tag:blogger.com,1999:blog-1746946614390371171.post3456147187907861498..comments2009-02-17T12:04:36.217-08:00Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.comBlogger3125tag:blogger.com,1999:blog-1746946614390371171.post-53406732800761977302009-02-17T12:04:00.000-08:002009-02-17T12:04:00.000-08:00Lance, two questions, 1. is there an updated version of the script that puts the output into the records tab that works in 6.12 and 2. is it possible to modify the script so it creates a csv automatically with the results. This is a great script by the ways. Thanks for sharing.yanivhttp://www.blogger.com/profile/13815590619108689991noreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-56334029877977292162008-09-04T20:06:00.000-07:002008-09-04T20:06:00.000-07:00Lance,<BR/><BR/>FYI, USB Device History EnScript.<BR/>This script supplies some very useful info. I noticed that the <BR/>volumeByteOffsetStart was incorrect<BR/>in the GetMounted Devices procedure. When verified against encase / winhex - the volume offset was wrong as the last byte is not being read in - "offset = tempfile.ReadBinaryInt(8) <BR/>This is because the uint cant cope so I changed it to a long and it works fine and was verified.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-89509798071793315442008-06-25T19:56:00.000-07:002008-06-25T19:56:00.000-07:00The script doesn't work with new version 6.11, any updates you can post please?Anonymousnoreply@blogger.com