Monday, December 16, 2013

EnCase EnScript to parse Recent FileCache.bcf for Windows 7/2008

Corey Harrell recently posted an excellent and very in-depth article about the "RecentFileCache.bcf" file and its value. Yogesh Khatri also posted part one and part two about the "Amcache.hve" file in Windows 8 and an associated EnScript that parses the Amcache.hve.

The EnScript below quickly parses selected "RecentFilecache.bcf" file(s). It also has an option to automatically bookmark any files referenced in the "RecentFileCache.bcf" file.



Steph Tuesday, 17 December, 2013  

Thank you for posting! Will there be an EnCase 7 version soon?

Lance Mueller Tuesday, 17 December, 2013  

EnCase v7 version posted

Post a Comment

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles