Thursday, January 7, 2016

EnCase v7 EnScript to export files based on condition and maintain original file path


A reader asked if it was possible to automate the export of files based on extension and then also maintain the original file path once they are exported.

This is certainly possible, but there are some risks of doing this since the original file that is identified by extension may be deeply nested in a sub directory, whose original path is close to 260 characters in length, then when exported, it is placed into a new export location, but also maintains the original file path, plus adding the new export path, pushing it over the 260 character limit.

The following EnScript is a slight modification of a previous export by extension EnScript that uses a condition to define the files you want to export, in this case by extension, and then exports them to a base export path and maintains the original file path into the export location.

Any file with a new export path length of 260 or greater is skipped and printed in the console window. 

Run the EnScript:




After you set the export path, you will be presented with a condition window. Create a condition:



Click "OK" and once the EnScript is done, check the specified export path.

Download here



2 comments:

Lee Skenderi Wednesday, 03 February, 2016  

Hi Lance, Thanks for the Enscript, I just used it and noticed that it does not look like the Enscript can export files located within a container i.e., Zips and Rars while maintaining the source folder structure. As you know, v6 was able to do this since it mounted containers as virtual folders and it looks this functionality is lost in v7 due to container contents saved in LEFs. Is there a way to modify the Enscript to account for files within these containers and still maintain original folder structure? Our organization is really looking for a solution for this in v7. Best - Lee S.

Lance Mueller Wednesday, 03 February, 2016  

Hi Lee,

Please contact me at the email list above-right so we can discuss and I can understand better exactly what you are trying to accomplish.

Post a Comment

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles