Thursday, January 7, 2016

EnCase v7 EnScript to export files based on condition and maintain original file path

A reader asked if it was possible to automate the export of files based on extension and then also maintain the original file path once they are exported.

This is certainly possible, but there are some risks of doing this since the original file that is identified by extension may be deeply nested in a sub directory, whose original path is close to 260 characters in length, then when exported, it is placed into a new export location, but also maintains the original file path, plus adding the new export path, pushing it over the 260 character limit.

The following EnScript is a slight modification of a previous export by extension EnScript that uses a condition to define the files you want to export, in this case by extension, and then exports them to a base export path and maintains the original file path into the export location.

Any file with a new export path length of 260 or greater is skipped and printed in the console window. 

Run the EnScript:

After you set the export path, you will be presented with a condition window. Create a condition:

Click "OK" and once the EnScript is done, check the specified export path.

Download here

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles