Tools

VirusShare.com is a repository of malware samples to provide security researches, incident responders, forensic analysts, and the curious access to samples of malicious code because sharing is caring! Created an EnCase Cybersecurity v5.5 Hash Sets of the VirusShare.com 0 thru 129 torrents using the logical size and MD5 sums for improved hash analysis.

VirusShare.com is a repository of malware samples to provide security researches, incident responders, forensic analysts, and the curious access to samples of malicious code because sharing is caring! Created an EnCase V7 Hash Library of the VirusShare.com 0 thru 129 torrents using the logical size and MD5 sums for improved hash analysis.

This EnScipt creates thumbnails from selected movies and adds those images to a Logical Evidence File. It creates a ‘readme’ file per movie with information about the original file and the images created. Once created these items can be easily added to a case.

This script creates an EnCase hash-library from the VirusShare hash-lists available to download from https://virusshare.com.

This is a self installing EnScript plugin that allows the examiner to extract and view SQLite database files using a designated external viewer application.

This script will prompt for a keyword from the user then search selected tagged items for that keyword. It will then check the search hit to see if it is the file name in a UsnJrnl record entry. If it is a UsnJrnl record it will parse selected fields from the record and export them to a .csv file in the case default export folder. Useful for searching for change journal records in slack and unallocated space.

This is a Volume Shadow-Copy Service (VSS) examination EnScript designed for EnCase.

This EnScript plugin (formerly called the Last Folder Plugin) provides a number of utility functions.

Dieses umfassende Berichtstemplate kann als Basis für Ihre eigene Vorlage dienen. Sie ist sehr umfangreich und enthält Bookmark-Verzeichnisse für die häufigsten Topics Ihrer Untersuchungen. Die Darstellung der verschiedenen Lesezeichen wurde gemäß Kundenwünschen angepasst und kann selbstverständlich weiter optimiert werden.

This EnScript is designed to decode data stored in the HKCU Registry UserAssist sub-key present in Windows XP and later operating systems.

This will add a right click option to unmount a compound file. This can be used to try a different password or just get rid of the additional items. NOTE: Unmounting a compound file will disconnect any bookmarks that were made of items inside the compound file.

This script parses Windows Vista, Windows 7, Windows 8 and Windows 10 thumbcache_*.db files.

Use this script to preview the files and folders on a remote device via a UNC path. Selected files can be added to a LEF.

This EnScript was authored in an attempt to save the examiner the time of manually parsing the System Registry Hive to determine the current control set and then parse the current control set to retrieve the timezone information for each of the evidence files loaded into EnCase Evidence tab.

This Enscript will send selected MD5 hashes to the Team Cymru Malware Hash Registry (MHR) to learn if any might be suspicious, e.g. malware. The results are recorded in the Bookmarks.

Cisco’s AMP Threat Grid Malware Analysis and Intelligence for EnCase® provides direct integration with Threat Grid, the first unified malware analysis and threat intelligence solution. After EnCase® Cybersecurity or EnCase® Analytics has identified an unknown threat on an endpoint with the EnCase® Enterprise platform, Threat Grid provides in-depth analysis and correlates the attack-related artifacts with all other known malicious activities to help analysts quickly investigate and determine if malware resides in other parts of the network or if the incident should be closed. The included Google Chrome Extension can be used to search Threat Grid for suspicious processes, IP addresses, registry keys and domains from EnCase® Cybersecurity or EnCase® Analytics.

ThreatAnalyzer provides best in class dynamic file analysis which enables the investigator to quickly determine any behaviors a given file sample may exhibit, including call outs outlining risk specific to malicious behavior. In addition to rich, descriptive, behavioral output, ThreatAnalyzer also provides detailed reports, file artifacts, and derivatives such as packet captures which may be generated by a file sample as part of the analysis.

This script parses history tables from WebCacheV01.dat Extensible Storage Engine database-files.

This EnScript will find any new or updated EnScripts (based on the last time you visited EnCase App Central) and double-clicking the EnScript’s name will take you to the item’s product page where it can be downloaded.

This script will export and rebuild tagged records into a local file to view with a browser. It searches the file content for linked objects and attempts to find those objects in the records. If the object is found the file content is modified to point to a local exported copy of that object. The folder used is the name of the selected record with the unix date to get a unique name.