Thursday, January 20, 2011

EnScript to parse LNK files into Excel - sortable on timestamps

The EnCase "Case Processor" EnScript includes a Link File Parser module that work fine, but does not produce a very efficient report. For example, if you want to quickly see all the LNK files that refer to object on removable media, you have to read through all the entries to find one that may be on a removable device. Also, there is no way to sort the data by the timestamps contained in the LNK file to build a timeline.

I wrote this EnScript several months ago for a specific need I had back then, but never had a chance to post it.

This EnScript requires Microsoft Excel be installed and it will parse all the LNK files in the case (no need to select). The data will be sent to Excel and a spreadsheet will automatically open, displaying the data. You can then easily sort on any field and quickly see the properties of each Link file.

Download Here

11 comments:

Phil Rodokanakis Friday, 04 February, 2011  

Lance: Does this EnScript also pull deleted LNK files out of Unallocated? Or should the Link File Parse module in the Case Processor be run first to locate any LNK files in unallocated?

Lance Mueller Saturday, 05 February, 2011  

No, this processes logical files only. It does nothing to search or process data in unallocated.

Shane Bell Sunday, 20 March, 2011  

Hi Lance, I have noticed that the output in excel seems to cap the report at 1500 rows. Is this intentional?

Chuw Fan Monday, 11 April, 2011  

Hi Lance, I am getting the same result as Shane Bell does, the output in excel seems to cap the report at 1500 rows. Is this intentional?

Lance Mueller Tuesday, 12 April, 2011  

@Chuw & Shane,

Yes, I apologize, there was some testing code I left in that limited it to 1500 records.

New version is posted.

http://www.lancemueller.com/blog/Parse%20Link%20Files%20to%20EXCEL%20Spreadsheet%20with%20UNIX%20dates%20for%20sorting.EnPack

Chuw Fan Monday, 25 April, 2011  

Hi Lance,

Thanks for the update,

Just share some idea here, i find that better to include the Link File timstamps for better understanding on the particular link file details, instead of showing the Target File timestamps only.

Anyway, Thanks for sharing the great EnScript.

Richard Gralnik Thursday, 26 July, 2012  

Lance,

I just ran the updated enscript against a case where I know I have 96 LNK files on a particular date. The Excel spreadsheet created by the enscript left out 50 of them. The spreadsheet has a total of 1,009 rows so the 1,500 record limit isn't the problem. Have you seen this before?

Thanks,
Richard

Anonymous Wednesday, 08 August, 2012  

I can use Excel sheet to create an excel file , but how can I read an excel file?

myla young Thursday, 06 December, 2012  
This comment has been removed by a blog administrator.
Anonymous Sunday, 10 March, 2013  

how to find the list of installed programs ? any enscript

Lance Mueller Sunday, 10 March, 2013  

Check the included Case Processor EnScript

Post a Comment

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles