Thursday, February 4, 2016

EnCase v7 EnScript to parse WiFi/Network Profiles

This is an updated EnCase v7 EnScript to parse the WiFi profiles that may exist on Windows 7/8/10 system in the following locations:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles
Running the EnScript displays a simple message box:

The EnScript will then search the case for all SOFTWARE registry hives that it can find based on name and location (\windows\system32\config) and attempt to parse any WiFi profile keys that may exist. All output is to the console in CSV format for quick import into Excel (copy and paste).

The EnScript parses the profile name, DNSSuffix (helpful sometimes in identifying owner or location of the network), MAC address of the access point, creation date/time of the profile & last connection date/time to the profile.

If you have access to the Google geolocation API, you can then possibly geolocate the WiFi access points based on the MAC address, which can tell an interesting story when also lined up by dates & times.

Download Here

Thursday, January 7, 2016

EnCase v7 EnScript to export files based on condition and maintain original file path

A reader asked if it was possible to automate the export of files based on extension and then also maintain the original file path once they are exported.

This is certainly possible, but there are some risks of doing this since the original file that is identified by extension may be deeply nested in a sub directory, whose original path is close to 260 characters in length, then when exported, it is placed into a new export location, but also maintains the original file path, plus adding the new export path, pushing it over the 260 character limit.

The following EnScript is a slight modification of a previous export by extension EnScript that uses a condition to define the files you want to export, in this case by extension, and then exports them to a base export path and maintains the original file path into the export location.

Any file with a new export path length of 260 or greater is skipped and printed in the console window. 

Run the EnScript:

After you set the export path, you will be presented with a condition window. Create a condition:

Click "OK" and once the EnScript is done, check the specified export path.

Download here

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles