EnCase EnScript to parse Recent FileCache.bcf for Windows 7/2008
Corey Harrell recently posted an excellent and very in-depth article about the "RecentFileCache.bcf" file and its value. Yogesh Khatri also posted part one and part two about the "Amcache.hve" file in Windows 8 and an associated EnScript that parses the Amcache.hve.
The EnScript below quickly parses selected "RecentFilecache.bcf" file(s). It also has an option to automatically bookmark any files referenced in the "RecentFileCache.bcf" file.
The EnScript below quickly parses selected "RecentFilecache.bcf" file(s). It also has an option to automatically bookmark any files referenced in the "RecentFileCache.bcf" file.
ShareThis
Posts
2 comments:
Thank you for posting! Will there be an EnCase 7 version soon?
EnCase v7 version posted
Post a Comment