EnCase v8 EnScript - Check hash values for tagged files to VirusTotal

This is an update to the original (v6 & v7) EnScript to check the hash value(s) of tagged files to VirusTotal.

Tag any file(s) you want to check with "Check VT":

Run the EnScript and provide either a public or private API key:

The console will provide results and all files with a score greater than zero are bookmarked along with the detected malware names.

Download Here

EnCase v8 EnScript - Check executables to VirusTotal

I have updated the EnScript to send hash values for all executable/DLLs to VirusTotal for analysis. This version works in EnCase v8 and the source code is included for customization. 

You must provide either a public or private VirusTotal API key:

This EnScript will ignore duplicate hash values and only send unique values to VirusTotal. All hash values with a score greater than zero are bookmarked with their detection name:

Download Here

EnScripts Currently Offline - being moved

All the EnScripts are currently unavailable while I move them to a different storage location. May of the old links will be broken, please just email me and I will provide an updated link and/or email it directly to you.

UPDATE:

EnScripts:
 https://github.com/lancemueller/EnCase-EnScripts

Practical Evidence files:
https://www.dropbox.com/sh/q0w7fy25qyltalh/AAD_VbL27cpa2bKuCtKaCuhaa?dl=0
 

EnCase v7 EnScript to parse WiFi/Network Profiles

This is an updated EnCase v7 EnScript to parse the WiFi profiles that may exist on Windows 7/8/10 system in the following locations:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles

Running the EnScript displays a simple message box:

The EnScript will then search the case for all SOFTWARE registry hives that it can find based on name and location (\windows\system32\config) and attempt to parse any WiFi profile keys that may exist. All output is to the console in CSV format for quick import into Excel (copy and paste).

The EnScript parses the profile name, DNSSuffix (helpful sometimes in identifying owner or location of the network), MAC address of the access point, creation date/time of the profile & last connection date/time to the profile.



If you have access to the Google geolocation API, you can then possibly geolocate the WiFi access points based on the MAC address, which can tell an interesting story when also lined up by dates & times.

Download Here

EnCase v7 EnScript to export files based on condition and maintain original file path

A reader asked if it was possible to automate the export of files based on extension and then also maintain the original file path once they are exported.

This is certainly possible, but there are some risks of doing this since the original file that is identified by extension may be deeply nested in a sub directory, whose original path is close to 260 characters in length, then when exported, it is placed into a new export location, but also maintains the original file path, plus adding the new export path, pushing it over the 260 character limit.

The following EnScript is a slight modification of a previous export by extension EnScript that uses a condition to define the files you want to export, in this case by extension, and then exports them to a base export path and maintains the original file path into the export location.

Any file with a new export path length of 260 or greater is skipped and printed in the console window. 

Run the EnScript:




After you set the export path, you will be presented with a condition window. Create a condition:



Click "OK" and once the EnScript is done, check the specified export path.

Download here

EnCase v7 EnScript to export files by extention

This is an updated version of an EnScript I wrote in 2009 to export files in a case based on file extensions. The original description & EnScript is here.

This version was rewritten for EnCase v7 with exactly the same functionality.

Download v7 here

EnCase EnScript to find files on remote systems by MD5 hash - GO FETCH!

I have had a few recent requests for an EnCase Enterprise EnScript to help find files on remote systems. The following EnScript accepts a plain text file (ASCII or Unicode) that contains MD5 hash values, one per line. The EnScript also contains a condition feature that allows the user to refine what files on the remote system they want to hash and compare to the list. Choose a text file, define a condition, go fetch.

The logical choice is to define a condition that contains specific file sizes (logical size). This will cause the EnScript to only hash the remote files that match the file sizes (or path or other criteria) you specify, dramatically speeding up the searching process.

The initial screen prompts for the role, a list of target systems (hostnames, IP addresses or IP ranges) you want to search and a text file that contains MD5 hash values:

 

The next screen allows you to define a condition. I strongly recommend using the logical size to reduce the number of remote files that need to be hashed and then compared with your list. If you do not have logical sizes of the files you want to search for, you can use other criteria such as name, path or other metadata, if feasible. Its important to remember that this is a normal condition used by EnCase, therefore if you do not specify any criteria (and leave it blank), no remote files will match that criteria and no files will ever match. So, if you do not have any criteria to help refine and reduce the remote files that need to be hashed and compared, you need to at least define a filter that includes everything, such as logical size >0.

 

Once launched, any files that match your filter criteria are hashed and then compared against the list of MD5 hash values you provided. If a file's MD5 matches, a LEF is created (in the case's default export folder) that contains all the files on that volume & host that match the MD5 hash values. Original paths are maintained:

 

 

EnCase v7 download here

EnCase v7 EnScript to check files to VirusTotal - Updated

In October 2013, I wrote an EnScript that checked files that are tagged with the "VirusTotal" tag to VirusTotal. That original EnScript simply calculated the hash value of the tagged files and then sent it to VirusTotal for evaluation using their API. The original EnScript used an external EXE (VTBookmark.exe) that I wrote in C# to do the actual communication to the VirusTotal website.

I have updated this EnScript to include the name of the detected malware that each AV product associates with the hash value. 

I have also rewritten it to no longer require the external "VTBookmark.exe" application. All the processing and communications are handled natively by EnScript now.

When using this EnScript, any hash value that has a positive value (> 0) is bookmarked. The console pane will display the status of each hash value, but only those with a positive value are bookmarked.  Each hash value can have one of three values:

1. A score of '0' signifies a hash value that is known to VirusTotal, but is not identified by any of the AV products as a risk.
2. A score greater than zero (> 0) represents the number of AV products that recognize the hash value as a potential risk
3. A score of '-1' signifies a hash value that is unknown to VirusTotal. This means the file contents have never been sent and/or analyzed by the AV products.

VirusTotal restricts the use of a public API key to four requests per minute. Therefore, if you tag more than four files, the EnScript will pause in order to wait for the time restriction applied to public (free) API keys. The console will indicate when this is happening:


When run, you can choose to tag specific files (recommended when using a public API key) or not have any 'VirusTotal' tag and the EnScript will conduct a file signature analysis and send the hash values of all identified executable files to Virus Total (recommended only if you have a private API key).

This EnScript can be used with a private VirusTotal key with no time limit restrictions and can process several thousand hash values per hour.

Download v7 EnScript here