Thursday, February 7, 2013

EnScript - EntryClass (2)


I can search for something through
File Name,
Size,
Hash,
Full Path
.....

and

identify files inside zip.


Name Return Type Declaration
MountVolume VolumeClass const MountVolume (uint Options, const String &Password="")
MountVolume VolumeClass const MountVolume (uint Options, CredentialClass credentials)

- MountVolme -
Mounts a compound file and returns the mounted volume
Arguments:
Options - PERSIST | CALCUNALLOC | SCANDELETED | MOUNTNOPOPUP | RESOLVEPATHS | FORCEKNOWN | SCANJETDIRTY | CREDSCANONLY | SCANRMS
Password - Holds a variable length array of characters

Mounts a compound file and returns the mounted volume
Arguments:
Options - PERSIST | CALCUNALLOC | SCANDELETED | MOUNTNOPOPUP | RESOLVEPATHS | FORCEKNOWN | SCANJETDIRTY | CREDSCANONLY | SCANRMS
credentials - Decryption credentials




I brought it from EnCase Help page.
###########################  Code and Result  ###########################

Black : Code

Red : Result

######################################################################
//Recurse all entries in the case and perform a 'View File Structure' on files that have an extension of ZIP.
//Print out the paths of the files inside the ZIPs

class MainClass;

class MainClass {
  bool good;
  void Main(CaseClass c) {
    int notWorks;
    uint opts; //can be any of EntryClass::MountOptions
    for(ItemIteratorClass i(c); EntryClass e = i.GetNextEntry();) {
      if (e.Extension().Compare("zip") == 0) {
        Console.WriteLine("Mounting " + e.FullPath());

Mounting 

        Console.WriteLine(e.TruePath());

dorumugs\C\Program Files (x86)\Autopsy\java\docs\beansbinding-1.2.1-doc.zip

        VolumeClass vol = e.MountVolume(opts, ""); //no password.  If a zip is password protected, vol will be null
        if (vol) {
          forall (EntryClass mountedEntry in vol) {
            /*
            notice that the 'FullPath' property is not the same as what the Table View shows.
            This is because the entries do not become part of the Case's Entry List until
            AFTER the script ends.  The only way to have the entries become part fo the case's
            entry list immediately is to add the device or evidence file to a case that is not
            part of the GlobalDataClass::CaseRoot().
            */
            Console.WriteLine("Entry Name=" + mountedEntry.TruePath());
            Console.WriteLine("Entry FullPath=" + mountedEntry.FullPath());


Entry Name=dorumugs\index-files
Entry FullPath=index-files
Entry Name=dorumugs\index-files\index-1.html
Entry FullPath=index-files\index-1.html
Entry Name=dorumugs\index-files\index-10.html
Entry FullPath=index-files\index-10.html
Entry Name=dorumugs\index-files\index-11.html
Entry FullPath=index-files\index-11.html
                        .
                        .
                        .
                        .
                        .


          }
        }
        else {
          Console.WriteLine("Could Not Mount " + e.FullPath());
          notWorks++;
        }
      }
    }
    if (notWorks == 0)
      Console.WriteLine("Worked");

Worked

    else
      Console.WriteLine("Does not work");

Does not work

  }
}




No comments:

Post a Comment