Monday, March 15, 2010

EnScript to export selected files & files based on condition criteria

Several months ago I created an EnScript that exports all the files based on a list of file extensions. The user can enter a list of extensions and any files that match the list of extensions, will  be exported to their original path. You can see the original post here.

I recently had a request for an EnScript to export all the selected files in the case and to maintain their original file paths and original timestamps. Below is the requested EnScript, which will export all the selected files to the case default export folder and maintain their original path and timestamps.

I then went ahead and modified it into another EnScript that will export files based on condition criteria. In cases where an investigator wants to export files based on metatdata, you can use this EnScript to filter and export only the files that match the condition criteria you define. In the example below, I defined two conditions to export files that have a file extension of "jpg" AND was accessed on or after 03/15/2010. You can define as many different conditions as you wish and use Boolean AND/OR/NOT logic to define your conditions.

The above condition will export all the files that have a JPG extension and we accessed on or after March 15, 2010. The files will be exported in their original file paths under the case's default export folder and the timestamps will be maintained.

Download "Export files based on Condition and maintain original path and timestamps"
Download "Export Selected Files and maintain path and timestamp"

2 comments:

Anonymous Wednesday, 21 April, 2010  

How does it handle long paths? (Cases where the export dir plus the filename would be longer than 255 characters.)

Lance Mueller Thursday, 22 April, 2010  

There is no internal handling of long paths by the EnScript. If you expect or encounter paths > 255 you should export to a root or short path.

Post a Comment

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles