Integrating Python with Leading Computer Forensics Platforms by Chet Hosmer

Author:Chet Hosmer
Language: eng
Format: epub, pdf
ISBN: 9780128099506
Publisher: Elsevier Inc.
Published: 2016-09-26T04:00:00+00:00

Fig. 4.8 Select files for export to python.

Once the desired files are selected, you choose EnScript from the EnCase menu bar. This will provide a list of available EnScripts. In this example, we choose the SelectedFiles EnScript from the dropdown list (see Fig. 4.9).

Fig. 4.9 Select and launch the SelectedFiles EnScript.

The results of the Python script launched by the SelectedFiles EnScript can be viewed by selecting in the Console Window of EnCase depicted in Fig. 4.10.

Fig. 4.10 Select and launch the SelectedFiles EnScript.

As you can see, the underlying Python script displays the informational messages that identify the Python script that was executed along with the path where the EnScript exported the selected files.

C:\Python27\EnCase\Basic\pyEnScript.py

C:\Users\Chester\Documents\EnCase\Cases\PYTHON-DEMO\Export

In addition, the script generates a list of the files contained in the Export folder as shown in Fig. 4.10 identified by the associated A marker. These are the same files that were selected in Fig. 4.8, with the addition of a Globally Unique Identifier or GUID. Since the selected files could come from multiple directories and locations, it is feasible to encounter different files with the same names. Thus, the GUIDs provide a method to distinguish files that have the same simple name. For example, the filename mem.raw in the original EnCase Evidence view (Fig. 4.8) now becomes mem_CC394FE7F293898189D7EB733B727E0E.raw when exported. The __CC394FE7F293898189D7EB733B727E0E is the GUID assigned and inserted into the mem.raw filename.

Finally, the results are also written to a bookmark that is defined in the EnScript. Fig. 4.11 depicts the selection of the Bookmark Python Selected File Results. As you can see, these are the same results that were written and viewed in the Console Window, but now they are part of the Case File.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.