Archaeological Dig for Digital Forensics: ItemIteratorClass

Thursday, February 7, 2013

EnScript - EntryClass (2)

I can search for something through
File Name,
Size,
Hash,
Full Path
.....

and

identify files inside zip.

Name	Return Type	Declaration
MountVolume	VolumeClass	const MountVolume (uint Options, const String &Password="")
MountVolume	VolumeClass	const MountVolume (uint Options, CredentialClass credentials)

I brought it from EnCase Help page.
########################### Code and Result ###########################

Black : Code
Red : Result

######################################################################

//Recurse all entries in the case and perform a 'View File Structure' on files that have an extension of ZIP.
//Print out the paths of the files inside the ZIPs

class MainClass;

class MainClass {
bool good;
void Main(CaseClass c) {
int notWorks;
uint opts; //can be any of EntryClass::MountOptions
for(ItemIteratorClass i(c); EntryClass e = i.GetNextEntry();) {
if (e.Extension().Compare("zip") == 0) {
Console.WriteLine("Mounting " + e.FullPath());

Mounting

Console.WriteLine(e.TruePath());

dorumugs\C\Program Files (x86)\Autopsy\java\docs\beansbinding-1.2.1-doc.zip

VolumeClass vol = e.MountVolume(opts, ""); //no password. If a zip is password protected, vol will be null
if (vol) {
forall (EntryClass mountedEntry in vol) {
/*
notice that the 'FullPath' property is not the same as what the Table View shows.
This is because the entries do not become part of the Case's Entry List until
AFTER the script ends. The only way to have the entries become part fo the case's
entry list immediately is to add the device or evidence file to a case that is not
part of the GlobalDataClass::CaseRoot().
*/
Console.WriteLine("Entry Name=" + mountedEntry.TruePath());
Console.WriteLine("Entry FullPath=" + mountedEntry.FullPath());

Entry Name=dorumugs\index-files

Entry FullPath=index-files

Entry Name=dorumugs\index-files\index-1.html

Entry FullPath=index-files\index-1.html

Entry Name=dorumugs\index-files\index-10.html

Entry FullPath=index-files\index-10.html

Entry Name=dorumugs\index-files\index-11.html

Entry FullPath=index-files\index-11.html

}
}
else {
Console.WriteLine("Could Not Mount " + e.FullPath());
notWorks++;
}
}
}
if (notWorks == 0)
Console.WriteLine("Worked");

Worked

else
Console.WriteLine("Does not work");

Does not work

}
}

Wednesday, February 6, 2013

EnScript - EntryClass (1)

I can search for something through
File Name,
Size,
Hash,
Full Path
ETC.............

BookmarkClass

Name	Return Type	Declaration
BookmarkClass	void	BookmarkClass (BookmarkClass parent=null, const String &Name="", uint Options=0)

- BookmarkClass -
parent - The parent folder for this node
Name - Name
Options - 32-bit unsigned integer

ItemIteratorClass

Name	Return Type	Declaration
ItemIteratorClass	ItemIteratorClass	ItemIteratorClass ()
ItemIteratorClass	ItemIteratorClass	ItemIteratorClass (CaseClass _case, uint Options=0, IterateModes mode=ItemIteratorClass::ALL, const String &Name="")
ItemIteratorClass	ItemIteratorClass	ItemIteratorClass (DeviceClass Device, uint Options=0)

Name	Return Type	Declaration
Compare	int	const Compare (const String &Text, uint Options=0)
Contains	bool	const Contains (const String &Expression)
Name	string	static File Name (const String & Name)

- Compare -
Returns < 0 if value is lexically less than, 0 if equal, > 0 if greater
Arguments:
Text - Input string
Options - CASE

- Contain -
Returns true if text is contained in this string
Arguments:
Expression - Search Expression

- Name -
Format string with argument
Arguments:
Format - File Name string

When you test this code, you must select items as picture.

I brought it from EnCase Help page.
########################### Code and Result ###########################

Black : Code
Picture : Result

#######################################################################

//Recurse all entries and bookmark entries named 'win.ini'

class MainClass;

class MainClass {
bool good;
void Main(CaseClass c) {
BookmarkClass folder(c.BookmarkRoot(), "EntryClass Example 1", NodeClass::FOLDER);

for(ItemIteratorClass i(c); EntryClass e = i.GetNextEntry();) {
if (e.Name() == "win.ini") {

BookmarkClass newMark(folder);
newMark.CopyItemData(e);
newMark.SetComment("Bookmarked win.ini");

good = true;
}
}
if (good)
Console.WriteLine("Worked");
else
Console.WriteLine("Does not work");
}

}