I can search for something through
File Name,
Size,
Hash,
Full Path
.....
and
identify files inside zip.
Name | Return Type | Declaration |
---|---|---|
MountVolume | VolumeClass | const MountVolume (uint Options, const String &Password="") |
MountVolume | VolumeClass | const MountVolume (uint Options, CredentialClass credentials) |
- MountVolme -
Mounts a compound file and returns the mounted volume
Arguments:
Options - PERSIST | CALCUNALLOC | SCANDELETED | MOUNTNOPOPUP | RESOLVEPATHS | FORCEKNOWN | SCANJETDIRTY | CREDSCANONLY | SCANRMS
Password - Holds a variable length array of characters
Mounts a compound file and returns the mounted volume
Arguments:
Options - PERSIST | CALCUNALLOC | SCANDELETED | MOUNTNOPOPUP | RESOLVEPATHS | FORCEKNOWN | SCANJETDIRTY | CREDSCANONLY | SCANRMS
credentials - Decryption credentials
I brought it from EnCase Help page.
########################### Code and Result ###########################
Black : Code
Red : Result
######################################################################
//Recurse all entries in the case and perform a 'View File Structure' on files that have an extension of ZIP.
//Print out the paths of the files inside the ZIPs class MainClass; class MainClass { bool good; void Main(CaseClass c) { int notWorks; uint opts; //can be any of EntryClass::MountOptions for(ItemIteratorClass i(c); EntryClass e = i.GetNextEntry();) { if (e.Extension().Compare("zip") == 0) { Console.WriteLine("Mounting " + e.FullPath()); Mounting Console.WriteLine(e.TruePath()); dorumugs\C\Program Files (x86)\Autopsy\java\docs\beansbinding-1.2.1-doc.zip VolumeClass vol = e.MountVolume(opts, ""); //no password. If a zip is password protected, vol will be null if (vol) { forall (EntryClass mountedEntry in vol) { /* notice that the 'FullPath' property is not the same as what the Table View shows. This is because the entries do not become part of the Case's Entry List until AFTER the script ends. The only way to have the entries become part fo the case's entry list immediately is to add the device or evidence file to a case that is not part of the GlobalDataClass::CaseRoot(). */ Console.WriteLine("Entry Name=" + mountedEntry.TruePath()); Console.WriteLine("Entry FullPath=" + mountedEntry.FullPath());
Entry Name=dorumugs\index-files
Entry FullPath=index-files
Entry Name=dorumugs\index-files\index-1.html
Entry FullPath=index-files\index-1.html
Entry Name=dorumugs\index-files\index-10.html
Entry FullPath=index-files\index-10.html
Entry Name=dorumugs\index-files\index-11.html
Entry FullPath=index-files\index-11.html
.
.
.
.
.
} } else { Console.WriteLine("Could Not Mount " + e.FullPath()); notWorks++; } } } if (notWorks == 0) Console.WriteLine("Worked"); Worked else Console.WriteLine("Does not work"); Does not work } } |
---|
No comments:
Post a Comment