits in each file. To use, conduct your search, then select the search hits you want to include in the report and then run.

Once you run the EnScript, it will automatically open Microsoft Excel (required) and populate three columns, Search Expression+(unique count), Full Path, and hits per file.

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles