EnCase bookmarks en...
 
Notifications
Clear all

EnCase bookmarks en masse

10 Posts
5 Users
0 Likes
693 Views
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
Topic starter
 

Is there a way to create bookmarks from a text file in EnCase 6.18/6.19?

Maybe an EnScript, or global setting or something? cry

 
Posted : 30/07/2013 1:08 am
(@twjolson)
Posts: 417
Honorable Member
 

What is the file? What deliniates the start and end of the bookmarks?

 
Posted : 30/07/2013 6:04 am
PaulSanderson
(@paulsanderson)
Posts: 651
Honorable Member
 

The current dev version of Reconnoitre imports a list of C4P carved files from a text file (exported from C4P) to show which files within a shadow copy contains the files identified by C4P - e.g. Reconnoitre will show a graphic embedded within a word document that is within a shadow copy.

Although I don't use it, the C4P encase files also include an enscript that will import this bookmark text file and highlight/bookmark the bytes (but only the SVI file - not the word doc witin the SVI in the example above) that comprise the file. This enscript would be quite easy to modify to your requirements.

 
Posted : 30/07/2013 2:28 pm
Chris_Ed
(@chris_ed)
Posts: 314
Reputable Member
 

Hi jhup,

In the past I have created EnScripts which will create bookmarks from either

- Filename
- Full path
- Sector

To "move" bookmarks between .case files I have an "export" and "import" script.

Let me know if you want a copy of any of them.

Chris

 
Posted : 30/07/2013 2:55 pm
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
Topic starter
 

What is the file? What deliniates the start and end of the bookmarks?

The file is a low-ASCII text file containing the list of EnCase Bookmark folder names I wish to create in order.
A carriage return and line feed character set delineates start and end of the items within the text file, and therefore the Bookmarks.
For example in the following fashion

Bookmark A
Bookmark B
Bookmark B\Bookmark B.1
Bookmark B\Bookmark B.2
Bookmark B\Bookmark B.2\Bookmark B.2.a
Bookmark B\Bookmark B.2\Bookmark B.2.b
Bookmark C
Bookmark D
Bookmark E

The current dev version of Reconnoitre imports a list of C4P carved files from a text file (exported from C4P) to show which files within a shadow copy contains the files identified by C4P - e.g. Reconnoitre will show a graphic embedded within a word document that is within a shadow copy.

Although I don't use it, the C4P encase files also include an enscript that will import this bookmark text file and highlight/bookmark the bytes (but only the SVI file - not the word doc witin the SVI in the example above) that comprise the file. This enscript would be quite easy to modify to your requirements.

Thank you Mr. Sanderson. I will look into how C4P/C4M allows the use of their scripts outside of their licensing schema.

Hi jhup,

In the past I have created EnScripts which will create bookmarks from either

- Filename
- Full path
- Sector

To "move" bookmarks between .case files I have an "export" and "import" script.

Let me know if you want a copy of any of them.

Chris

I just need one that would take a text file and create Bookmarks from that set. Nested or sub bookmarks would be nice.

 
Posted : 30/07/2013 4:57 pm
Chris_Ed
(@chris_ed)
Posts: 314
Reputable Member
 

Oh, I see. I'm not sure if the functionality exists to export bookmarks like you might do keywords or hash sets - how would the "import" script know which files to bookmark, for example?

 
Posted : 30/07/2013 5:52 pm
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
Topic starter
 

Oh, I see. I'm not sure if the functionality exists to export bookmarks like you might do keywords or hash sets - how would the "import" script know which files to bookmark, for example?

I do not need it to bookmark, just create the folders within the Bookmark section.

Imagine instructing a platoon, each running EnCase.
For the reports to look identical across all of the members, we would like a quick way to generate the "skeleton" for the report. This would be one less step for them to do.

Since the SOP is consistent across, they would all need all the folders in the Bookmark section, with or without anything actually bookmarked for those folders.

 
Posted : 30/07/2013 6:08 pm
PaulSanderson
(@paulsanderson)
Posts: 651
Honorable Member
 

Thats easy then )

class MainClass {
void Main(CaseClass c) {

BookmarkFolderClass folder1, folder2, folder3;
folder1 = new BookmarkFolderClass(c.BookmarkRoot(), "folder 1");
folder2 = new BookmarkFolderClass(c.BookmarkRoot(), "folder 2");
folder3 = new BookmarkFolderClass(folder2, "folder 3");
}
}

 
Posted : 30/07/2013 6:27 pm
(@angrybadger)
Posts: 164
Estimable Member
 

easy?
pulls in text file and creates the folders.

class MyDialog DialogClass {

PathEditClass _file1;
String textfile, bmName;
StringEditClass _Edit1,
_Edit2;
MyDialog()
DialogClass(null, "Import text file as Bookmarks"),
_file1(this, "Select the text file you wish to import",START, NEXT, 250, 12, 0, textfile , WindowClassFILEOPEN),
_Edit2(this, "BookMark Folder Name", START, NEXT, 160, DEFAULT, 0, bmName, 19, WindowClassREQUIRED)

{

}
}

class MainClass {
BookmarkFolderClass bkmarks;
typedef EntryClass[] EntryArray;

void MakeBookmarkPath( String path, BookmarkFolderClass bmf ) {
if (path.GetLength() == 0)
return;

BookmarkFolderClass nbmf;
String head, tail;

int firstSlash = path.Find("\\");

if (firstSlash == 0 )
MakeBookmarkPath( path.SubString( 1) ,bmf );

head = path.SubString(0, firstSlash);
tail = path.SubString( firstSlash + 1 );

nbmf = bmf.Find(head);

if ( !nbmf)
nbmf = new BookmarkFolderClass(bmf, head);

if ( firstSlash != -1 )
MakeBookmarkPath( tail, nbmf );

}

void Main(CaseClass c) {
LocalFileClass local();

String line;
MyDialog dialogbox();

int i;
i = 0;

if (dialogbox.Execute() == SystemClassOK){

bkmarks = new BookmarkFolderClass(c.BookmarkRoot(), dialogbox.bmName);

if (local.Open(dialogbox.textfile)){

local.SetCodePage(0);

while (local.Peek() != FileClassEOF) {

local.ReadString(line, 2048, "\r");

line.Replace("\n","");
line.Replace("\r","");
line.Replace("\t","");

MakeBookmarkPath( line, bkmarks );

}
}
}
}
}

 
Posted : 30/07/2013 7:21 pm
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
Topic starter
 

Awesome gents. I will test it out tomorrow and see how this works.

 
Posted : 31/07/2013 7:05 am
Share: