I'm trying to crack passwords on EFS encrypted files. I need to use encase and I'm trying to figure out how to export a wordlist of the image. I know its easy in ftk but i need to figure out how to in encase. then i can use this wordlist to put int prtk and hopefully crack them.
thanks for any input you can give.
Index the case, then use sed to put it into the format of one word per line, then use "sort -u" to do a sort-unique.
IIRC, if you first create an index in EnCase, there's an EnScript, either under the Forensic or the Examples folder, that will output a dictionary list for you. The script runs pretty quickly, it's just the indexing that's slow. It's named something like "Create Index Dictionary" or some-such (I'm not booted up in Windows right now so can't double-check).
Jon
How about in Version 7? I do not see the previously offered Enscript to export the index. Any ideas>? Thanks
How about in Version 7?
Version 7? There's no version 7…
Repeat with me
there's not version 7
there's not version 7
there's not version 7
Just a bad dream…
Seriously though, how do I do it in Encase 7?
In case you struggle with EnCase, someone's posted a way to do it quickly with a Python script here
http//
Interesting read.
In EnCase 7, if you have indexed your case
From the tools menu, select Passware Export. The Passware Export will generate a series of items, this will include a text file containing words from the index.