Join Us!

Notifications
Clear all

File/Data Map  

  RSS
nate
 nate
(@nate)
New Member

Hello All,
I am looking for application or script file that can scan a partition/drive for instances of standard file types, doc, xls, pdf, ppt, tif, gif, jpg, and others as needed active and/or deleted both. Header analysis is preferred for file type determination. The output report should list number of hits per file type and total ammount of disk space taken up by each file type. I have been doing this manually and would like to know if any of you are using something that automates this.

Thanks
Nate

Quote
Posted : 23/05/2006 2:44 am
MindSmith
(@mindsmith)
Active Member

Encase ENScripts do just that. Of course you need to be using Encase. Downlaod or request a demo CD from their website & take a look at the sample case & test the scripts found in the demo. NB Not all the EnScripts are included in the Demo.

ReplyQuote
Posted : 23/05/2006 1:52 pm
keydet89
(@keydet89)
Community Legend

ProDiscover will do the same thing, is less expensive than Encase, and does not require dongle. Like Encase, all it takes is a ProScript…but I find it much easier to write scripts for ProDiscover b/c they're based on Perl.

Harlan

ReplyQuote
Posted : 23/05/2006 4:17 pm
zon4jou
(@zon4jou)
New Member

I wrote a tool myself who does this trick for me. It reports the location of the headers in both blocksizes and "512-byte" sectors, as used by the Autopsy Browser ( http//www.sleuthkit.org )

The tool can be found here
http//doornenburg.homelinux.net/scripts/blocktype

It's written in Perl and uses "file" to identify the headers of the files. Currently it only runs on linux/unix.

ReplyQuote
Posted : 23/05/2006 9:27 pm
Share: