Wednesday, April 1, 2015

EnCase v7 EnScript to carve RecentFileCache.bcf data from selected file(s)

The following EnScript can be used to quickly search for and parse RecentFileCache data from memory images, unallocated space or the allocated RecentFileCache.bcf file.

To use, simple blue check whatever file(s) you want to process, then run the EnScript.

Output is to the console and bookmarks:

c:\windows\system32\lsass.exe
c:\windows\system32\lsm.exe
c:\windows\system32\oobe\windeploy.exe
c:\windows\system32\sppsvc.exe
c:\windows\system32\winsat.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\mcbuilder.exe
c:\windows\system32\winhost.exe
c:\windows\system32\logonui.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\userinit.exe

Download EnCase v7 EnScript here

2 comments:

Suprman23 Friday, 10 April, 2015  

What filters does EnCase not support?

Lance Mueller Friday, 10 April, 2015  

Sorry, I am not sure I understand what you are asking?

Post a Comment

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles