EnCase App Central

Extend the power of EnCase. Access, download and install software apps built by expert EnScript developers that help you get down to business – faster.

Filters

Filters

No applications available with selected criteria, please modify your search.

$Filename Attribute Dates of tagged file(s)

This EnScript will display the (8) eight NTFS time-stamps associated with each tagged file/folder in EnCase.

APFS Date-Added Decoder

This script decodes the date-added timestamps present in the internal $Catalog file created by EnCase for APFS volumes.

Active Directory Account Importer For Secure Storage

Android Screen Unlock

This script is designed to remove basic PIN, password or pattern lock from a connected device. This method was tested and works on Android versions from Gingerbread (2.3) to Jelly Bean (4.1). The Consol.

Apple System Log (ASL) File Parser

This EnScript parses user-specified Apple System Log (ASL) files in the current case. Output is by way of bookmarks and a tab-delimited spreadsheet file.

Ares and Lime Pro Dat File Decryptor

This script will decrypt the data from the .dat files used by the Ares and Lime Pro P2P file trading programs.

Ares and Lime Pro Registry Report

Assisted PST/OST Mounting in EnCase

Attribute and Field Helper Plugin

This plugin allows the examiner to view and bookmark the information shown under the Attributes and Fields tabs en-masse rather than on a per-file/folder basis.

AutoCAD DWG Summary Info Reader

This EnScript allows the examiner to read document summary information from AutoCAD DWG files. The script supports file-versions from 2004 to 2013.

BAM Registry Parser

This script Background Activity Moderator (BAM) Registry entries generated by later versions of Windows 10.

Binary Plist Finder

This script searches specified items for binary property-list (plist) files. It was designed primarily to recover plist files from unallocated clusters but can also be used to recover plists embedded in.

BitTorrent Bencode File Finder

This EnScript can be used to find and decode bencoded files of the type used by several BitTorrent clients.

BitTorrent Bencode Viewer Plugin

This is an EnCase plugin that allows the examiner to view the bencoded files of the type used by many BitTorrent clients.

Bookmark Filter Plugin

This self-installing plugin allows the user to select bookmarks matching a given condition. It is particularly useful when trying to identify bookmarks containing specific text in the comment.

Bookmark and Decode exFAT Directory Entries

This script bookmarks the exFAT directory-entries for the highlighted file/folder or selected files/folders in the current view; it is primarily designed to allow the examiner to view exFAT timestamps t.

C-TAK (Cyber-Threat Analytics Knowledgebase) Trial Version

C-TAK provides examiners with accurate identification of cyber threats that may directly impact investigations. The C-TAK trial includes Keylogger, Rootkit and Trojan datasets built in.

CD Image Loader Plugin

This EnScript loads one or more CD/DVD-ROM ISO images into the current case. Supports multi-part images of the type created by FTK Imager.

CUPS Printer Control-File Parser

This script parses CUPS (Common UNIX Printing System) printer-control files of the type found on macOS.

Case Analyzer and Sweep Enterprise Data Extraction

Use this script to batch-extract selected Case Analyzer and Sweep Enterprise reports to comma-delimited spreadsheets.

Categorize & Bookmark by File Extensions

EnCase v7 EnScript to define criteria in a condition dialog and then bookmark those files into bookmark subfolders based on extensions

Chrome History Transition Parser

This script is designed to parse the transition field from records in the visits table of the Chrome/Chromium History SQLite database file.

This is a File Mounter. Like the V6 file mounter, but for V7 and to mount the files not included in the Evidence processor.

Comprehensive Case Template

This template may serve you as basis for your own specific template and includes many Bookmark folders for often encountered topics during your exams.

Contextual Data Builder

Importing customer contextual data enables you to integrate your enterprise or third-party database of whitelisted, blacklisted, and watchlisted hashes as you extract, transform, and load data to the an.

Copy Files With Path

This script is designed to copy files (those that are entries) into a nominated folder and/or logical evidence file whilst still preserving each one's path. It will work in triage mode.

Copy Web Browser Files

A simple script used to identify all browser history cookie and cache files in a case and copy them out for further processing using 3rd party tools.

Cortana Search Decoder

Decodes the search terms stored in IndexedDB.edb files used by the Microsoft Windows Cortana search function.

Create Hash Library From Multiple Hash Lists

This script is designed to create/update a hash library using the hash-values contained in one or more tab-delimited hash-list files with CR/LF line-endings.

Create LEF From Folders Using Logical and UNC Path

Creates an EnCase logical evidence file from the contents of one or more folders specified by the user.

Create Result Set Excluding Unwanted Items

Allows the examiner to create a result-set that excludes unwanted items by way of them having a 'known' hash value or other undesirable properties (name, size, file extension, etc).

Create Result-Set From Responsive Items

This script is designed to create a result-set from both entries and records (artifacts) in a single pass.

Create Result-Sets For Hash-Categories

This script creates result-sets for each of the hash-categories associated with active hash-sets contained in the current case's active hash library/libraries.

Create Result-Sets For Specific Document-Types

This EnScript allows the examiner to create result-sets containing items matching user-specified file-types.

Credit Card Number Search With Luhn Verification

DFLabs DIM Integration-NG

Created by DFLabs this EnScript enables you to add EnCase evidence and bookmark data to IncMan-NG suite.

DFLabs IncMan Integration-NG

This EnScript allows the user to upload remote node snapshot information from Sweep Enterprise into IncMan-NG the Incident Response Management from DFLabs.

This script parsers user-specified .DS_Store files created by Mac OS X. One of the most common reasons for wanting to examine these files is to determine the original name and path of files/folders in t.

Data Extraction Utility

This script is designed to extract one or more blocks of data from the file highlighted in the EnCase GUI.

Deleted SQLite Database File Recovery

This script is designed to recover deleted database files last modified by SQLite version 3.7 or later.

Detect Similar Text Content

Drive Space Audit

This EnScript will audit the space of all devices in the case. A table will be built in the bookmarks tab as a summary to show usage of devices in the case.

Dumpkeychain is a Windows utility for decrypting credentials from Mac OS X system and user keychains given the associated system-key-file or keychain-password respectively.

E-mail Address Finder

EMLX to EML Mail Converter

Convert Apple Mail EMLX files to EML/MBOX format, which can be then read by other e-mail clients and processed by EnCase.

EVF2 Evidence-File Segment Extraction Utility

This is a proof-of-concept EnScript designed to extract data from one or more EVF2 evidence-file segments in the event of a hardware or software failure.

EVTX Log Entry Finder

EnCase Integrated Threat Toolkit (EITT)

EnCase Integrated Threat Toolkit (EITT) is a GUI interface and aggregate for a number of EnCase® Enterprise functions and over 15 open source tools designed to assist in DFIR investigations.

This script allows an EnScript developer to quickly identify newly introduced classes, methods, and properties in EnCase.

EnParse - 30-Day Free Trial

30-day free trial of EnParse. Find what is in multiple evidence files at once without full export, prepare useful reports for clients.

EnScript Editor Utilities Plugin

This helpful EnScript lets you search all your downloaded EnScripts and either launch them or open the folder where they were found.

EnScript to send file metadata directly to Splunk

Endpoint Investigator Network Utility Plugin

This is an Endpoint Investigator Network Utility plugin that allows the examiner to import one or more network-nodes or IP-ranges from a nominated tab-delimited text-file in MS Windows format. It can al.

Endpoint Investigator Snapshot Scanner

This script is designed to validate the prescence of EnCase Endpoint Investigator agents running on multiple endpoints.

Endpoint Security Registry Value Extractor

This script is designed to extract Registry values from one or more result-LEFs created by EnCase Endpoint Security. It will process all Lx01 and L01 evidence files in the folder specified by the user.

Evidence File Converter

EnScript converts blue-checked EnCase evidence files in the evidence tab to bitstream, dd-type disk images with the option to use the Apple multi-part DMG naming convention.

Exif GPS Information Reader

Search for, bookmark, and decode Exif metadata with the option to view GPS coordinates in Google Earth.

Exif Viewer Plugin

The is a self-installing application plugin that enables the user to right-click on HEIC and JPEG files in order to view and bookmark the Exif metadata contained therein.

Export Result-Set to Project VIC

Export and Bookmark Files Based On Extension

Use this EnScript to extract files into separate folders based on extension. The script will create a tab-delimited index file containing the file-system metadata specified by the examiner. Detects and .

Export by Extension

Extract Block Data Excluding Headers

This script is designed to assist the examiner to extract files from block-based storage structures where each block has a fixed length and is preceded by a header also having a fixed length.

Extract Bookmarked Items With Bookmark Folder Path

This EnScript extracts selected bookmarked items to a nominated folder whilst preserving the bookmark-folder path. The examiner can opt to extract e-mail records as MSG.

Extract Selected Folders in Current View

This script is designed to extract selected folders in the current view to a nominated export folder. Only folders that contain one or more child objects will be processed. Files themselves will not be .

Facebook MSG Finder

File Block Hash Map Analysis

This EnScript uses block-based hash analysis in order to locate and recover one or more target files in circumstances where other methods are likely to fail.

File Description and Extension Tally

File Directory Listing

File Properties is a script to easily cut/paste properties on selected files to your investigation report without using bookmarks.

FileRemediator uses EnCase's built-in wiping function to target and wipe individual files and folders on a local device and then create all the necessary logs.

Find E-Mail Attachments By Extension

Finds e-mail attachments with file-extensions specified by the examiner. Searches archive attachments (including nested archives) by default.

Find Entries by Hash Category Plus (EnFilter)

Find IPV4 Addresses

Find Unique Records by Hash (EnFilter)

This is a modified version of the Filter in EnCase to Find Unique Entries by Hash, I have modified the filter to work on records and will match on the MD5 hash.

Find and Parse Prefetch Files in Unallocated

This EnScript searches unallocated clusters for deleted prefetch data. If found, the EnScript will parse out the name of the executable, last run time and run count.

Flat File Export

This script is designed to copy tagged items into a single output-folder and report-on user-specified properties in the process.

GPT Partition Parser

This EnScript locates and bookmarks GPT partition-table information from devices in the current case.

Generate ED2K Hash Values

This EnScript will generate ED2K hash values for the purpose of comparing them to some known bad files based on those ED2K hash values.

Generic ESE Database Table Parser

This script will attempt to parse one or more tables from Extensible Storage Engine (ESE) database files specified by the user.

Generic SQLite Database Parser

This script allows one or more pre-defined queries to be run across SQLite database files with names matching those specified.

Generic XML Viewer Plugin

GigaTribe Download State Information Finder

The GigaTribe Download State Information Finder searches for information stored whilst a download is progressing on a GigaTribe user's computer.

GigaTribe V3 Chat Parser

HEIC Image Viewer Plugin

This plugin is designed to view the HEIC file currently highlighted in the GUI, including Exif metadata. GPS coordinates can be displayed using Google Maps.

HEIC, KTX and WebP Image File Converter

HFS Journal Parser

This app is designed to discover files that are hidden by rootkits. It will place all detected files into a LEF for further analysis. This may include the malware and additional files deemed important b.

Has Attachment by Category (EnFilter)

This filter works on Records in email and will return Records with Attachments that match the selected category. The Source of the filter can be viewed to see the changes made.

Hash Calculator Plugin

This EnScript plugin calculates a number of different hash values, either for complete files, or for a range of data. Hash values can be submitted to Virus Total automatically.

Hash Library Viewer

This script allows the examiner to view, bookmark and extract the contents of the current case's hash library.

Hash List Builder

Generate a matching file set for blue checked items that have had their MD5 hashes processed for import into EnCase Endpoint Security.

Hash List Importer

This EnScript is designed to create a new EnCase hash-library from a list of hashes in tab-delimited format, or from an NSRL hash-set.

Identify and Extract Date & Time Changes

EnScript to identify 4616 events (date and time change) that exceed a user specified number of minutes allowing the user to quickly discard Time Server syncs.

Index and Extract Mounted Archives

This script is designed to index mounted archive files and their contents relative to the case as a whole; also, to filter and extract this data into a logical evidence file (LEF) so it can be viewed as.

Item Ancestor Resolution

This script allows the examiner to identify the ancestors (emails, etc.) of items in a given result-set so they can be bookmarked and/or extracted.

JPEG File Exporter

View EXIF metadata found in JPEG images within EnCase-- no need for a third-party application to view GPS coordinates, camera make and model, etc.

JSON Viewer Plugin

This EnScript plugin allows the user to view and bookmark application data stored in JavaScript Object Notation JSON files.

Keyword Search and Proximity Extract

Keyword search and proximity extract is designed to do Fuzzy string extraction by grouping relevant string fragments together.

Keyword Search with Range Bookmarking

This EnScript allows the user to perform a raw or transcript keyword search of entries and records, and bookmark a user-specified range of bytes before and after each search-hit.

Known _met Search and Parse

Link File & Jump List Parser

This EnScript parses recent file-system activity from Microsoft Windows shortcut-link and jump-list files.

Logon Banner and Text (from SYSTEM registry hive file)

This is an EnScript that extracts and bookmarks the local logon banner and logon text. Verifies corporate policies, such as "further used denotes no expectation of privacy".

Low Hanging Fruit

Low Hanging Fruit Please extracts file name path and MD5 to a SQLite database that also contains an Item Moniker data for each entry.

This script will provide a clean view of computer activity by creating a chronological report of file-system metadata.

MFT Date Comparator

This script is designed to identify potentially suspect files by analyzing timestamp differences in the NTFS MFT standard information and filename attributes of each file.

MFT Record Bookmark Plugin

This plugin has been designed as primarily as a classroom aid to assist in the examination of MFT records and their component sections (MFT-record attributes).

MP4, MOV, M4A and HEIC File Carver

This EnScript is designed to carve MP4, MOV, M4A and HEIC files as defined by the ISO base media file format, ISO/IEC 14496-12.

Mac OS X AutoLogin Password Decoder

This is a small utility that will decrypt the user-password for a user set to to automatically log-in to a Mac OS X system.

Mac OS X BinaryCookie File Parser

This script parsers user-specified Mac OS X binary cookie files. Output is by way of bookmarks and a tab-delimited spreadsheet file.

Mac OS X Log Entry Finder

This script searches user-specified Mac OS X plaintext log-files for log-entries containing one or more keywords.

Mac OS X OpenBSM Audit Log Parser

This EnScript parses Mac OS X OpenBSM audit-logs, which although deprecated, may still contain details of events relating to audit-control, user-logon and group/user creation/modification/deletion.

Mac OS X Outlook Mail Converter

This EnScript is designed to convert Microsoft Outlook *.olk14MsgSource and *.olk15MsgSource message-files to EML files and a logical evidence file that can be processed by EnCase.

Mac OS X Previous Versions Chunk Storage Parser

Certain Mac OS X applications support the storage of previous versions of files. This EnScript will recover those files and write them to a logical evidence file so that they can be examined.

Mac OS X QuickLook Thumbcache Parser

Mac OS X Time Machine Parser

This EnScript allows the examiner to resolve the backup paths of blue-checked files in a Mac OS X Time Machine volume without having to make a copy of the volume available to a Macintosh computer.

MacOS Var-Folders Name Converter

This script decodes the UUID and UID from the names of sub-folders under /private/var/folders in MacOS.

Manfreds Berichtsvorlage (NSRL 2.49)

Dieses umfassende Berichtstemplate kann als Basis für Ihre eigene Vorlage dienen. Sie ist sehr umfangreich und enthält Bookmark-Verzeichnisse für die häufigsten Topics Ihrer Unter.

Manfred's Comprehensive Case Template

This template may serve you as basis for your own specific template and includes many Bookmark folders for often encountered topics during your exams.

Manfred's Comprehensive Case Template (NSRL 2.49)

This template may serve you as basis for your own specific template and includes many Bookmark folders for often encountered topics during your exams.

Matching File Analysis

This script is designed to locate one or more files from a known set. It works with records as well as entries.

Matching File Creator

This EnScript allows the examiner to tag items of interest and export a tab-delimited CSV file with the name, MD5 hash value, and logical size of the selected tags.

Process Windows, Linux, and OS X memory images and find running processes, parents, create dates, and more.

Messenger Protocol Fragments

Microsoft Word ASD Document Viewer

This EnScript plugin allows Autosave Document (ASD) files to be extracted and opened with Microsoft Word.

Multiple Date Range Filter - Entries Only (EnFilter)

This EnScript filter allows the examiner to show/hide entries using multiple date-ranges and one of four different logic options.

NETSH Packet Capture

NETSH Packet Capture allows network traffic sniffing on Microsoft Windows 7 and newer machines using natively installed NETSH with a Servlet with Remediation from EnCase Endpoint Security.

NTFS Index Buffer Reader

NTFS $UsnJrnl Parser

This EnScript allows the user to parse valuable information logging NT file-system operations including time files that have been created, deleted and renamed.

NirSoft ESEDatabaseView Plugin

This plugin provides an interface to the NirSoft ESEDatabaseView executable so as to provide centralized reporting of Extensible Storage Engine (ESE, aka Jet Blue) databases through the use of bookmarks.

Nokia Lumia 610 SMS

Office 2007 Metadata Processor

Office 97-2003 Metadata Processor

This EnScript parses metadata from Microsoft Office documents of the format used prior to Office 2007.

OfficeRecovery 2013 Ultimate - Trial Version

Repair and examine the contents of corrupted files in collected evidence. Word Excel digital images and dozens of other formats are supported.

Old School Search Hit Viewer

The Old School Search Hit Viewer will display search hits in a table; the hits are highlighted with a user-specified amount of context visible around the search hit.

Outlook PST & OST Deleted File Recovery

PDF File Finder

This script is designed to find deleted PDF files using the header, '%PDF-#.#' (GREP), and the footer, '%%EOF'.

Parse single or multiple .EXE files and extract all information encoded into the PE (COFF) header. Also works on memory dumps or unallocated space.

Parse $I $Recycle.Bin Files

This script parses the original path, logical size, and date-deleted information from $I $Recycle.Bin files.

Parse MemProcFS UserAssist Files

Parse PE Executable for String Resources

This EnScript specifically targets a resource known as "VS_VERSION_INFO" which contains metadata about the specific executable, including the manufacturer name, original filename, version info and ot.

Parse Wireless Access Points in Vista, Win7, & Win8

EnScript to extract & display information about wireless networks that have been connected to. Supports analysis of Windows Vista, 7 & 8.

Parse the setupapi.dev.log of USBs

This EnScript will parse the setupapi.dev.log (Windows Vista/7) for USB connected events and display this in the console tab

Plist Viewer Plugin

Use an extended context-menu option to bookmark, decode and extract data contained in Apple property list (.plist) files; automatically view plist files embedded in other plist files.

Pre-Evidence Processing Tasks

Prefetch Dump (PFDump)

This EnScript parses application usage information stored in Microsoft Windows prefetch files. This version supports Window XP through Windows 10 and includes a run-count and one or more last-run dates.

Prefetch File Recovery

Print Spool - SHD & SPL Parser

This EnScript extracts and bookmarks the admin data from the printer shadow files and bookmarks EML print data from the printer spool files.

Quick Base64 Decoder

Quick Bookmark Folders

Quickly make bookmark folders for each device in your case. Automate making bookmark folders and subfolders for each device in your case. Along with bookmarking each device and each volume in the cas.

Quick Registry Browser

Quick View OST and PST Files and Extract to MSG

This script will attempt to mount the highlighted PST/OST file and display its contents so that messages can be previewed and/or extracted to *.MSG files.

RDP Cached Bitmap Extractor

This EnScript parses bitmap data cached by the Microsoft Windows Terminal Services (Remote Desktop Protocol - RDP) client.

Record LEF to Entry LEF Converter

This script converts logical evidence files (LEFs) containing records to ones containing entries. It may prove useful when working with applications that can't open record-LEFs.

Record to Excel

Use Record2Excel to export records to Microsoft Excel. This script works with any records list which can be tagged. It will export all record properties (fields values) to Excel. Requires Microsoft E.

This EnScript runs RegRipper directly from EnCase. Automatically bookmark results or load them in a Microsoft Word / Open Office document. Requires RegRipper.

Registry Files Exporter

Registry Viewer Plugin

This script allows the examiner to to use a right-click context-menu-option or keyboard shortcut to view Registry hive files (SYSTEM, SOFTWARE, SECURITY, SAM, NTUSER,DAT, etc.).

Remote Agent Deployment

Calculates the volume based on logical size in bytes per month based on MAC times for an eight year time frame that are not tagged as 'Known'.

Run Condition As Filter

This download consists two filters designed to make it easier to locate, edit, and launch conditions from multiple locations. They also make it easier to create modified copies of the conditions that.

SEEB USB - Mounted Devices Report

Script will create detailed Excel, CSV, console & bookmark reports on Mounted, USB, portable devices found in the registry and setupapi logs.

SQLite Blob Extractor

SQLite Free-Page Parser

This EnScript is designed to read and decode unused pages from SQLite database files, pages that may contain deleted data.

SRUM Database Parser

This EnScript parses the System Resource Usage Monitor (SRUM) ESE database, SRUDB.dat, which is located in the %SYSTEMROOT%\System32\sru folder

Safari Evidence Processor Module

Safari Form Values Decryptor For Windows (SFVDWIN)

Use this tool to extract the autofill form values from the encrypted Form Values plist that Safari uses. It requires the user's keychain and associated password to decrypt the data.

Search For Valid Bitcoin Addresses

Search Hits Preview

Search and Bookmark Specific Data Types

This EnScript allows the examiner to search for one or more keywords and bookmark the resultant search-hits using specific data-types (picture, ROT13, low ASCII, hex, etc).

Serialized Property Storage (SPS) Reader

This EnScript mounts all SYSTEM registries found in the current evidence, parses the Application Compatility Cache registry key and output the result onto the console, bookmarks and tab-delimited CSV.

Show or Hide Items with a Selected Tag

Skype Chatsync IP Addresses

This EnScript will parse out the IP addresses from Skype chatsync files and write them to the console as well as bookmark the artifacts.

Skype S4L Database Parser

This script parses cached messages and profile-information from the 'messagesv12' and 'profilecachev8' tables of Skype 's4l-*' SQLite-database files.

SysTools Outlook Exporter v2.2 (Demo Version)

SysTools Outlook Exporter is an EnCase plugin which allows you to export email evidence found with EnCase forensic to an Outlook (.pst) file WITHOUT Outlook.

System Snap Shot

System Snap Shot collects information regarding software used, system settings, user names, last login information, and connections made that would allow data to be moved off the machine.

Team Cymru Malware Hash Registry Search

ThreatAnalyzer Automation Toolkit

ThreatAnalyzer provides best in class dynamic file analysis which enables the investigator to quickly determine any behaviors a given file sample may exhibit.

ThreatGRID Malware Analysis and Intelligence for EnCase

Threat Grid Malware Analysis and Intelligence for EnCase® provides direct integration with Threat Grid, the first unified malware analysis and threat intelligence solution. Threat Grid provides i.

This script parses the thumbcache_*.db files used to store thumbnail images generated as a result of viewing pictures in Windows Explorer under Windows Vista, 7, 8/8.1 and 10.

Timezone Info Prior to Processing

This EnScript allows the Examiner to determine the timezone settings of each device prior to running the EnCase Evidence Processor.

UNC Path Preview and Acquire

Use this script to preview the files and folders on a remote share using a UNC path. Specific user credentials can be supplied where necessary.

URL and Windows File-Path Finder