tag:blogger.com,1999:blog-1746946614390371171.post449508559546845684..comments2010-07-08T12:58:32.819-07:00Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.comBlogger27125tag:blogger.com,1999:blog-1746946614390371171.post-2130514085188564812010-07-08T12:58:32.680-07:002010-07-08T12:58:32.680-07:00I have seen an Enscript like this once, but I do not have it.<br /><br />This enscript goes through the computer and finds all prefetch files and pulls the data out of them into a spreadsheet. The data that it pulls shows the name of the file, its location, and the previous times that it was ran. This script would be of great use in my investigations. Any help would be appreciated.<br /><br />Brannon Raines<br />brannon.raines@wellsfargo.comBrannon Rainesnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-36214589951390724022010-06-16T20:24:16.150-07:002010-06-16T20:24:16.150-07:00I would like to see an. EnScript that parses gigatribe chat files into a readable format.<br /><br />Tom Bell<br />KYOAG<br />tom.bell@ag.ky.govAnonymousnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-80947888994302788732009-04-22T12:21:00.000-07:002009-04-22T12:21:00.000-07:00AccessData's registry viewer product has a near feature called Auto RSR. This allows one to generate a registry report and include whichever keys desired. Something like this would make a nice Enscript. Especially if it gave the option to parse restore points.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-73659534555674603372009-04-10T12:29:00.000-07:002009-04-10T12:29:00.000-07:00I would like an EnScript that will parse DHCP history out of the registry restore points. i.e. I would like it to find, mount, and parse each restore point on the hard drive and list the following:<BR/><BR/>Assigned DHCP assigned IP Address<BR/>IP address Lease Start date/time<BR/>IP address Lease End date/time<BR/><BR/>It would be nice if it presented it in an easy to read timeline format.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-82198176194394567812009-03-23T09:45:00.000-07:002009-03-23T09:45:00.000-07:00I'm looking for an enscript that will export all selected files and rename them to either include the file name and/or the md5 with the correct extension appended to the end. Ideas?Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-55713967554396397542009-03-23T06:54:00.000-07:002009-03-23T06:54:00.000-07:00Carlos,<BR/>You might want to take a look at P2P Marshal for P2P stuff, funded by the NIJ.<BR/>http://p2pmarshal.atc-nycorp.com/<BR/>Though i should warn you its not perfect in my experience (others seem to like it - thought its missed stuff for me on partial installations).<BR/>RichRich2005noreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-66989181013003386202009-02-26T15:28:00.000-08:002009-02-26T15:28:00.000-08:00Hi <BR/>I am with DHS-Immigration and Customs Enforcement (ICE), Computer Forensic Lab at Puerto Rico.<BR/><BR/>What I like to see is and Enscrip to check Local User Profile for all other Chat Clients (Yahoo, MSN, etc.)Chat logs<BR/><BR/>P2P download Logs (Bittorrent, Limewire etc.)<BR/><BR/>Somehting that makes a quick report of their file trading and activity for tracking Child Porn.<BR/><BR/>carlos.a.negron@dhs.govAnonymousnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-23946981633395557132009-02-25T03:29:00.000-08:002009-02-25T03:29:00.000-08:00Hi Mueller,<BR/><BR/>Can a Enscript be written which can parse the live memory for gtalk chats and store the results in bookmark. I want gtalk only as they are not stored on the local machines.<BR/><BR/>Kush Wadhwa<BR/>(kushwadhwa@gmail.com)Kush Wadhwahttp://www.blogger.com/profile/10761246058955112644noreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-74223861540181352592009-01-30T16:27:00.000-08:002009-01-30T16:27:00.000-08:00I'd love an EnScript that would convert all the selected items to PDF with Bates numbers. Yes, I can do this by hand. Yes, it is better done by other tools, but I'm ending up doing "ediscovery in the field" more often than I'd like.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-49459753334942855302008-11-11T13:59:00.000-08:002008-11-11T13:59:00.000-08:00How about a script that would linearly copy out unallocated space, unused disk area, pagefile.sys, hiberfil.sys and start the hashing process one after the other as not to kill the machine? <BR/>Thanks a lot for this blog, it is very useful!Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-61350782964839955112008-11-10T11:37:00.000-08:002008-11-10T11:37:00.000-08:00Lance, sorry to butt in without a suggestion for a script but I was reading the suggestions when I saw that "a" was asking for a script which " parses out and bookmarks the ramnents of (live)messenger out selected files (unallocated/pagefile/hyberfil)". If this is referring to MSNP remnants of conversation my colleague has already done this - http://computerforensics.parsonage.co.uk/downloads/MSNTextFragmentsFinder.zip<BR/>Hharryparsonagehttp://www.blogger.com/profile/11774876007771263349noreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-33399648932999735932008-11-08T05:57:00.000-08:002008-11-08T05:57:00.000-08:00How about being able to do anything from Enscript that you can do from the GUI. Ever hear of automation? You can only recover folders when you add a device in v6. However, last I checked, you can't programmatically add a multi-file dd style image. In all honesty, though, I have stayed away from v6 because I get "Out of Memory" errors when I approach a large number of "files". The same case doesn't give me problems in v5 but alas, v5 is even worse with automation, can't perform a sig and hash search.Greg Kelleyhttp://www.blogger.com/profile/11087813718826491542noreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-64763563643021865112008-10-31T13:10:00.000-07:002008-10-31T13:10:00.000-07:00Lance...<BR/><BR/>How about an EnScript that will rip through the registry based on the white paper and spreadsheet that I sent you...<BR/><BR/>Dan P.Dannoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-91511853030083578042008-10-29T21:11:00.000-07:002008-10-29T21:11:00.000-07:00How about a "First Run" script which combines come of the basics and outputs into a csv format with date being the first column and time the second column. For example the basics could include:<BR/>-USB Information <BR/>-Mounted Drives<BR/>-Parse Link Files<BR/>-MAC of all files between dates<BR/>-Event logs(Limited to default locations)<BR/>-MRU's from Registry<BR/>-WEP<BR/>-Printers<BR/>-Prefetch<BR/>-Internet History (Limited to default locations)<BR/>etc<BR/><BR/>Although some of these scripts currently exist they do not output in a standardized format. The "First Run" script would mean a first responder could get an instant report on scene of the basics immediately after imaging has been completed.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-67820003726595416082008-10-29T07:28:00.000-07:002008-10-29T07:28:00.000-07:00I'd like and EnScript that leveraged Volatility (a.k.a. the greatest thing since sliced bread) against a mem dump file. The GUI popup would allow the user to 'check box' the various Volatility command line options. The output would be a CSV file and would appropriately associate the output of the selected options to the correct process (PID). The idea is that it creates an easy read on a per process level. Volatility provides a lot of disparate info on each process. This EnScript would essentially format the Volatility output in a "makes sense" manner.jobelhttp://www.blogger.com/profile/06794676714562793474noreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-44919392291930188162008-10-28T07:55:00.000-07:002008-10-28T07:55:00.000-07:00An easy, but always requested one:<BR/>Dialog-"Where", and "Named"<BR/>Output-Case Folder Structure!<BR/>(with an option for For/eDisc/Inv/etc)Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-46241077681392205432008-10-27T07:44:00.000-07:002008-10-27T07:44:00.000-07:00I would like an enscript that creates a timeline of every entry in the case, I have found the timeline functionality of encase unstable and awkward to work with. By all entries I mean MAC times, Reg c times, Internet history access/update times, and other user defined times (such as network logs, etc.). This way, an investigator can create a timeline of all of the events on the system and use it to rebuild the history. He will be able to integrate the network/system logs to correlate these events.aliarastehnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-90016131328344928332008-10-27T07:36:00.000-07:002008-10-27T07:36:00.000-07:00I would like to see an enscript that diffs active registry files and system restore points registry files and exports only the changesSALnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-9483829818052918782008-10-24T08:51:00.000-07:002008-10-24T08:51:00.000-07:00Hans,<BR/><BR/>That's a good idea, but it can already be easily accomplished without an EnScript in about 20 seconds using a condition. <BR/><BR/>Just take your list of paths/files that you want to know about and create a condition that says "if full path contains" and then paste your list of paths, then run. The only files that will be shown to you are those that match your path criteria.Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-63915626952031386882008-10-24T08:33:00.000-07:002008-10-24T08:33:00.000-07:00<B>Interesting things enscript</B><BR/><BR/>I would like a solution for a quick scan of interesting things that possible resides on a Windows disk.<BR/>Purpose is to find out which interesting things resides in the data. Its purpose is not to export or carve data. Just knowing that interesting things are present is enough to set up a plan to investigate that data.<BR/><BR/>The script should look for particular file names/file path/extensions<BR/><BR/>The script should pick the particular names, etc. from a reference file. Every investigator should be able to edit the reference file, so he/she can put in names/path/etc. he/she wishes to be searched for. I think this will be a great solution for investigators all over the World. In many cases particular software, software names and (path) names are language/country dependent.<BR/><BR/>A further advantage is, that the investigator self decides what he/she is looking for. <BR/><A HREF="http://www.hansheins.nl/forensics/Enscipt-wishes/Enscript_wishes.pdf" REL="nofollow"><BR/>Further Info</A>hanshttp://www.blogger.com/profile/10133092635400237609noreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-37545385443151509812008-10-23T23:53:00.000-07:002008-10-23T23:53:00.000-07:00I would like to have an Enscript that parses out and bookmarks the ramnents of (live)messenger out selected files (unallocated/pagefile/hyberfil)Ahttp://www.blogger.com/profile/09695445057660117747noreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-22069975380448082472008-10-23T10:25:00.000-07:002008-10-23T10:25:00.000-07:00I would like to have an Enscript witch can map/parse the Vista-Filenames/paths to the Thumbscache entries.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-84806799817562132102008-10-22T19:33:00.000-07:002008-10-22T19:33:00.000-07:00Some interesting ideas so far. Albee, keep dreaming! ;)<BR/><BR/>Paul Bobby, what kind of information are you interested in from the DCOM database?<BR/><BR/>Skype is a good idea.<BR/><BR/>Larry, I think I can modify the script I have posted here to do what you want.<BR/><BR/>Keep the ideas coming!Lance Muellerhttp://www.blogger.com/profile/15789264000499223230noreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-75911078088966236342008-10-22T16:09:00.000-07:002008-10-22T16:09:00.000-07:00Producing forensic evidence from the DCOM database files on a deadbox hard drive.Paul Bobbyhttp://www.blogger.com/profile/10685628856061244051noreply@blogger.comtag:blogger.com,1999:blog-1746946614390371171.post-10889598203480758292008-10-22T15:43:00.000-07:002008-10-22T15:43:00.000-07:00I would love to have an Enscript that can parse the meta data out of office files in bulk (i.e. All checked files) and would write them to a tab delimited text file I can import and post process in a database.Larry E. Danielhttp://www.blogger.com/profile/09201368667213383998noreply@blogger.com