I am looking for application or script file that can scan a partition/drive for instances of standard file types, doc, xls, pdf, ppt, tif, gif, jpg, and others as needed active and/or deleted both. Header analysis is preferred for file type determination. The output report should list number of hits per file type and total ammount of disk space taken up by each file type. I have been doing this manually and would like to know if any of you are using something that automates this.
Encase ENScripts do just that. Of course you need to be using Encase. Downlaod or request a demo CD from their website & take a look at the sample case & test the scripts found in the demo. NB Not all the EnScripts are included in the Demo.
ProDiscover will do the same thing, is less expensive than Encase, and does not require dongle. Like Encase, all it takes is a ProScript…but I find it much easier to write scripts for ProDiscover b/c they're based on Perl.
I wrote a tool myself who does this trick for me. It reports the location of the headers in both blocksizes and "512-byte" sectors, as used by the Autopsy Browser ( http//www.sleuthkit.org )
The tool can be found here
It's written in Perl and uses "file" to identify the headers of the files. Currently it only runs on linux/unix.